Long time listener, first time caller, so I apologize if I missed any reqs for a post. We’re discussing a native way of allowing Helpdesk to generate a token for last resort PW resets within ISC using a mix of forms, event triggers, and/or workflows. A form to get the identity and provide other fields for proofing/accountability. Then use a workflow/event trigger to call the API and return the generated token to the Helpdesk personnel/users Manager (Manager of user for whom the service desk personnel is trying to reset PW token). Trying to avoid PS scripts, Postman, custom app, etc.
I don’t expect a full solution as a response, but if you are willing to share personal experience or high-level steps to accomplishing this, it would be greatly appreciated.
What I really want to know is if this is even possible?
What would be the best way of returning the token/response back to Helpdesk/user’s Manager?
It sounds like you’re looking for this option - under Identity Profile, Password Reset and User Unlock Methods - By providing a code sent by your Helpdesk.
Then you can use the generate-password-reset-token API to create the token on demand:
I’ve had success with the following flow:
Workflow with interactive trigger - this is the main engine
One form to “lookup” the user
One form to confirm the identity
The workflow calls the generate token API and returns it in the interactive form.
Things to consider: This effectively makes it possible for Helpdesk admins to directly set the password for any identity. In your “lookup form”, consider filtering the search results down to only those who are missing the attributes for any other valid forms of password reset, like personal email. In the identity confirmation form, be sure to include any attributes that are required to ensure the Helpdesk can effectively confirm that they have the right person selected.
Use your sandbox and just call the generate digit token endpoint to confirm that it’s giving you the desired results before spending too much time on the forms and workflow.
I have designed my workflow and it is creating digit token. After generating, I want to validate in Audit Events as per below details where it is failing to get a response but if I search the same query with request ID of digit token generation, I can get result on postman API whereas it is failing in workflow’s HTTP request search step
I have designed the below workflow and I have two places where I need to search based on Entitlement membership. I am doing like this and I am not getting the response as expected.
@vsekar7 Instead of “Get Access” action, you can make use of search API using “HTTP Request” action. You can configure something like below which will give you the output if user has IGA_SSPR entitlement.
Search Query: {"indices":["identities"],"query":{"query":"attributes.identificationNumber:{{$.getIdentity.attributes.identificationNumber}} AND @access(displayName:*IGA_SSPR*)"}}
