Issue in Provisioning Policy (Add Entitlements) – Email attribute not resolving

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , , , ,
1

Description:
I’m facing an issue when using a Provisioning Policy in the “Add Entitlements” operation.

The target application requires an email field, but I’m unable to populate it using any of the following options:

  • Identity attribute (e.g. email)

  • Account attribute (e.g. mail from AD or HR source)

  • Even when trying to inject the value via a BeforeProvisioning Rule, the field still arrives as null.

It seems that during the “Add Entitlements” operation, the plan context does not have access to these attributes — even though they are correctly populated in both the identity and account.

Has anyone experienced this limitation?
Is there any specific way to reference identity or account attributes in Entitlement-only operations, or is this a known restriction in ISC?

2

hi @henriqueoliveiraIAM I have seen this problem. I think this is not an issue, plan just does not contain other attribute values not related to current operation.

What I have done to fixe it in other plan operations, is force the attributes to appear using the provisioning policy. In my case, I need the email in the enable and disable operations, so I added it to the Disable and Enable Provisioning Policy. I think you can add it the email field in the Assign Provisioning Policy.

Just create a new Provisioning Policy in Visual Studio Code:

image
image597×234 12.2 KB

I think type for entitlement addition is Assing (if it works, share here with us, if it does not, try another type).

You can copy the email attribute from the Create Provisioning Policy, but should be something like this:

{
    "name": "Add Entitlement",
    "description": null,
    "usageType": "ASSIGN",
    "fields": [        {
            "name": "mail",
            "transform": {
                "type": "identityAttribute",
                "attributes": {
                    "name": "email"
                }
            },
            "attributes": {},
            "isRequired": false,
            "type": "string",
            "isMultiValued": false
        }
    ]
}
3

HI,

this is my provisioning plan:

{
    "name": "Add",
    "description": null,
    "usageType": "ASSIGN",
    "fields": [
        {
            "name": "emailadiciona",
            "transform": {
                "type": "identityAttribute",
                "attributes": {
                    "name": "email"
                }
            },
            "attributes": {},
            "isRequired": false,
            "type": "string",
            "isMultiValued": false
        }
    ]
}
4

@henriqueoliveiraIAM Did this work for you?

5

Hello, it didn’t work.

We remind you that creating a before rule retrieved the collaborator’s email address from Sailpoint.