We are attempting to remove the existing sunset dates from a number of role assignments.
Our initial attempt was to click the designated button, clear the date field, and save the identity, but this action was unsuccessful; the date remained in place.
We tried removing the enddate from the identityEntitlement object via debug mode. This successfully removed the sunset date from the role assignment itself. However, the date is still being listed under “Identity Events,” and the role assignments are still being removed upon reaching the original sunset date.
Follow this example code that I used to remove the attribute assignment of O365 group. There is an entitlement avlue associated with it and based on that check. If it matches that exact entitlement from where you want to remove the sunset date, it will remove the sunset date.
Identity id = context.getObjectByName(Identity.class, identityName);
if(null != id.getAttributeAssignments()){
log.error("Inside updating sunset date for : "+ identityName);
Iterator it = id.getAttributeAssignments().iterator();
AttributeAssignment at = null;
while(it.hasNext()){
AttributeAssignment at1 = it.next();
if("035nkun21yy0t83".equalsIgnoreCase(at1.getValue())){
at = at1;
}
}
if(null != at && null != id){
log.error("AttributeAssignment is not null.");
id.remove(at);
context.saveObject(id);
context.commitTransaction();
}
}
You need to modify it little bit as per your requirement. I have used this to remove the entire attribute assignmnet but in your case you can just set the endDate as null.
import sailpoint.object.Identity;
import sailpoint.object.AttributeAssignment;
Identity id = context.getObjectByName(Identity.class, "test");
if (id == null) {
throw new RuntimeException("Identity not found: test");
}
for (AttributeAssignment aa : id.getAttributeAssignments()) {
if ("Active Directory".equals(aa.getApplicationName()) &&
"memberOf".equals(aa.getAttribute()) &&
"CN=Contractors,OU=Groups,DC=corp,DC=com".equals(aa.getValue())) {
aa.setEndDate(null);
System.out.println("Removed sunset date for entitlement");
break; // remove this if you want to clear all matching assignments
}
}
context.saveObject(id);
context.commitTransaction();
context.decache();
you can modify as per your requirement. logically it should work.
@rgupta11 When you select sunrise/sunset date for an entitlement/role, a requestobject will be created post approvals to provision/deprovision automatically on the selected date. So you can delete the request object if you don’t want the provision to happen.
Can you try using the below code to delete the Request object which launches the workflow on the roleEndDate to remove the roles.
import sailpoint.object.Request;
import sailpoint.object.QueryOptions;
import sailpoint.object.Filter;
import java.util.Iterator;
import sailpoint.tools.Util;
import sailpoint.api.Terminator;
import sailpoint.object.RoleAssignment;
import sailpoint.object.Identity;
import org.apache.log4j.Logger;
String roleName = “” ; // roleName
String userName ;
Terminator terminator = new Terminator(context);
Iterator iterator = context.search(Request.class,null);
while(iterator!=null && iterator.hasNext()){
Request request = (Request) iterator.next();
if(request!=null){
String role = request.getAttribute("roleName");
userName = request.getAttribute("identityName");
if(Util.isNotNullOrEmpty(roleName) && role.equalsIgnoreCase(roleName)){
log.error("Request Info : " + request.toXml()); // Verify that you are retrieving the roles you expected before deleting the object
terminator.deleteObject(request);
}
}
}
if(userName!=null){
Identity identity = context.getObjectByName(Identity.class,userName);
if(identity!=null){
List roleAssignments = identity.getActiveRoleAssignments(roleName);
if(roleAssignments!=null){
for(RoleAssignment roleAssignment : roleAssignments){
if(roleAssignment!=null){
roleAssignment.setEndDate(null);
}
}
}
}
}
After the execution of this rule, run the Identity Refresh Task with ‘Refresh assigned, detected roles and promote additional entitlements’ option checked so that the endDate is updated
@rgupta11 You need to delete both Request Object and Attribute Assignment to remove the sunset. If you only remove request object, then identity refresh will create a new request object based on the attributeassignment entry. So you need to delete both of them to clear out the sunset date properly.
If this is part of regular operations, you can provide a manual steps to delete attribute assignments and then remove request object(either by debug or from identity page - events tab) or you can also provide a script to do this. Sample script are provided above.
