IFS Assyst ITSM as Front-End for Access Requests with SailPoint ISC for Provisioning - Design Guidance

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi everyone,

I’m currently working on a design where IFS Assyst ITSM will act as the front-end system for access requests and approvals, while SailPoint Identity Security Cloud (ISC) will handle the provisioning and identity lifecycle management.

I wanted to get some guidance and hear from others who may have implemented a similar pattern.

Proposed Flow (High-Level)

  1. User submits access request in IFS Assyst

  2. Approval workflow is handled entirely within IFS Assyst

  3. Once approved, Assyst sends the request to SailPoint ISC

  4. ISC processes the request and performs provisioning via connectors (AD, SaaS apps, etc.)

  5. Status (success/failure) is sent back to Assyst (with an Email)

I also came across a similar discussion for BMC Helix ITSM integration with SailPoint ISC:
https://developer.sailpoint.com/discuss/t/bmc-helix-itsm-integration-with-sailpoint-idn/98705

It looks like @KRM7 you had a similar requirement with BMC and mentioned that the solution can be achieved using workflows.

Could you please share the high-level implementation steps on how you achieved this?

From my understanding, out-of-the-box ISC workflows do not directly support application provisioning, so I’m trying to understand how this was handled in your implementation (e.g., via Access Request APIs, triggers, or any custom orchestration).

Any guidance would be really helpful.
@YGupta22

2

Hi @shiva_Idm19

I think you can accomplish this as long as your IFS Assyst ITSM supports HTTP Requests and has some basic logic for checking the status of a request.

You can leverage the access request API endpoints to submit requests. You’ll need to make the entitlements requestable on the ISC side and make them have no approvals since you want all the approvals done on the ITSM side.

To track the status of the request, your ITSM will need to record the access request ID that is given when you submit an access request, then it will need to frequently check the status of the request to ensure it was completed successfully.

Let me know if you have any questions or concerns on the approach!

3

Thanks Tyler for your reply, but this typically involves calling various SailPoint APIs 5 times(Refer below screenshot for details).
So we are doing a POC on creating a workflow in which Assyst will do one call and SailPoint ISC will do the heavy lifting

image
image1483×474 30.6 KB