Identity Deleted Event Trigger

Identity Security Cloud (ISC) ISC Discussion and Questions
1

We have tried using the Identity Deleted event trigger with multiple implementations using web hooks but are not able to get an event sent out when deleting an Identity in our source system. Testing does work successfully, but is there a certain operation that needs to be performed in order to trigger this event?

1 Like
2

Hi @justinrhaines,

Identity Deleted is triggered after an account is removed from an authoritative source and account aggregation has completed. The flow is detailed in the image in our docs: https://developer.sailpoint.com/triggers/available-event-triggers/Identity_Deleted.html.

I implemented our event triggers when I created the Workato connector for our platform. You can view the Ruby code to see how I implemented it.

You said you were able to send a test event to your web hook handler, so I’m guessing the issue you are facing has to do with how you are trying to trigger the event and not your implementation. Please try the following steps to trigger Identity Deleted:

  1. Navigate to your sources page: https://{your_tenant}.identitynow.com/ui/admin#admin:connections:sources
  2. Select an authoritative source. In my case, I have a source called “Employees” that is a flat file.
  3. Go to the “accounts” tab and download the CSV file for your accounts.
  4. Delete one of the accounts from the CSV file and save.
  5. Go to the “Import Data” tab and upload your modified CSV file. Account aggregation should happen automatically for flat file sources.
  6. Once account aggregation is complete, the Identity Deleted trigger should fire off an event with the details of the account you removed from the CSV.

Alternatively, you can also remove the identity from the identity list to trigger Identity Deleted:

image
image2555Ă—702 81 KB

3

This is curious- we have tried deleting several users of which only some are showing up in the activity log. This is also in a flat-file as you suggested following the same steps. The experience has not been consistent at all. Are there other conditions that have to be met other than simply deleting an identity?

1 Like
4

From what I have observed in my own test tenant, you should only need to perform the steps I outlined to trigger the Identity Deleted event. This has worked for me 100% of the time. If you are experiencing inconsistencies, then I recommend opening a support case so our staff can see what is going on inside your tenant.

1 Like
5

Thanks for the prompt response - we will continue to monitor for these events.

6

You should be able to use other aggregations besides flat file - the source type doesn’t matter. The trigger is on the identity removal.

If you are seeing this not fire, and can reproduce it, that sounds very bug-like to me. Lets understand it, so we can improve this one. One interesting theory I have would be to note the behavior with and without accounts correlated.

7

Hi Neil. Identity Deleted is not firing as I would expect. I was able to get back to some testing again today. I set up three subscriptions to webhooks to see what was going on. I subscribed to provisioning completed, identity deleted, and identity changes. The only event that fired at all when I deleted the identity from the auth source was provisioning completed. On that event, it just shows basic removal of a birthright entitlement. I would have expected to have seen two events fire in this case. But not having Identity Deleted sent is killing my use case. Is there anyone you know of who can look at this with me and not charge for it? Or am I totally misunderstanding how events work?

1 Like
8

Hi Matt,
Provisioning completed fires when provisioning is completed - successful or not. This only happens when and if there is a provisioning. Could be a result of identity changes, role assignments, accesses, or any other process which triggers provisioning. Sounds like that is working.

Each identity can either be created, modified, or deleted, and we have event triggers on all these events. An identity can’t fire more than one at once - i.e. you’re not going to get a specific identity updated and deleted within the same transaction. Hope that makes sense.

As I said earlier, if you delete an identity and there is no identity-delete event triggering, then that sounds like a bug. If you remove something and the identity goes away and is deleted, then it should fire the identity-deleted event, if you’ve subscribed to it. Sounds like you can reproduce the problem, so that should be opened with SailPoint Support. They won’t charge for it, as you are just reporting a bug. Feel free to reference me and our conversation here if you need to!

As always, happy to help!

2 Likes
9

Hi @neil.mcglennon , I did open a support case as you directed. They gave me an internal ticket number IDNARSENAL-9782. Do we know if the issue has been resolved?