Implementing Leaver Use Case for DocuSign Using SailPoint IdentityNow Workflow
Overview
While working on a client implementation using the DocuSign eSignature Direct Connector in SailPoint IdentityNow, I successfully configured Joiner and Mover use cases. However, I encountered a limitation: Leaver functionality is not natively supported, as the connector lacks an option to disable user accounts.
To meet the client’s requirement of closing user accounts during the Leaver process, I collaborated with the DocuSign application team and devised a custom solution using DocuSign REST APIs and SailPoint Workflows.
Problem
The DocuSign eSignature Direct Connector does not support account disablement or deactivation, which is critical for offboarding (Leaver process).
Solution Approach
By leveraging DocuSign’s Close User API, I implemented a custom integration via HTTP operations in SailPoint Workflows. This API requires an JWT Bearer Token, which can be reused due to its long lifespan.
DocuSign API Reference
- Close User API:
delete | REST API | Docusign
Step-by-Step Implementation
1. JWT Authentication for Access Token
To access the DocuSign API securely, I used the JWT OAuth grant type, which supports long-lived tokens (up to 10 years).
Required Parameters:
user_idintegration_key(Client ID)private_key(RSA key)
Refer to DocuSign JWT Authentication Guide for detailed steps.
JWT Claim Tips:
iat: Current Unix time – use https://www.epochconverter.com/exp: Set expiry far in the future, e.g.,1999999999
Generate Access Token:
http
CopyEdit
POST https://account-d.docusign.com/oauth/token
Content-Type: application/json
{
"grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
"assertion": "YOUR_JWT"
}
2. Calling the Close User API
Once the token is obtained, use it in the Authorization header to call the Close User API:
http
CopyEdit
DELETE [https://account-d.docusign.com/restapi/v2.1/accounts/{accountId}/users/{userId}](https://account-d.docusign.com/restapi/v2.1/accounts/%7BaccountId%7D/users/%7BuserId%7D)
Authorization: Bearer {access_token}
3. Workflow Configuration in SailPoint IdentityNow
- Trigger: Use Native Change Detection to monitor
userStatusfrom the authoritative source. - Condition: If
status == inactive, initiate the workflow. - Step 1 – Get Token:
- Add HTTP Operation to generate the Bearer token.
- Step 2 – Close Account:
- Add another HTTP Operation to call the Close User API with the token.
Summary
By integrating SailPoint Workflows with DocuSign’s REST API, I successfully implemented the Leaver use case despite the limitations of the native connector. This approach provides a scalable, API-driven way to manage user lifecycle events beyond what’s offered out-of-the-box.