Hi all,
I am trying to find out disabled identities that have active application links and entitlements. Can someone help me with a code snippet?
Or is there any OOTB report?
Thanks in advance
@rishavghoshacc Try this OOTB report Identity Effective Access Live Report. If your identity status attribute is searchable then it will be shown in identity extended properties section, there you can select status and run the report.
Try below filter to fetch the inactive users who has active application links
QueryOptions qo = new QueryOptions();
qo.addFilter(Filter.eq("inactive", true));
qo.addFilter(Filter.notnull("name"));
qo.addFilter(Filter.notnull("links.application.name"));
qo.addFilter(Filter.ne("links.application.name", ""));
qo.addFilter(Filter.ne("links.iiqDisabled",true));
For full code you can check below reference post
@vemadeepak I would also need to get the app name for the link that is still active. For that I would need to iterate over all the links of the identity.
Is there a way to optimize the part where I can directly get the app name too?
Can you please try this code,
import sailpoint.object.Identity;
import sailpoint.object.Link;
import sailpoint.object.Application;
import sailpoint.object.Schema;
import sailpoint.object.AttributeDefinition;
import sailpoint.object.QueryOptions;
import sailpoint.object.Filter;
import sailpoint.tools.Util;
import java.util.Iterator;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.util.HashMap;
import java.util.Collection;
// Set to a specific source/app name if needed, else null for all apps
String targetApplication = null; // Example: “Active Directory”
List results = new ArrayList();
// Query only inactive identities first
QueryOptions qo = new QueryOptions();
qo.addFilter(Filter.eq(“inactive”, true));
Iterator it = null;
try {
it = context.search(Identity.class, qo);
while (it.hasNext()) {
Identity identity = (Identity) it.next();
if (identity == null) {
continue;
}
List links = identity.getLinks();
if (Util.isEmpty(links)) {
continue;
}
for (Object obj : links) {
Link link = (Link) obj;
if (link == null) {
continue;
}
Application app = link.getApplication();
if (app == null) {
continue;
}
// Optional application/source filter
if (targetApplication != null && !targetApplication.equals(app.getName())) {
continue;
}
// ACTIVE link check
// This works properly only if IIQDisabled is populated by the source/connector
if (link.isDisabled()) {
continue;
}
// Read entitlement attributes from the account schema
Schema accountSchema = app.getAccountSchema();
List entitlementValues = new ArrayList();
if (accountSchema != null) {
List schemaAttrs = accountSchema.getAttributes();
if (!Util.isEmpty(schemaAttrs)) {
for (Object attrObj : schemaAttrs) {
AttributeDefinition attrDef = (AttributeDefinition) attrObj;
if (attrDef == null) {
continue;
}
// Only source attributes marked as entitlements
if (attrDef.isEntitlement()) {
Object value = link.getAttribute(attrDef.getName());
if (value == null) {
continue;
}
if (value instanceof Collection) {
for (Object v : (Collection) value) {
entitlementValues.add(attrDef.getName() + "=" + String.valueOf(v));
}
} else {
entitlementValues.add(attrDef.getName() + "=" + String.valueOf(value));
}
}
}
}
}
// Only keep rows where active link has entitlements
if (!Util.isEmpty(entitlementValues)) {
String entCsv = "";
for (int i = 0; i < entitlementValues.size(); i++) {
if (i > 0) {
entCsv += ", ";
}
entCsv += String.valueOf(entitlementValues.get(i));
}
Map row = new HashMap();
row.put("identityName", identity.getName());
row.put("displayName", identity.getDisplayName());
row.put("application", app.getName());
row.put("nativeIdentity", link.getNativeIdentity());
row.put("entitlements", entCsv);
results.add(row);
}
}
}
} finally {
if (it != null) {
Util.flushIterator(it);
}
}
return results;
@rishavghoshacc You can configure a custom report of data source on Link Object, and you can add a filters on identity status and schedule the report. Let me see if i have a sample i’ll share it here.
Check below blog to acheieve with Active Specific Application.
try fliter like below application name used filter.in anything available. also add the logic for entitlement based on identity
QueryOptions qo = new QueryOptions();
qo.addFilter(Filter.eq(“inactive”, true));
qo.addFilter(Filter.and(Filter.eq(“links.application.name”, “Active Directory”),Filter.ne(“links.iiqDisabled”, true)));
// Execute the search
Iterator linkAcc = new IncrementalObjectIterator(context, Identity.class, qo);
List listofAttr=new ArrayList();
int count =0;
while(linkAcc.hasNext()){
listofAttr.add(linkAcc.next().getName());
count ++;
}
I have seen quickest way to get this information is to use SQL query (if you can access IIQ DB even as read only).
Something like below should get you what you need
select id.name 'Inactive Identity',l.display_name 'Active Account ID',app.name 'Application'
from spt_link l, spt_application app, spt_identity id
where l.application = app.id
and l.identity_id = id.id
and l.iiq_disabled =0
and id.inactive = 1
and app.authoritative = 0;
This is working solution. Please try from custom rule. It should work.
@rishavghoshacc shared a sample report. please check and let us know for any further issues.
@SivaprakashRNTBCI - Identity Effective Access Live Report does not show account status. It is helpful to see the role and entitlements assigned to users.