Form & Workflow combination to onboard non-employees

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi All,

I am looking for some help to build a workflow which can be utilized to create an identity upon form submission. I don’t know even if it’s possible as Workflow doesn’t have action to create identity. So, I am looking for some suggestions around this.

Thanks in advance!!!

2

Hey Mahesh,

This is possible. Like you said, create a form to collect the identity data from the user. Then trigger the workflow to start when the form is submitted. In that workflow:

  • You’re right, you can’t create identities directly. However,
  • You can use the HTTP Request action to call an external API (such as creating the identity within an authoritative source, SailPoint would then later aggregate it back in)
  • If AD is the master, you can use a Powershell script.

If these don’t fit your use case, you could also setup an authoritative source with a delimited file type. Write your new identity from the workflow to this.

3

What is your Auth source for Non-employees? Depending on this your approach would change

4

Hi @daltonherriman ,

thanks for the suggestion. We don’t have any authoritative source for non-employees. We are expecting to create identity in SailPoint and then we can manage non-employee lifecycle via lifecycle state.

5

Hi @iamology ,

We don’t have any authoritative source for non-employees. We want to create Identity in SailPoint and then use lifecycle-state to manage the non-employees.

6

Hi @maheshtare

You cannot directly create identities in SailPoint ISC. Identities must originate from an authoritative source.

For your requirement, you can either set up a flat file source or a NELM source to serve as the authoritative source for identity creation. Within your workflow, you can then leverage APIs to create accounts in the flat file or NELM source, which in turn will create an identity in SailPoint ISC.

7

Hey Mahesh,

Identities need to come from an authoritative source. As Ujjwal said, you can create a flat file source to use. That way you have complete control of the identities.

8

Thanks @UjjwalJain & @daltonherriman , will try and let you know.

9

Hi @iamology, @UjjwalJain & @daltonherriman ,

Thanks for the suggestions. We tried the suggested options & It is working as expected. However, can you please help me with following use-case.

  1. There should be a form through which managers/SailPoint admins should update the end date of the identity.

FYI, We have created a separate delimited file authoritative source for non-employees and identities will be created into it using combinations of form + workflows.

10

Hi @maheshtare,

You can use interactive triggers (via Launchpad) to initiate a form that lets the user select an identity and specify an end date. Once the form is submitted, configure your workflow with the appropriate steps to retrieve the flat file account and update the end date attribute for that user.

Refer to below documentations for more information:

11

Hi @UjjwalJain ,

Appreciate your quick response. Is it possible to display the entire identity details if we select specific identity.

Idea is managers should actually see the end date/ last name before actually making the changes.

12

There are several mentions in this thread of the NELM source. Have you explored that? It has a built in form for both creating and updating non-employees. There are some limitations, such as required attributes that you can’t remove from the source, but otherwise it’s a prebuilt solution that sounds like it fits your needs.

Just trying to save you some dev time, if possible.

13

That’s also possible, but it will require submitting two forms: the first for identity selection, and then a second form displaying the user details.

1 Like
14

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.