How to Get Entitlement DisplayName in Audit Event

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.4

Please share any images or screenshots, if relevant.

image
image1779×367 20 KB

image
image752×477 10.5 KB

Hi Sailors,

I created a block of code to add an audit event to record the added and removed entitlements in a role. However, I found that the value shown is the entitlement object instead of the entitlement displayName. And the value shown is not full as well. I would like to know how I can retrieve the entitlement displayName from the object.

// Part 2. Audit profile differences (entitlements, constraints, etc.)
if (roleDifference != null && roleDifference.hasDifferences()) {
  List profileDiffs = roleDifference.getProfileDifferences();
  log.error("Profile differences found: Number of profileDiffs = " + (profileDiffs != null ? profileDiffs.size() : "null"));
  if (profileDiffs != null && !profileDiffs.isEmpty()) {
    hasChanges = true;
    for (Object diffObj : profileDiffs) {
      if (diffObj instanceof ProfileDifference) {
        ProfileDifference diff = (ProfileDifference) diffObj;
        log.error("Processing ProfileDifference for application: " + diff.getApplication());
        // Process filter difference for entitlements/constraints
        Difference filterDiff = diff.getFilterDifference();
        if (filterDiff != null) {
        
    Object oldObj = filterDiff.getOldValue();
    Object newObj = filterDiff.getNewValue();
    // Check for removed and added values
    if (oldObj != null) {
        String removedValue = oldObj.toString();
        filterDiff.addRemovedValue(removedValue); // Store removed value
        log.error("Removed Value: " + removedValue);
    }

    if (newObj != null) {
        String addedValue = newObj.toString();
        filterDiff.addAddedValue(addedValue); // Store added value
        log.error("Added Value: " + addedValue);
    }

        
          log.error("Filter difference found");
          Object oldObj = filterDiff.getOldValue();
          log.error("Old filter value class: " + (oldObj != null ? oldObj.getClass().getName() : "null"));
          log.error("Old filter value: " + (oldObj != null ? oldObj.toString() : "null"));
          Object newObj = filterDiff.getNewValue();
          log.error("New filter value class: " + (newObj != null ? newObj.getClass().getName() : "null"));
          log.error("New filter value: " + (newObj != null ? newObj.toString() : "null"));
        
          // Create AuditEvent
          AuditEvent event = new AuditEvent();
          event.setAction("RoleAttributeChange");
          event.setSource(launcher);
          event.setTarget(roleObject.getName());
          event.setAttributeName("Profile Entitlement Changes");
    event.setString1("Added Value: " + (newObj != null ? newObj.toString() : "null"));
    event.setString2("Removed Value: " + (oldObj != null ? oldObj.toString() : "null"));
          Auditor.log(event);
          context.saveObject(event);
        } else {
          log.error("No filter difference found in this ProfileDifference");
        }
      }
    }
    context.commitTransaction(); // Commit after all events
  }
} else {
  log.error("No role differences or no hasDifferences");
}
2

If it helps, here is something quick and dirty that I’ve used before. It is absolutely not efficient since it pulls all managed attributes and just brute-force matches the filter value to the managed attribute value to get the display name. But depending on the app and how often you run this, it can get the job done.

  Bundle bundle = context.getObjectByName(Bundle.class, "YourRoleNameHere");
  List<Profile> profiles = bundle.getProfiles();
  String profileValue = "";
  String yourEntitlementName = "";

  // grab the filter value from the profile for the target app
  for (Profile profile : profiles) {
    log.debug("profile app: " + profile.getApplication().getName());

    if ("YourAppNameHere".equals(profile.getApplication().getName())) {
      List<Filter> filters = profile.getConstraints();
      Filter filter = filters.get(0); // loop if you have multiple constraints

      List filterValues = filter.getValue();
      log.debug("filter values: " + filterValues);
      for(Object val : filterValues) {

        log.debug("filter value: " + val);
        profileValue = val.toString();
      }
    }
  }

  // brute force: query all managed attributes and match by value
  List<ManagedAttribute> entitlements = context.getObjects(ManagedAttribute.class);
  log.debug("entitlements size: " + entitlements.size());

  for (ManagedAttribute e : entitlements) {
    if (profileValue.equals(e.getValue())) {
      yourEntitlementName = e.getDisplayName();

      log.debug("entitlement value is: " + e.getValue());
      log.debug("entitlement display name: " + e.getDisplayName());
      log.debug("entitlements: " + e.getAttributes());
      
    }
  }

  return yourEntitlementName;