How to cancel an in-progress source aggregation

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

We have a customer who would like to cancel the existing aggregation if it hits above a certain modify number to avoid a mass change event from authoritative sources before it happens. Much like how the OOTB delete threshold behaves.

Is there a public API that we can call to cancel the in-flight aggregation?

Theoretically if that exists we could call that cancel aggregation API based on this event trigger.

2
3

Leigh you can click the X to cancel it on the source in the gui

5

I noticed that clicking on X button in the UI calls this API
https://TENANT.api.identitynow.com/tpe/taskResult/taskResults/TASK_ID/cancel

But this does not seem like a public API

2 Likes
6

Do pending task api call grab the task id of the aggregation that is running
And shoot out a update task status to
Completed or cancel.

7

Thanks all - I’ll take a look.

FYI this question was spit from a query i made in another thread. The overall idea was to use the accounts collected ETS in a workflow and programatically cancel an aggregation before it does too much damage.

8

This is of interest to my organization as well. We have a business requirement to interrupt any mass attribute changes that are unexpected. Ideally we would like for this to abort before applying to the identity when a mass change is detected.

I’m not sure I totally follow on the mention of updating the task status to completed or cancelled, as I only see a get task endpoint in the documentation, not a corresponding POST/PUT/PATCH. Can someone help point out what I might be missing? Thanks!

9

Hi @Leigh-mason,
I could think of 1 solution .

  1. Trigger the source aggregation using a Powershell script using API, not sure if there is a standard API call to do this, but if there is not then you can find out the API calls which UI makes for Aggregation trigger.
  2. In the same script, while aggregation is in progress, use search API to find out “Modify Account Passed” event number with the appropriate interval to find out how many account modifications are happening because of current aggregation.
  3. We do need to put a static value as a threshold, lets say this aggregation triggered 500+ Modify account passed events, then run an API call to terminate the aggregation using API.
    For terminating the source aggregation @iamnithesh API call is useful.

Let me know if it helps.
Thanks,
Vaibhav

10

Hi Michael,

The one I believe needs to be called is this:

The bigger trick is finding the actual aggregation task we care about.
It looks like you’d need to do a list all and use JSONPath/define variable in a workflow to find the right ID.

11

Awesome, this definitely gives me something to start digging into. I really appreciate the insight. I’ll come back with an update on how it goes!

12

You target the pending task api to capture the aggregation jobs aka traffic in the Que that are running. Then you grab the id and complete it to stop the aggregation. Two api calls complete the job. The aggregation is completed.

13

In-progress Account Aggregation status

This API returns the status of an in-progress account aggregation, along with the total number of NEW , CHANGED and DELETED accounts found since the previous aggregation, and the number of those accounts that have been processed so far.

This will give you details of active aggregation in progress.

14

So if I use the Accounts Collected for Aggregation trigger in workflows, and invoke these API calls from there, is there any delay between when accounts have been collected for aggregation and when they start to be processed? If I update the task status to stop the aggregation after accounts are collected and I have numbers on how many accounts have changes, I assume that I may end up with some of the accounts already processed if there is no delay?

15

The event looks to be a fire and forget. So potentially there could be some modifies that slip through.

Given how quick the workflows process, theoretically it should be a nominal amount vs not having any checks at all.

In the absence of having something OOTB like deleteThreshold or as a Request/Response ETS, it looks like it is the next best thing to stop it.

16

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.