Entitlement removal workflow issue

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi,

Below workflow is developed to remove all the entitlement of the user when the user LCS state changes to “lapsed”. It is removing the entitlements when I have entered the identity value inside the “Manage access loop”. It is not working when I give variable as “$.loop.context.trigger.identity.id” . Can anyone guide me here?

{
	"name": "Lapsed Entitlement Removal",
	"description": "This workflow will remove all entitlements of lapsed users.",
	"modified": "2023-11-13T13:59:55.902539822Z",
	"modifiedBy": {
		"type": "IDENTITY",
		"id": "9ccdea463acd483c9e100ebda16f3f18",
		"name": "harish.govindaraj"
	},
	"definition": {
		"start": "Get Identity",
		"steps": {
			"Compare Strings": {
				"choiceList": [
					{
						"comparator": "StringEquals",
						"nextStep": "Get Access",
						"variableA.$": "$.getIdentity.attributes.cloudLifecycleState",
						"variableB": "lapsed"
					}
				],
				"defaultStep": "End Step — Failure",
				"type": "choice"
			},
			"End Step — Failure": {
				"failureName": "Failure",
				"type": "failure"
			},
			"End Step — Success 1": {
				"description": "Success",
				"type": "success"
			},
			"Get Access": {
				"actionId": "sp:access:get",
				"attributes": {
					"accessprofiles": false,
					"entitlements": true,
					"getAccessBy": "specificIdentity",
					"identityToReturn.$": "$.getIdentity.id",
					"roles": false
				},
				"nextStep": "Loop",
				"type": "action",
				"versionNumber": 1
			},
			"Get Identity": {
				"actionId": "sp:get-identity",
				"attributes": {
					"id": "b57dc232aee041f39610f732797138e3"
				},
				"nextStep": "Compare Strings",
				"type": "action",
				"versionNumber": 2
			},
			"Loop": {
				"actionId": "sp:loop:iterator",
				"attributes": {
					"context.$": "$",
					"input.$": "$.getAccess.accessItems",
					"start": "Manage Access",
					"steps": {
						"End Step — Success": {
							"description": "Success inside loop",
							"type": "success"
						},
						"Manage Access": {
							"actionId": "sp:access:manage",
							"attributes": {
								"comments": "Removal in lapsed",
								"removeIdentity.$": "$.loop.context.trigger.identity.id",
								"requestType": "REVOKE_ACCESS",
								"requestedItems.$": "$.loop.loopInput"
							},
							"nextStep": "End Step — Success",
							"type": "action",
							"versionNumber": 1
						}
					}
				},
				"nextStep": "End Step — Success 1",
				"type": "action",
				"versionNumber": 1
			}
		}
	},
	"creator": {
		"type": "IDENTITY",
		"id": "9ccdea463acd483c9e100ebda16f3f18",
		"name": "harish.govindaraj"
	},
	"trigger": {
		"type": "EVENT",
		"attributes": {
			"attributeToFilter": "cloudLifecycleState",
			"filter.$": "$.changes[?(@.attribute == \"cloudLifecycleState\")]",
			"id": "idn:identity-attributes-changed"
		}
	}
}

Thanks,
Harish G

2

Hi @Harish_accenture – I compared what you have to my working entitlement removal workflow. This is what I have for my loop step, you may need to just change what you have with the context variable and the removeIdentity:

            "Loop": {
                "actionId": "sp:loop:iterator",
                "attributes": {
                    "context.$": "$.trigger.identity",
                    "input.$": "$.getAccess.accessItems",
                    "start": "Manage Access",
                    "steps": {
                        "End Step — Success 1": {
                            "type": "success"
                        },
                        "Manage Access": {
                            "actionId": "sp:access:manage",
                            "attributes": {
                                "comments": "Removed due to emergency termination.",
                                "removeIdentity.$": "$.loop.context.id",
                                "requestType": "REVOKE_ACCESS",
                                "requestedItems.$": "$.loop.loopInput"
                            },
                            "description": "Removes all entitlements assigned to the terminated user.",
                            "nextStep": "End Step — Success 1",
                            "type": "action",
                            "versionNumber": 1
                        }
                    }
                },
                "nextStep": "End Step — Success",
                "type": "action",
                "versionNumber": 1
            }

Thanks,

Alex King

1 Like
3

Thanks for your help!

4

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.