How do you provisiong if you can't use Roles/AP/Entitlements?

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi,

We have a target app that doesn’t support entitlements at any level, just user create, update, disable and delete account operations. We have created a webservices connector for it and we have aggregation working as expected. The problem comes when we have to create accounts.

How you guys create accounts if you can’t use Roles, Access Profiles or Entitlements that trigger the account creation?

I have tried creating a Lifecycle State Profile and added the source to the list of Source To Enable expecting that would make it, but doesn’t do anything…the account is not created in the target app. To rule out a problem on this current connector, I added another fully functional webservices connector to the list of sources to enable…but when I manually assign the Lifecycle State to any users…nothing happens.

How would you do it?

Thanks!

1 Like
2

AFAIK we don’t have create account without access just like in IIQ.

  1. Can you make any generic schema attribute in your connector as an entitlement ?
  2. What if you create a dummy AD Group, upon addition you can invoke create account API call using Native Rules. I know we are depending on AD which is an additional action item. Remaining operations (Aggregation, Disable, Enable, Delete) can be managed through Webservice connector.
  3. If account creation can be made using some conditions not a manual request then you can invoke create API call through Workflows (HTTP Request Action).
1 Like
3

Hey @MVKR7T,

Could you elaborate on option 1?

We already created a generic schema attribute (account schema not group schema) representing fake entitlements…but I’m not sure what we should do next…creating a fake entitlement? How can I do that?

Thanks in advance.

Regards.

1 Like
4

When you mark a schema attribute as an entitlement and run aggregation, it will promote the entitlements. You can see them under your source, entitlements tab.

Create an Access Profile and Role for that.

Let’s say you have schema attributes: firstName, lastName, email…etc these are common attributes can’t use as access. Status, description… something like that an attribute will be there which holds same value for all users. Status as Active for all active users.

When you mark this attribute as entitlement and run account aggregation, you will see status as an entitlement. Make use of it.

When user request for this Role, user account gets created with Active status.

2 Likes
5

Oh I see @MVKR7T … I’ll test this out and let you know.

Thanks!

1 Like
6

It worked like a charm @MVKR7T . Thanks!

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.