How to map 'disabled' flag to SailPoint during AWS Identity Center integration

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.4P2

We are working on an integration between SailPoint and AWS Identity Center. Our goal is to automatically disable a user’s account in SailPoint when they are disabled in AWS Identity Center. We have a connector set up, and basic provisioning is functional, but we need guidance on handling the disable flag specifically.

We need to know the recommended method for getting the “disabled” status of a user from AWS Identity Center to trigger a disable action in SailPoint. We want this to be an automated process as part of our identity lifecycle management.

Questions:

  • Is there a specific attribute in the AWS Identity Center schema that we can map to the SailPoint IIQDisabled flag during aggregation?
  • If an attribute-based mapping isn’t standard, what is the best practice for detecting a disabled user in AWS Identity Center?
2

You should use the schema attribute “active“ for this. We are using the scim2.0 connector

1 Like
3

Hi Alfi, Thank you for the suggestion. I’m new to SailPoint, so could you please elaborate more?

4

so scim connector has a field called “active“ which is a boolean. in the customization rule you create a rule and add code like this example:

boolean isActive = Boolean.TRUE.equals(object.getAttribute(“active”));

String acctName = object.getIdentity();

if (“Active”.equalsIgnoreCase(isActive)) {
object.put(“IIQDisabled”, false);
log.debug(" [" + acctName + “], assuming active account.”);

} else {
object.put(“IIQDisabled”, true);
log.debug(" [" + acctName + “], marking IIQDisabled as true.”);

}
5

Thank you for the detailed explanation, let me try this.

6

Actually, we are using out-of-the-box AWS IdC connector, it doesn’t have any attribute which says active or inactive to override.

7

hmm ok , try adding that field and see if you can pull it .

8

Useful article to understand active and inactive accounts and identities.

Understanding active and inactive accounts and identities: IIQDisabled - Compass

1 Like
9

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.