Custom User Level

SailPoint Human Fabric (SHF) SHF Discussion and Questions
1

I’m trying to create a custom role for source read only - to view all sources, schemas under connections using the below API but getting the error,

curl --location --request POST ‘https://{tenant}’
–header ‘Content-Type: application/json’
–header ‘X-SailPoint-Experimental: true’
–header ‘Authorization: Bearer XXXXXXXXX’
–data-raw ‘{
“name”: “Source Read Only”,
“description”: “Provides access to view all sources and schemas under connections without edit or aggregate rights”,
“owner”: {
“id”: “”,
“type”: “IDENTITY”
},
“rightSets”: [
“idn:source:read”,
“idn:source-schema:read”
]
}’

2

Hi @ssel

What error are you getting? Also, please confirm if the API below is the one you’re trying to use. I can’t see the full Url from what you’ve provided.

3

Yes, I’m using the exact endpoint but not getting any response code after the request sent

image
image667×1389 64.5 KB

4

I replicated your call and I think the issue is due to the “rightSets” you have selected. Make sure you’re using valid right sets that can be assigned. You can get the list of them using this API:

For example, I did this call and worked for me:

{
  "name": "Source Read Only",
  "description": "Provides access to view all sources and schemas under connections without edit or aggregate rights",
  "owner": {
    "id": "",
    "name": ""
  },
  "rightSets": [
"idn:ui-identity-management-read",
"idn:ui-identity-accounts-read"
  ]
}
5

That works, however do we have any rightsets specific to sources to view all of it and it’s configuration, schema , aggregation status?

6

Good to hear! Unfortunately, I don’t see any specific to only sources. This is all that I pulled out of the API:

idn:ui-identity-management-read
idn:ui-identity-management-write
idn:ui-identity-access-history-page-read
idn:ui-access-profiles-read
idg:ui-admin
idn:ui-access-intelligence-center-page-write
idn:ui-password-sync-group-read
idn:ui-access-entitlements-write
idn:ui-virtual-appliance-clusters-read
idn:ui-access-roles-read
idg:ui-read-only
idn:ui-virtual-appliance-clusters-write
idn:ui-password-sync-group-write
idn:ui-access-entitlements-read
idn:ui-identity-accounts-read
idn:ui-access-profiles-write
idn:ui-access-roles-write
idn:ui-password-policy-write
idn:ui-access-intelligence-center-page-read
idn:ui-identity-accounts-write
idn:ui-password-policy-read

I think one of the OOTB roles might come closer to your needs, maybe “Source Configuration Assignee” or “Source_Admin”, but these both still give access to make modifications to configuration. User Level Matrix: User Level Access Matrix - SailPoint Identity Services