Hi All,
Currently I’m building Identity Trigger to launch the certifications based on user owner change. In campaign I need the user account as well as entitlements and few applications I should exclude it from the campaign.
Anyone has implemented such use-cases? If so, please can you provide your inputs.
@prahantMishra Are you configuring a Certification Event or LifeCycle Event?
Hi @neel193 , Thanks for your response!
It’s certification event.
Trigger configuration — Set the Event Type to Attribute to fire on the attribute that represents “owner” (e.g. manager or a custom identity attribute).
Use an Exclusion Rule on the certification. Write a rule of type CertificationExclusion and you can store the application names in the custom object to use it to figure out if you want to exclude the entitlements associate with these apps.
@neel193 , I want to create a campaign with entitlements and accounts together. I don’t think just with Certification Exclusion I should be able to do it. I believe I should touch base an OOTB java class as I need to include entitlements as well as and users account all together.
Exclusion will work only to exclude some specific apps entitlements.
@prahantMishra AFAIK OOTB you can’t put both entitlements and account together in the same certification or at least i haven’t used it. as the outcome of both these are different, one will remove and other delete/disable the account.
@prahantMishra As it is not natively supported, I would not recommend touching the OOTBs java class to modify the certfification behaviour. Instead if you really want to achieve it, do it via Plugin and insert few custom xhtml pages with a customized view to have both entitlements and accounts review.
@neel193 yes exactly we can’t pull both together. I need to look for other way around.
Go for plugins. that should be your best way to do the customization without modifying any standard modules.
Actually, plugins are not a suggested approach as per business so would need to go with java classes. Thanks for the suggestions @neel193 .
@neel193 , do you know which java class gets invoke if we trigger certification event?
@prahantMishra Primary handler is sailpoint.api.CertificationTriggerHandler and uses these builder class: sailpoint.api.CertificationBuilderFactory & sailpoint.api.Certificationer. CertifiableAnalyzer used to generate Certifiables (Roles & Entitlements) and it excludes both ent and accounts together.
There could be additional classes but these are the ones i am aware of. Also, as it is coming via identity triggers, so sailpoint.api.Identitizer should also be in use.
Hello Prashant. Since plugins are not an option for your business, I would suggest trying one OOTB option before modifying the Java classes.
If you require the reviewer to review individual entitlements and also allow the reviewer to revoke the whole account, try setting Included Access = Entitlements and enabling Enable Account Revocation under the Certification Event Behavior settings. This gives the reviewer entitlement-level decisions and a Revoke Account option. Choosing Revoke Account initiates revocation of the account and its associated entitlements. The actual removal follows the configured certification revocation process. You can also use Included Applications to select only the applications you want certified, so a separate Exclusion Rule may not be needed.
For the owner-change trigger, use Manager Transfer if owner means the manager, or Attribute Change if it is a separate identity attribute. Also make sure Process Events is enabled in Identity Refresh. The limitation is that this does not give you the account and each entitlement as independent review items in the same certification. If separate reviews are acceptable, one option worth testing is two Certification Events for the same owner-change condition, one for Accounts and one for Entitlements, though those would be separate reviews rather than one combined certification.
Regarding Java, Neel has already identified CertificationTriggerHandler and the related classes. I would use them for tracing rather than modifying the internal implementation. If independent account and entitlement decisions in one certification are mandatory, I would validate the supported options with SailPoint Support before changing the core certification logic.
I would first test Enable Account Revocation and see if it meets your business requirement.
Hi Harish,
Thanks for your suggestion!
But, ask to embed entitlements and accounts together in a single certification campaign rather than splitting it into two for accounts and entitlements separately.
I checked the CertificationTriggerHandler event and it’s associated classes, eventually event end up calling certification builder class to build certifications. Probably, I will have to look into it.
If needed I will open a case with SailPoint Support too.
Hello Prashant. Thanks for clarifying. I understand that you need both accounts and entitlements together in a single certification. Since you have already traced the flow to the certification builder, I would be careful about modifying those internal classes. Changes there could affect certification decisions, revocation processing, and future upgrades.
I think opening a SailPoint Support case would be a good next step. I would specifically ask whether your IIQ version has a supported extension point to include both account and entitlement review items in one certification. Also, whether the account also needs its own independent Approve or Revoke decision, or whether displaying it alongside its entitlements is sufficient. That could make a difference in the approach.
I have not found a documented, supported customization for this requirement, so I would confirm with Support before changing the OOTB classes.
Hi Harish,
Version is 8.5p2
Yes, need accounts and entitlements both with approve and revoke functionality. If it would be just displaying the details, I would have achieved it by using customization rules. But in current use-case I need both of them to be in certifiable items for certifier review and take action on it.
For 8.5p2, I could not find a documented OOTB option or a supported extension point to treat the account and its entitlements as separate certifiable items, each with its own Approve or Revoke decisions, within a single certification.
Since modifying the certification builder carries upgrade risk and has to keep revocation handling correct, I would confirm with SailPoint Support whether 8.5p2 has a supported extension point for this before changing those classes.
Hi Harish,
Thanks for checking doc!
I have resolved the issue. Now in certification I could see user entitlements and accounts with all customizations in place by leveraging customization rules in a such a way that it should show the required certifible items.