How to skip Skip Specific Plan Attribute Requests from provisioning

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Hi

I have a requirement to skip specific attribute requests from provisioning in plan in IIQ.

I know we can remove them from provisioning plan using before provisioning rule but i have a requirement to use them in after Modify Native rule for some validation, but these attributes shouldn’t be provisioned.

any suggestions appreciated.

Thanks

Prashanth

2

Hi Prashanth,

The Before Provisioning rule is the only place to stop these attributes from reaching the connector. Before removing them, stash their values on the AccountRequest so they remain available later.

You can use below code to do it, or add in your existing rule

List skipAttrs = Arrays.asList("attr1", "attr2");

if (plan != null && plan.getAccountRequests() != null) {
    for (AccountRequest acctReq : plan.getAccountRequests()) {
        List attrReqs = acctReq.getAttributeRequests();
        if (attrReqs == null) continue;

        Map saved = new HashMap();
        List toRemove = new ArrayList();

        for (AttributeRequest ar : attrReqs) {
            if (skipAttrs.contains(ar.getName())) {
                saved.put(ar.getName(), ar.getValue());
                toRemove.add(ar);
            }
        }

        if (!toRemove.isEmpty()) {
            attrReqs.removeAll(toRemove);
            Attributes args = acctReq.getArguments();
            if (args == null) args = new Attributes();
            args.put("skippedAttrs", saved);
            acctReq.setArguments(args);
        }
    }
}
return plan;

**Reading the values using below something:

Map args = request.getArguments();
Map skipped = (args != null) ? (Map) args.get("skippedAttrs") : null;
Object val = (skipped != null) ? skipped.get("attr1") : null;
// validation logic
3

Hello Prashanth. Naveen’s approach looks good. Since your After Modify native rule runs through IQService, I would suggest storing the values as individual AccountRequest arguments rather than a nested map. In the BP rule, save the value before removing its AttributeRequest:

acctReq.addArgument("validationAttr1", ar.getValue());

Then, in your PowerShell After Modify rule, once $requestObject is initialized, you can access it using:

$value = $requestObject.Attributes["validationAttr1"]

These metadata values are available to the scripts but are not provisioned to AD. Just make sure a Modify operation still reaches the connector after removing those AttributeRequests. Otherwise, the After Modify rule may not execute.

4

Set excludeAttributesFromProvisioning in the application xml with a list of attribute names which are to be ignored during provisioning.
eg:

<entry key="excludeAttributesFromProvisioning">
  <value>
    <List>
      <String>attribute1</String>
      <String>attribute2</String>
    </List>
  </value>
</entry>
5

@PrashRV Agree with @BhuvaneshGeddam . You can use : excludeAttributesFromProvisioning. Check below article for reference.
Update an AD account attribute only in Sailpoint while creating new account - IdentityIQ (IIQ) / IIQ Discussion and Questions - SailPoint Developer Community