Help with "attribute sync" from Identity-Now to Webservice APP

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hello Experts,

I am trying to use Identity-Now/ISC as a data transporter between HR System and WebService App.

I have a webservice application that doesn’t have capability of getting information directly from HR System.

So i thought of this approch: HR —IdentityNow—WebServiceApp

I don’t want to create account, nor disable or delete the account. I just want to update/modify the value of 2 attributes in WebService

Identity attribute: personalEmail sync into secondaryEmail of Webservice app
Idenity attribute : personalPhone sync into secondaryPhone of Webservice app.

Has anyone ever applied this approach? Or even this approach is a good approach?

I need your expert analysis and ideas.

Thank you
Best Regards

2

I see no problem with this approach. You’ll still need to set the values in the Create Account configuration page and create the “Update Account” configuration in the HTTP Actions page.
But as long as you never create a “Create Account” http action, you’ll never actually create the account.

3

@KevinHarrington As i was following your steps and trying to add a HTTP operation UPDATE Account the endpoint API. I found one API call is only for one user.

During Aggregation operation I was able to make one call and all accounts got aggregated

this is the endpoint URL

PATCH: https://api.webservice.net/rest/contacts/{organizationId}/{id}

Correct me if i am wrong this call is only for one user.

Thank you

4

IdentityNow will only want to update one user at a time, so the fact that your PATCH call only acts on one user at a time is a good thing.

5

You can use attribute sync without needing to create accounts on the source. As suggested, you will have to configure create account profile and use the attributes which are sourced directly from the identity for attribute sync

6

I configured the “Create Account Section”

image
image889×778 24.2 KB

I am struggling in setting of Http operation of Update Account,

image
image1257×511 26 KB

When I hit this "sync button’ once a day I want to sync these 2 attributes into webservice app. for all users

image
image1604×387 21.8 KB

But with this endpoint PATCH: [https://api.webservice.net/rest/contacts/{organizationId}/{id}]

I am understanding sync will be applied to one user that matches the id.

organizationId is static but id changes with the users.

7

Hi Rita,

The way that I achieve a dynamic user-based URL for Web Services is the following:

  1. Ensure that the ID that the PATCH call requires is either an identity attribute (such as employee ID) or an account attribute that is included in the response map of the Account Aggregation operations - and thus present on all accounts.

  2. Utilize the Services Standard Before Provisioning Rule (or a custom developed Before Provisioning Rule) to pull this ID value off of the identity or account and include it in the Provisioning Plan whenever an update is being performed.

More information on that process can be found here: Update Provisioning Policy - Identity Security Cloud (ISC) / ISC Community Knowledge Base - SailPoint Developer Community

  1. Reference the ID value from the Plan in the Context URL using a dynamic variable refernece: e.g. “$plan.employeeId$”

For your URL it would looks something like: https://api.webservice.net/rest/contacts/{organizationId}/$plan.id$

Please let me know if you have any questions!

Best,
Chris

8

you can include the id attribute in the create account configuration. This will include it in the plan which can then be used in the web services http patch operation

9

Hi @j1241 , the process till now is good.

  1. Next thing is to setup the context path, and for that you can use your api ex: Few things to understand here in this API endpoint is
  • organizationId : Static Value ex: 3212xxxx
  • id: dynamically changing

These 2 are variables that is these should be updated before calling the API.
Now, if the organizationId is not changing per user etc. Or if it is a static value then i would say get that value and populate directly in the api.

For the {id}, see what id is required by the endpoint is it some sort of employeenumber or a autogenerated id etc.
Whatever it requires, Mark the same as account id in your Webservices Schema.

Now the final api endpoint is:
…/rest/contacts/3212xxxx/$plan.getNativeIdentity$

  1. Configure the Endpoint Body
    Exampe:
{
    "secondaryEmail":"$plan.personalEmail",
    "secondaryPhone":"$plan.personalPhone"
}

This should allow you to sync the values.
NOTE: before enabling it for all users, i would recommend doing the sync for single user first and once it looks good, then you can enable for all.

Letme know if this helps :slight_smile:

11

@nileshnikalje

The “id” is webApp id, with whom i can map in create account configuration.
It’s value is does not match with any identity attribute.

image
image727×118 2.55 KB

@neeraj99 mentioned if i mark it as Accountid in Account schema i can use it in
$plan.getNativeIdentity

image

please correct me if i am wrong here

12

Hi Rita,

So you can setup the create account policy with the attribute that you need to sync along with any other attributes that are required in create profile.
Hence personal email & personal phone should be there in the create account policy.

Next thing is the Account ID i.e named as “id” is correctly marked.
Now you can simply setup the HTTP operation with the earlier suggestion/post that i had given.

And this should work perfectly.

So in summary;

  • You will have to add the 2 attributes which needs to be synced.
  • Create the HTTP operation
  • Enable the attribute sync

Letme know if there’s still any confusion

13

@neeraj99

Update on this, followed exactly mentioned.

I am having problem at creating context url.

I used this url in postman with this payload, id has been hardcoded

https://api.webapp.net/rest/contacts/orgid/id?idType=id

[
  {
    "op": "replace",
    "path": "/paths/pathId:56789/value",
    "value": "[email protected]"
  }
]

The sync was successful

But when I use the same url in IdenityNow using provisioning plan

https://api.webapp.net/rest/contacts/orgid/$plan.id$?idType=id

I get this error.

[“Exception occurred while performing \u0027Modify\u0027 operation on identity \u00271528617519414277\u0027: Error: {\n "status" : 405,\n "moreInfoUrl" : "http request method not supported"\n}”]

Account Schema
image

Create Account

image
image1096×238 10.7 KB

Any idea how can I solve this error

Any help will be helpful

14

There’s your issue. Method not allowed. Can you double check the Api method you have used? I know you would have already checked that still the one you are using in postman vs the one you are using in Webservices.

15

Also if possible can you share screenshot of how you have configured the endpoint vs how you are calling via postman or any other tool. It would be helpful to get to conclusion where is it failing.

16

Hello @neeraj99

Thank you I really appreciate your suggestion.
Yes, I checked the method is PATCH as mentioned in the API documentation
I have modified the actual id’s for security reason

Calling via postman

image
image673×363 15.2 KB

Configured in IdentityNow

image
image658×598 15.2 KB

image
image1138×226 6 KB

image
image678×367 11.2 KB

'$plan.secondaryEmail$ " is working fine

This is from webapp api document
curl --request PATCH
–url ‘https://api.webapp.net/rest/contacts/123456/414277?idType=id’
–header ‘accept: application/json’
–header ‘content-type: application/json-patch+json’

17

I don’t see any issue with the configuration.
But can you do one thing like hardcode the values in the configuration.
i.e rather than putting variables for now just directly put the hardcoded values and see if that works.
If not. then try deleting the current endpoint and create a new one;
I know this is a redundant step but if hardcoding doesn’t work then there maybe something which is missing maybe the base URL is missing something?

18

Hi Rita,

You can use the sync functionality as well, but before doing so, make sure to define the UPDATE policies in the Create Profile. Once the update policies are in place, you can use the HTTP operation to update the user attribute value.

This operation will update the attribute value based on what’s defined in the UPDATE policies. Additionally, ensure that the attribute is included in the sync configuration to keep it updated consistently

Thank You!

19

Hello Everyone,

Update:

I was finally able to fix the method not supported error, the issue was context url
previously tried urls are :


/contacts/orgid/$plan.planNativeIdentity$?idType=id
/contacts/orgid/$plan.getNativeIdentity$?idType=id
/contacts/orgid/$plan.id$?idType=id

but when I used


/contacts/orgid/$getobject.nativeIdentity$?idType=id

the sync was successful

Thank you everyone for you inputs and ideas.