Delect create event from CreateIdentity Form

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Share all details about your problem, including any error messages you may have received.

Hello everyone,

We have a use case regarding identities that are created manually through the IdentityCreate Fomr .

Context:

  • The identity is successfully created in IdentityIQ.
  • However, the Identity Trigger (with Create Event) is not triggered for these newly created identities.
  • The same trigger works correctly for identities coming from our authoritative source during aggregation/Identity Refresh.

Our goal is to detect the creation of an External Identity in order to automatically launch a workflow.

Is there any configuration that should be made , or develope a new logic to detect identities created from the IdentityCreate form ?

Best reguard

2

@alshahim04 Could you please share the identity trigger xml?

Also check both newly created identites: one you created using form vs one came via aggregation and see if needsCreateProcessing flag is being set to true or not?

3

Hello Alshahim. The Create event is evaluated during Identity Refresh with Process Events enabled. The identity created through the CreateIdentity form does not appear to receive the same new-identity trigger marker that aggregation creates, so the Create event is not detected.

For this use case, I would copy and customize LCM Create and Update, then add a step after the identity has been successfully created to launch your external-identity workflow. You can add a condition so it runs only for external identities.

I think this is more reliable than manually changing the internal triggerSnapshots map and also runs immediately without waiting for an Identity Refresh.

4

@punna0001 In case you don’t want to set the flags, you can actually call the joiner workflow from the workflow associated with the create form. this’ll bypass all joiner trigger conditions and will take of your joiner operations.

5

IdentityTrigger objects (Create/Delete/etc) are only evaluated by sailpoint.api.Identitizer when its checkTriggers flag is set to true. That flag is turned on automatically in two places:

  • Aggregation tasks and “Refresh Identity Cube” tasks —

i would suggest, Don’t try to make the LCM refresh step “inherit” trigger processing — it’s more reliable to explicitly invoke the Identitizer with triggers forced on, right after the identity is created.

Solution;

1. Create a BeanShell rule (Rule type: Workflow), e.g. Force Trigger Processing On Create:

import sailpoint.api.Identitizer;
import sailpoint.object.Identity;
import sailpoint.object.Source;

Identity newIdentity = context.getObjectByName(Identity.class, identityName);

if (newIdentity != null) {
    Identitizer identitizer = new Identitizer(context);
    identitizer.setProcessTriggers(true);
    identitizer.setRefreshSource(Source.LCM, "Create Identity Form");
    identitizer.refresh(newIdentity);
}

return null;



2. Add a Step in the C workflow, right after the identity is committed/provisioned (after the Provision step, before workflow completion):

<Step name="Force Trigger Evaluation" icon="task">
    <Arg name="identityName" value="ref:identityName"/>
    <Script>
        <Source>
            import sailpoint.object.Rule;
            Rule rule = context.getObjectByName(Rule.class, "Force Trigger Processing On Create");
            Map params = new HashMap();
            params.put("identityName", identityName);
            context.runRule(rule, params);
        </Source>
    </Script>
    <Transition to="End"/>
</Step>

try it and let me know if it works

6

How is it different than calling the joiner workflow directly?

7

Hi @alshahim04 We have a similar use case that we implemented using the joiner trigger rule. Just add the logic that needs to return true when a new identity is created in the external system. It is working fine in our case, and I hope it will work for you, too. Try to enhance the joiner trigger rule.

Thanks,

PVR.