GetObject in Webservice Connector

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi Team,

When I remove any entitlement for a webservice connector. It doesn’t reflects immediately on the user profile. We had configured getObject API.

Do we have aggregate the account every time to see the updated access in IDN. Doesn’t the get Object operation triggers automatically & does this job ?

Thanks,
Tanay Chouhan

2

If you remove an entitlement outside of IDN, natively that is, you need to aggregate that account for the source that is connected to it for the changes to be visible in IdentityNow.

If you remove an entitlement from IDN via for example a certification, it should show immediatly after the API request has been successful.

How does the entitlement structure look like and what operations are you using right now? Are you removing the actual entitlement itself or the entitlement from a user account conneted to the Webservice source?

3

Hi Sebastian, Thanks for your input.

I agree that is the expected behavior for sources like AD or LDAP but for Web service connector it is not the case.

I am using Remove Entitlement operation to remove the access of a user from IDN via Certification. This is for a webservice connector.

4

Yes, of course you need to configure a Remove Entitlement Operation beforehand! :slight_smile:

However, you should not need a Get Object Operation in order for IDN to actually sync with the end system after removal.

5

Hi Tanay,
Please configure getObject method. This is required by IDN for syncing in the changes to IdentityNow.

Also please do the following on your source and test again.

Patch : https://{{tenant}}.api.identitynow.com/v3/sources/:id
Body:

[
  {
    "op": "add",
    "path": "/connectorAttributes/getObjectAfterProvision",
    "value": true
  }
]
6

Thanks Rakesh. I tried this still sync not working.

7

Hi Tanay,
I am not understanding the issue. Are you revoking an entitlement directly or revoking access profile or role ? Is it getting removed in target?

8

Can you share step-by-step what it is you are doing inside IdentityNow?

Can you also share a screenshot of the operations in the Web Service Configuration, as well as a screenshot of the Remove Entitlement Operation configuration?

9

Hi Rakesh,

There are two access profiles AP1 & AP2. Both were assigned using Access Request.
I am removing AP2 via Certification. It does gets removed from Target but the changes doesn’t reflects in IDN until I aggregate the account.

10

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.