Disabling serviceNow application account not removing the entitlements

[mayurimenkar]

Which IIQ version are you inquiring about?

Version 8.3

Share all details related to your problem, including any error messages you may have received.

Hi All, in current implementation we are removing all roles adn entittlments and disabling applicaiton accounts when user leaves the organization. However it is not working sa expected in case of serviceNow application. The account is getting disabled but the entitlements(groups) can still be seen as provisioned to the user in IIQ.
Any specifix reason for this. How can we remove those groups in target.
Thanks!

[kjakubiak (Kamil Jakubiak)]

Hi Mayuri,
IIQ by default when executing DISABLE operation - disables account, it’s not removing anything from it. The easiest way to do that would be to write BeforeProvisioningRule where in case of DISABLE operation you add MODIFY operation to remove entitlements.

The rule would look similar to this:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Rule language="beanshell" name="RemoveEntitlementsOnDisable" type="BeforeProvisioning">
  <Source>
  import sailpoint.object.ProvisioningPlan;
	import sailpoint.object.ProvisioningPlan.ObjectRequest;
	import sailpoint.object.ProvisioningPlan.ObjectOperation;
	import sailpoint.object.ProvisioningPlan.AttributeRequest;
	import sailpoint.object.ProvisioningPlan.Operation;
	String entitlementAttribureName = "role";
	List newAccountRequests = new ArrayList();
	List accountRequests = plan.getAccountRequests();

	for(AccountRequest accountRequest : accountRequests) {
 	 if(accountRequest.getOperations().equals(ProvisioningPlan.AccountRequest.DISABLE)) {
      AccountRequest newAccountRequest = new AccountRequest();
      newAccountRequest.setOperation(ProvisioningPlan.AccountRequest.MODIFY);
      newAccountRequest.add(new AttributeRequest(entitlementAttributeName,Operation.Set,null));
      newAccountRequest.setNativeIdentity(accountRequest.getNativeIdentity()); 
      newAccountRequests.add(newAccountRequest);
     }
    }
if(!newAccountRequests.isEmpty()) {
  for(AccountRequest accountRequest : newAccountRequests) {
    plan.add(accountRequest);
  }
}
      </Source>
</Rule>

if setting entitlementAttribute to null will not work then you will have to get all current entitlements from the link, iterate over them and for each value create separate AttributeRequest with REMOVE operation - like that

List links = identity.getLinks();
for(Link link : links) {
if(link.getApplicationName().equals(accountRequest.getApplication()) && link.getNativeIdentity().equals(accountRequest.getNativeIdentity()) {
      newAccountRequest.add(new AttributeRequest(entitlementAttributeName,Operation.Remove,link.getAttribute(entitlementAttributeName)));
}
}