Get multiple entitlements in access request within the same plan

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

I am sending this as an access request

{
  "requestedFor": [
    "2c************6f89"
  ],
  "requestedItems": [
    {
      "id": "02***********c1a",  //first entitlement
      "type": "ENTITLEMENT",
      "comment": "Hello, this is a comment",
      "clientMetadata": {
        "servicenow": "This is servicenow client metadata"
      }
    },
    {
      "id": "919d********************e63",  //2nd entitlement
      "type": "ENTITLEMENT",
      "comment": "Hello, this is a comment",
      "clientMetadata": {
        "servicenow": "This is servicenow client metadata"
      }
    }
  ],
  "requestType": "GRANT_ACCESS",
  "clientMetadata": {
    "ticketno": "This is another set of tikcet no"
  }
}

The problem here is both these entitlements go in as two different plans in my provisioning rule code. Due to this the first one becomes a create operation and second one becomes a modify. Cant we make them both come in within the same plan ?

2

This is by design. Access requests with multiple items will be broken out into individual operations for the backend to process.

The reason for this is that approval processes for access items can have different approval chains and timelines, and we were seeing issues with large access requests having to wait for all approvals for all items to complete before the items were provisioned. This is how it works right now, but it may be improved in the future to allow more control over how these items are processed.

3

Hi @colin_mckibben,

Is it correct to say that, if we request two entitlements from request centre for a Web Service Connector, two plans will be generated containing one entitlement each and hence add operation will be executed twice.

4

Actually, in this scenario, if the user doesn’t have an account yet, then the first operation will be a create, and the second will be a modify. If the account already exists, then both operations will be a modify.

5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.