IIQ Access Tab / IdentityCube Entitlement Descriptions Blank

Which IIQ version are you inquiring about?

8.4p2

Please share any images or screenshots, if relevant.

Share all details about your problem, including any error messages you may have received.

Hi Everyone,

I’m trying to find a way that will allow for the Entitlement descriptions to show on the Identity Cube → Entitlements page and on the Manage Identity → View Identity → Access page.

I updated the UIConfig and included a Description column header on the grid. But even with a renderer it’s still not populating any information for the description..

When I fetch the XHR it shows that the managedAttributeId is blank, the description shows NULL and not sure if this is something we can do..

Any help is appreciated!

Hello Cody. I think the blank managedAttributeId is the one we have to look at here.

The description is pulled from the corresponding ManagedAttribute in the Entitlement Catalog, so I think adjusting UIConfig or the renderer will not help if that ManagedAttribute is not being resolved.

I would confirm that the application schema attribute is marked Managed, and that a matching ManagedAttribute exists in Applications → Entitlement Catalog with a description populated. If it does not exist yet, you could run an account aggregation or an Identity Refresh with Promote managed attributes enabled. If it does already exist with the expected description, it would be worth checking that the application, attribute, and value all match exactly, and then looking into why the IdentityEntitlement is not resolving to that ManagedAttribute.

Hi Cody,

can you try below steps and see if it works for you

  • Confirm a ManagedAttribute exists for the entitlements you care about (check Manage Attributes for that app/attribute/value) and has a description set.
  • If it doesn’t exist, either aggregate with managed attribute promotion turned on, or update the descriptions.
  • Then run “Refresh Identity Cube” (with “Promote managed attributes”/entitlement correlation option checked) or re-aggregate accounts so IdentityEntitlement rows get managedAttributeId populated.
  • After that, your UIConfig column + renderer will actually have data to render — you don’t need to change the column config itself.

If ManagedAttributes already exist with descriptions and managedAttributeId is still null after a refresh, check that the attribute/value on the entitlement exactly matches the ManagedAttribute’s attribute/value (and that you’re refreshing the correct application’s cube.

I don’t think Promote Managed Attributes is useful here. It is used to promote aggregated assignments as entitlements… this should not update descriptions or do anything on the identityentitlementgrid of the identity warehouse.

Agreed. I was only suggesting Promote managed attributes for the case where the corresponding ManagedAttribute does not exist yet. It would not populate the description or directly update the IdentityEntitlement grid.

If the ManagedAttribute already exists with the expected description, then the blank managedAttributeId is the part I would investigate.

Hey everyone,

I have confirmed that the managed attribute value is selected on the schema attributes and I’ve gone into the Applications → Entitlement Catalog and found that the managed attributes do have descriptions.

I’ve looked at several cases and it doesn’t seem to matter what managed attribute it is, they never render with a description in these places.

I’ve rerun refresh identity with promoted to make sure links are up dated and correct..

I’m starting to wonder if this isn’t possible without some heavy customization / a plugin to force it..

I am also trying the same thing in my Sandbox but it is not working either. Let me keep working on it and will share my findings as well.

Could you please share the UIConfig entries you have added/modified?

Sure, headed to the office now and I’ll share what I’ve done!

Okay so here is the OOTB versions without any customization..

There are two entries that I modified.

  1. <entry key="identityEntitlementGridColumns"

  2. <entry key="uiIdentityEntitlementGridColumns"

Within these entries they both have a dataIndex of
<ColumnConfig dataIndex="description" fieldOnly="true" stateId="description"/>

So I changed those entries into something renderable, so I thought… I’ve tried several different iterations to get this to work.. All of which have failed..

I’ve tried dot notation with managedAttribute.description

I’ve tried the entitlement description’s

most recently I tried

<ColumnConfig dataIndex="IIQ_entitlementDescription" fieldOnly="true" groupProperty="IIQ_entitlementDescription" headerKey="cert_item_tbl_header_entitlement_description" hidden="true" property="IIQ_entitlementDescription" sortProperty="IIQ_entitlementDescription" stateId="IIQ_entitlementDescription"/>

Appreciate the help!

I have tried the same thing.. in my case when i set property, it was trying to read it from identityentitlement object and it failed with error that property not available. I’ll continue checking that and will update here.

Yes, that data index only looks at IdentityEntitlement so there is no property for description. It would have to lookup the MA to get it but does not seem like that is possible with just a column config.

Hi @dustin_cody ,

I did some digging into this and this is what I found.

A ManagedAttribute description stored in two different places:

  • Object Properties — basically a general free-text property.
  • Standard Properties — the actual locale-aware description field, such as en_US.

IIQ’s Explanator, which is what actually resolves descriptions everywhere, only reads Standard Properties. So a description can look totally fine in Object Properties and still never show up anywhere in IIQ. Worth ruling that out first.

Separately: IdentityEntitlement doesn’t store a description at all. It just stores application/name/value/type. IIQ has to resolve the description from the matching ManagedAttribute at runtime.

Here’s the actual bug: the server does correctly resolve the description via Explanator.getDescription(...), but it never makes it into the JSON response the grid uses — it gets computed, then dropped before serialization. Confirmed this by checking the network response directly; the value just isn’t there. That means no UIConfig or renderer change can fix it, as long as I could find. the data’s gone before the UI ever sees it.

Workaround: there’s a separate endpoint that already returns the description correctly:

GET /rest/identities/{identityId}/identityEntitlements/{entitlementId}/details

Unhide the existing description column, then hook the grid’s load event to call this endpoint per row and patch the description in:

entStore.on('load', function(store, records) {
    Ext.each(records, function(r) {
        Ext.Ajax.request({
            url: '/rest/identities/' + identityId + '/identityEntitlements/' + r.get('id') + '/details',
            success: function(resp) {
                var d = Ext.JSON.decode(resp.responseText);
                if (d.description) { r.set('description', d.description); r.commit(); }
            }
        });
    });
});

(entStore/identityId will need to match whatever they’re actually called in your version.)

One thing to keep in mind: the JavaScript would be modifying a shipped core file, so applying this would require access to the IIQ application server/filesystem

Would you mind helping me understand what files on the server would need to be updated? Or how to implement this?

Would I need to update the UIConfig.xml file with

entStore.on('load', function(store, records) {
Ext.each(records, function(r) {
Ext.Ajax.request({
url: '/rest/identities/' + identityId + '/identityEntitlements/' + r.get('id') + '/details',
success: function(resp) {
var d = Ext.JSON.decode(resp.responseText);
if (d.description) { r.set('description', d.description); r.commit(); }
}
});
});
});

Attaching the actual file for reference, three places were touched:

  1. createGrid()
  2. New function renderDescription
  3. New function enrichDescriptions

Path: webapps/identityiq/scripts/sailpoint/web/define/identity/identityEntitlementsGrid.js

identityEntitlementsGrid.js (28.5 KB)

UIConfig change:

<ColumnConfig dataIndex="description" headerKey="description" hideable="true" percentWidth="20" renderer="SailPoint.Define.Grid.IdentityEntitlements.renderDescription" stateId="description"/>

I was able to get this to work in the Identities → Identity Warehouse → Selected Identity → Entitlements.

The but this doesn’t work on the Manage Identity → View Identity → Access page.

Probably just need to reconfigure some of the code, not sure. But I appreciate the help!

The Entitlements tab and Access page are two different front-end pieces. The fix we applied only covers the Entitlements tab and the Access page is a separate screen with its own JS/grid config, so it won’t automatically carry over. We’d need to locate that file and patch it separately, but the same enrichment pattern should apply there too.

I searched for uiIdentityEntitlements.js but didn’t find anything in the binaries.

Looks like there’s not a way to do this part due to the bug and the file not being available.

Hello Cody. I would not treat the missing uiIdentityEntitlements.js as the end of the road. I would try a plugin snippet instead of modifying another shipped IIQ file.

As a first check, inspect the XHR/grid data on Manage Identity → Access in 8.4p2. If it exposes the identity ID and IdentityEntitlement ID, you may be able to reuse Pujan’s /rest/identities/{identityId}/identityEntitlements/{entitlementId}/details approach.

If switching to Access does not change the browser URL, point the snippet regexPattern at the parent Manage Identity page and let the JavaScript detect the Access grid.

If the grid only gives you application/attribute/value, that endpoint will not be enough. In that case, I would consider a small plugin REST resource to resolve the matching ManagedAttribute description and return it to the snippet.

I have not tested this against the 8.4p2 Access grid, so I would confirm the grid data first. But I would try this path before concluding that the Access tab cannot be customized.

Hi Harish,

Thank you for the feedback and guidance, i’ll look into this further!

Best Regards!