How to provision SCIM2.0 Complex attribute like Manager

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Hi Experts,
I have manager complex attribute as below. IIQ can discover, able to preview and aggregate the manager field. I’m getting “Unable to get property value from getter class:openconnector.connector.scim2.SCIM2ExtendedComplexPropertyGetter
java.lang.IllegalStateException: Not a JSON Object: "7c8808f3-defa-4411-991a-eb42dd7f2c3b” error while trying to provision.
Manager field in SCIM:
info.txt (6.0 KB)

“manager”: {
“$ref”: “https://XXX.test.XXXX.com/scim/internal/Users/7c8808f3-defa-4411-991a-eb42dd7f2c3b”,
“value”: “7c8808f3-defa-4411-991a-eb42dd7f2c3b”
}
Please find additional error details in the attachment.

Can any one suggest me how I can send the value for manager ?
Thanks in advance,
Jay

2

The manager is part of the extended schema, so needs to be in a “container” for that schema. Then, all you need to provide is the id of the manager as the value:

{
    "urn:ietf:params:scim:schemas:sailpoint:1.0:User": {},
    "emails": [
        {
            "type": "work",
            "value": "[email protected]",
            "primary": "true"
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:schemas:sailpoint:1.0:User",
        "urn:ietf:params:scim:schemas:core:2.0:User",
        "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
    ],
    "name": {
        "formatted": "Andrew.Dwyer",
        "familyName": "Dwyer",
        "givenName": "Andrew"
    },
    "active": true,
    "userName": "Andrew.Dwyer",
    "password": "xyzzy",
    "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
        "department": "Finance",
        "manager": {
            "value": "7bac06aaf46811ebaea21bb0add92936"
        }
    }
}
3

Hey @menno_pieters ,

Do you have any guidance on how to configure the Account Schema / Create Profile to provision complex attributes for a SCIM source that are non-referenceable within IDN?

For example, if the User schema on the SCIM source expected the below, how would we be able to configure the Create Profile to achieve this?

        "emails": [
            {
                "value": "[email protected]",
                "type": "business"
            }
        ],

We are finding that when we discovery the schema, the account schema for the source in IDN includes both emails.value and emails.type attribute.

Chris

4

@whoiscjay This is a very old thread and is in the context of IIQ and not IDN (although the SCIM standard is pretty much universal). I’d first point you to the SCIM core schema (RFC 7643: System for Cross-domain Identity Management: Core Schema) and that you would need to use some form of selector to identify the correct list element to retrieve, followed by the element’s sub-attribute.

If you need more help with your issue, I’d suggest creating a new post in the #idn forum detailing your issue/question.

5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.