Fetching specific entitlements in workflows

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi

I have a requirement to create a workflow like this:

  1. Trigger: cloudLifecycleState changed to inactive
  2. Disable AD account and remove all the AD groups that start with “AD-CA-”

The part where I have a doubt is how to remove the groups that start with “AD-CA-” ?

Regards
Arshdeep

2

@arshdeep_thapar

You would need to use loop operator to iterate through all the entitlement that user has on source and then use a compare string operator to identify if entitlement name starts with “AD-CA” and then remove via access request action.

Note: I would recommend to use before provisioning rule or native rules (connector after modify) of AD to achieve this as it will be a lot easier to do it than on workflow.

2 Likes
3

Try this JSON path to remove all the access starting with “AD-CA-”

$.getAccess.accessItems[?(@.name =~ /^AD-CA-/)]

P.S the below image on where and how this has been added.

image
image703×560 28.3 KB

Hope this helps…

2 Likes
4

@neeraj99 thanks for your response.
Would this not give an inaccurate result in case the user’s entitlements are more than 250?

5

Thanks for your response @Anshu_Kunal . Would the loop work for more than 250 entitlements. I have seen in the documentation that there is a limit for 250 entitlements usually for some REST APIs. Is it the same for loop?

6

@arshdeep_thapar yes, there is a limit in loop also.

For example, if the first step in your loop is Manage Access, select an array of access items such as the accessItems object returned by the Get Access step. The array you select can contain no more than 100 items. If an item in this list is larger than 512KB, that item will fail when the loop is executed.

1 Like
7

thanks Anshu for your response. I think SailPoint should come up with a way if the entitlement list is huge. How to run a loop over that. That’s my doubt.

8

@arshdeep_thapar
You may want to take a look at this thread

https://developer.sailpoint.com/discuss/t/alternative-ways-to-match-the-limitation-of-worflow-loop-allowing-100-iterations/23847/3