IdentitySelector for IdentityOperation (Rapid Setup Termination)

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

Version 8.4

Share all details related to your problem, including any error messages you may have received.

Hello Experts,
I must show only contractors’ user type in Identity Operations for Rapid Setup Termination process. Since Identities → Identity Operation is not a Quicklink, We cannot use Dynamic scopes here. Please let me know if we can filter the identities and show only specific identities when the user clicks Identities → Identity Operation. (By default employees should not appear here in selectIdentities suggestion)

2

I think, you can create a specific workgroup for those users and work with SPRights and capability if you cant use quicklinks.

https://community.sailpoint.com/t5/IdentityIQ-Articles/IdentityIQ-Rights-and-Capabilities-Definitions/ta-p/77550

You dont belive a SPright/Capability already exists for you necessity, so you need create it

3

Hello Emanuele, Sorry if my ask is not clear. We know we have capability “RapidSetupIdentityOperationsAdministrator” which provides access to Identity Operation under Identities. The ask is once someone clicks the Identity Operation, I am able to see all the identities in the system and terminate it. The requirement is, in this screen I should see only few users maybe based on “User type = Contractor” by default and hide all the employee in the Identity Selection screen. Is this possible with any configuration OOTB?

image
image1881×701 35.5 KB

4

sorry for the question, why dont use an identityselector in quicklinks populations?
otherwise you need create a custom spright and add to this capability

5
  1. Identity Operation is not a Quicklink. Hence Dynamic scope cannot be applied here.
  2. Capability & SPright is to provide access to a menu item i.e Identity Operation. Our requirement is not around this and instead restricting identities displayed in Identity selection screen when Identity Operation is clicked. So capabilities is of no help here
6

I searched a lot and I dont find a good method for restricting identities in this case.
I think to solution but I dont know if resolve your case.
The first is create a quicklink with a filter rule or match critiria and assing this to a workgroup; for example a workgroup can view the external and anthor for internal, but applies for all pages.
Also, you can create a plugin and remove the FullAccessTerminateIdentity capability for all users.
Or you need to find the class that SP uses in this page and change it for filter the identities

7

Hi @venky_t24,

Have you ruled out the option to use scope to restrict the user to see only necessary details?

Thanks

8

Hello @ashutosh08 & @enistri_devo,
Thank you for your response.
Scoping is a good option to consider as all other options involves more customization like changing xhtml pages or creating a custom quicklink & workflow.

Do we know if we can use Configuration-> IdentitySelectorConfiguration for this requirement?

9

Also I saw that. You can change the IdentitySelectorConfiguration but its affect all the page that you use it, so the al environment

10

Hi @venky_t24,

As mentioned by other community member it will be a global change and your use-case is to just restrict the data to be viewed by user, so scope is looking best for it.

But before considering do analyze thoroughly as it will also be a global change.

Thanks

11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.