How to obtain all accounts of an application?

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Experts,

I am trying to find an equivalent method in the IdnRuleUtil class to return all accounts in an application. This is what I would like to do:

  • Get all accounts from Active Directory Application
  • Get all sAMAccountName in a List

Did you find any way to achieve this?

For context my usecase is as follows:
The sAMAcxountName is the first character of the first name followed by a number sequence. However the number sequence is independent of the first character. FOr example:
John J900000
Jane J900001
Astrid A900002
Jacob J900003
David D900004
Aaron A900005

Thanks!

2

you can use maxNum logic, for example
int maxNum = nums.isEmpty()
and we already know using api we can list all accounts and attributes.samAccountname

3

How are you and which classes are you using in the cloud rules to make an api call?

5

I do not think it’s possible to do this with IdnRuleUtil. SailPoint is safeguarding people getting large amounts of data during cloud rules I guess. If you are checking for uniqueness or something along those lines, if you have sAMAccountName set as the Display Attribute in your account schema, you could use accountExistsByDisplayName(java.lang.String applicationName, java.lang.String displayName) to do a lookup based on what you are generating for the proposed account sAMAccountName to see if it already exists or not, and increment as needed.

1 Like
6

You are not allowed to make an API call from the cloud rule…

In my opinion, using PS script using native rules would be a better approach

1 Like
8

That’'s what i also expected. So I will now do the following:

AFAIK the account creation process is not multi threaded. So I will create an AfterCreate rule - this will make an API call to ISC and store he last generated sAMAccountName on a custom attribute on the Source:

image
image339×228 7.78 KB

Using this PATCH call in the PS Script:

image
image728×528 23.2 KB

In the Rule, I will fetch the value of this attribute and increment it by 1. What do you think? @iamology @patrickboston

1 Like
9

If you can make it work, that will be the best approach in my opinion…

Thanks for posting such a unique question and coming up with a solution

10

Hi @tamalika01 This sounds a really good idea. I strongly suggest that if you get this to work you write it up in a blog post as it would be greatly appreciated by the community. One suggestion, if I may, you could make it generic by only storing the integer part and increment it before storing. Then the attribute would represent the next available value to be used in attribute generation.

1 Like