ISC VA-Based Web Services Connector - Raw JWT Token Response

[baoussounda (Ousmane N'DIAYE)]

Hi,

I’m integrating an on-premises REST API with ISC using the VA-based Web Services Connector.

The authentication endpoint returns HTTP 200 with the access token directly in the response body (raw JWT/string) rather than as a JSON property.

I’m unable to find a supported way in the Web Services Connector to capture this raw response and reuse the token for subsequent API calls.

Has anyone handled a raw token response like this with ISC Custom Authentication?

The same issue is described here: ISC Web Services Connector – Custom Authentication Endpoint Returns Raw Token (No JSON) – Need Supported Pattern - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community

Regarding the suggested approach of using a Web Services After Operation Rule to transform the raw response into JSON:

Does Web Services Connector support an After Operation Rule specifically on a Custom Authentication operation ?

Thanks

[SanjeevIAM (Sanjeev Kumar)]

Yes VA based Webservices connector supports the After Operation Rule. I would suggest you review the following solution to see if you can use Before Operation Rule approach for your case.

Generation of JWT using a Web Services Before Operation Rule and Private Key on VA

Hi, hoping to get some input on possible approaches for the use case below: Use Case: IDN needs to communicate to an end system using via an API for identity management operations. The system requires a private public key pair to be generated with the public key pair imported on the end system’s keystore. IDN must then generate a JSON web token with the following context: Header: { “alg”:RS256 } Payload: { “iss”: name of the user who holds the public key in the app’s user store, “exp…

[MattUribe]

I’ve had success using an after operation rule for the Custom Auth operation:

import sailpoint.object.*;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import sailpoint.object.Application;
                   
log.error("rawResponseObject --> "+ rawResponseObject.substring(0,6) + "...");

Map processedData = new HashMap();
List returnObj = new ArrayList();
Map bearerResponse = new HashMap();


bearerResponse.put("bearerToken", rawResponseObject);        
returnObj.add(bearerResponse);
processedData.put("data", returnObj);
return processedData;

[baoussounda (Ousmane N'DIAYE)]

Thanks @SanjeevIAM , @MattUribe .

Since my initial post I have created and attached a webservice after operation rule to my custom authentication operation but was waiting some action from application owner for the permissions configuration.

The following after rule works correctly :

import java.util.HashMap;
import java.util.List;
import java.util.Map;

Map result = new HashMap();

try {
    String rawToken = (rawResponseObject != null) ? rawResponseObject.trim() : "";
    if (rawToken.startsWith("\"") && rawToken.endsWith("\"") && rawToken.length() > 1) {
        rawToken = rawToken.substring(1, rawToken.length() - 1);
    }

    log.debug("Custom Auth After Rule : token received, length = " + rawToken.length());

    if (!rawToken.isEmpty()) {
        Map tokenMap = new HashMap();
        tokenMap.put("accesstoken", rawToken);

        List dataList = new ArrayList();
        dataList.add(tokenMap);

        result.put("data", dataList);
    } else {
        log.error("Custom Auth After Rule : token response was empty");
    }

} catch (Exception e) {
    log.error("Custom Auth After Rule : exception occurred : " + e);
}

return result;

In my Custom Authentication operation, I didn’t map anything in the response mapping. Instead, I populated the accesstoken in the after rule. For the other operations, I simply pass $application.accesstoken$ as the token.