Get group/entitlement value for create user

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hello,

We are currently integrating Prisma with sailpoint ISC and we have problem getting group/entitlement ID for body in http request, the requirement for API create operation is getting group/entitlement ID and put in the parameter. The JSON raw structure is currently like this

{
"accessKeysAllowed": true,
"defaultRoleId": "string",
"email": "string",
"firstName": "string",
"lastName": "string",
"roleIds": [
"string"
],
"timeZone": "string"
}'

defaultRoleId, and roleIds value is the group/entitlement ID that assigned to the user I have been using $plan.groups$ but its not working, any suggestion for this?

Thank You

2

Hi

If it is not working as expected, then use web service before operation rule to achieve this:

  1. Get account requests and attribute requests.
  2. Get the requested groups from the attributes request.
  3. Get the current create account body. and replace roleIds value.
  4. Then update body using requestEndPoint.

Refer : Web Services Before Operation Rule

3

Hi @Tieasna

The $plan variable depends on the naming in your schema. Can you show us what your account and entitlement schema look like?

4

Here is my Account and entitlement schema looks

image
image1592×632 94.3 KB

image
image1576×398 101 KB

5

Hi @Tieasna

you can use $plan.RoleId$ attribute to retrieve the values in the HTTP operation.

6

Try below:
{
"accessKeysAllowed": true,
"defaultRoleId": "string",
"email": "string",
"firstName": "string",
"lastName": "string",
"roleIds": [
"$plan.roles$"
],
"timeZone": "string"
}'

7

Hello,

it’s not working, it send no value

8

Please check the box. Create Account with Ent request in Additional Settings. Let me know if it fixes the issue

17821922707253828887554259153457
17821922707253828887554259153457459×362 4.78 KB

9

Hello @Tieasna

By default, the Web Services connector creates the account first and then sends entitlement requests separately. SailPoint documents createAccountWithEntReq as false by default, and says enabling it sends entitlements with the Create Account request in a single call: Additional Configuration Parameters

So for your case, enable Create Account with Ent Request / createAccountWithEntReq=true, then use the entitlement attribute name from your schema in the body. Since your entitlement attribute appears to be RoleId, test with something like:

"roleIds": [
  "$plan.RoleId$"
]

This should work for a single role. If you are assigning multiple roles, or Prisma needs a different structure like defaultRoleId plus roleIds, use a Web Services Before Operation Rule to read the provisioning plan and update the request body before the call is sent. SailPoint’s Before Operation Rule doc confirms the rule receives the provisioningPlan and requestEndPoint, and can update the HTTP payload: Before Operation Rule

So I would do it in this order:

  1. Enable createAccountWithEntReq.
  2. Use $plan.RoleId$ since that matches your entitlement schema.
  3. Use a Before Operation Rule only if you need to reshape the value into defaultRoleId / roleIds exactly as Prisma expects.