Hi @Venu1010 - this is very doable within IdentityIQ. I’ll break it down in terms of your two question categories: group aggregation and provisioning entitlements
Group Aggregation: Creating Entitlements within IdentityIQ
Based on the shared JSON response from your application, you want to build your accountGroup schema with all of the necessary information you need to create entitlement objects within IdentityIQ. To make things easy, I would use clear named attributes for your schema (i.e. role_id, product_id, role_name, etc) to distinguish what data is the “role” and what is the “product”.
You can map these values using JSON path expressions in your group aggregation operation on the connector like so:
Given your requirement to use colon separated values for name, and comma separated values for value, you have two options here:
- After Operation Rule: use an after operation rule to parse the response, add two custom attributes (name and value or whatever names you would like), and add to each JSON item object
- Group Customization Rule: use a group customization rule to parse each ResourceObject and add 2 custom schema attributes for your name and value)
I would vote option 2 here just because it’s a bit simpler and easier to manipulate the resource object vs the entire response payload. You would then use these 2 new custom attributes within your accountGroup schema like so:
Provisioning Entitlements to Application
If your entitlements look like the following formats:
name: <role_name>: <product_id>
value: <role_id>, <product_id>
You should have all the information you need to provision these entitlements. When a user requests an entitlement for your web service, there will be an attribute request in the provisioning plan that looks like this:
<AttributeRequest name="accountGroup" op="Add" value="1,A"/>
In your before operation rule, you can extract out the necessary role id and product id from the value in the attribute request since you are setting the format to <role_id>, <product_id>. “1” would be the role id here and “A” would be the product id. You can use those values appropriately to build the necessary payload for your application.
Hope this helps! Lmk if you have additional questions here, happy to dive into anything in further detail
