Ok, I need some help with this one…. I’m writing a JDBC Provisioning Rule and I’m running into a problem that has been giving me a headache for weeks now…
Here’s the simplified version of my code:
import //(lots of imports. I won't list them all. They are the class imports needed from java.sql to sailpoint.object, blah blah blah)
public String getAttributeRequestValue(AccountRequest acctReq, String attribute) {
if ( acctReq != null ) {
AttributeRequest attrReq = acctReq.getAttributeRequest(attribute);
if ( attrReq != null ) {
return attrReq.getValue();
}
}
return null;
}
// Initialize the result
PreparedStatement statement = null;
CallableStatement cstmt = null;
ResultSet resultSet = null;
if (plan != null) {
List accounts = plan.getAccountRequests();
if ( ( accounts != null ) && ( accounts.size() > 0 ) ) {
for (AccountRequest account : accounts) {
try {
if (AccountRequest.Operation.Create.equals(account.getOperation())) {
// Get values from the provisioning plan
String nativeIdentity = account.getNativeIdentity(); //1
String lastName = getAttributeRequestValue(account, "LastName"); //2
String firstName = getAttributeRequestValue(account, "FirstName"); //3
String email = getAttributeRequestValue(account, "Email"); //4
// Check if the user already exists in SQL database
statement = connection.prepareStatement("USE sprocDatabase SELECT COUNT(*) FROM userDatabase.dbo.User WHERE FirstName = ? AND LastName = ? AND Email = ?");
statement.setString(1, firstName);
statement.setString(2, lastName);
statement.setString(3, email);
resultSet = statement.executeQuery();
resultSet.next();
int countBefore = resultSet.getInt(1);
if (countBefore > 0) {
// User already exists, log the message and continue to adding user to required groups
log.error("User already exists within the database.... Continuing to add to requested groups");
return null;
} else {
// User doesn't exist, create the account in the SQL database before adding to groups
String sql = "{call dbo.idmgr_CreateNewUserAccount_SAILPOINT(?, ?, ?, ?, ?, ?)}";
cstmt = connection.prepareCall(sql);
// Set input parameters
cstmt.setString(1, nativeIdentity);
cstmt.setString(2, lastName);
cstmt.setString(3, firstName);
cstmt.setString(4, email);
AttributeRequest officeName = account.getAttributeRequest("OfficeID");
if (officeName != null && ProvisioningPlan.Operation.Remove.equals(officeName.getOperation())) {
cstmt.setNull(5, Types.NULL);
} else if (officeName != null) {
cstmt.setString(5, officeName.getValue());
} else {
log.error("OFFICENAME FROM ATTRIBUTEREQUEST IS NULLEMPTY");
}
AttributeRequest roleName = account.getAttributeRequest("RoleGroupID");
if (roleName != null && ProvisioningPlan.Operation.Remove.equals(roleName.getOperation())) {
cstmt.setNull(6, Types.NULL);
} else if (roleName != null){
cstmt.setString(6, roleName.getValue());
} else {
log.error("ROLENAME FROM ATTRIBUTEREQUEST IS NULLEMPTY");
}
// Execute stored procedure
cstmt.executeUpdate();
cstmt.close();
ProvisioningResult result = new ProvisioningResult();
result.setStatus(ProvisioningResult.STATUS_COMMITTED);
} else if (AccountRequest.Operation.Modify.equals(account.getOperation())) {
/* Modify account request -- change role*/
} else if ( AccountRequest.Operation.Delete.equals( account.getOperation() ) ) {
//disable
} else if ( AccountRequest.Operation.Disable.equals( account.getOperation() ) ) {
// Disable, not supported.
} else if ( AccountRequest.Operation.Enable.equals( account.getOperation() ) ) {
// Enable, not supported
} else if ( AccountRequest.Operation.Lock.equals( account.getOperation() ) ) {
// Lock, not supported.
} else if ( AccountRequest.Operation.Unlock.equals( account.getOperation() ) ) {
// Unlock, not supported.
} else {
// Unknown operation!
}
}catch (SQLException e) {
ProvisioningResult result = new ProvisioningResult();
result.setStatus(ProvisioningResult.STATUS_FAILED);
} finally {
if (statement != null) {
statement.close();
}
if (resultSet != null) {
resultSet.close();
}
if (cstmt != null){
cstmt.close();
}
}
}
} else {
result.addError("ACCOUNT IS NULL!!!");
}
}
return result;
Here’s the problem I’m running into:
I do not receive any errors from the Sailpoint IDN/ISC side. As far as ISC can tell, the user was setup successfully in the database and the user was assigned their respective entitlements:
However… the user is never set up in the SQL database because the SPROC won’t trigger if the “role” fields are NULL…. Which led me to my CCG log files where I found this…
"message":"OFFICENAME FROM ATTRIBUTEREQUEST IS NULLEMPTY","pipeline":"12…….
"message":"ROLENAME FROM ATTRIBUTEREQUEST IS NULLEMPTY","pipeline":"12….
This is because of these two lines in my code:
Which tells me that:
AttributeRequest officeName = account.getAttributeRequest("OfficeID");
AND
AttributeRequest roleName = account.getAttributeRequest("RoleGroupID");'
are NULL.
But that doesn’t make sense…
If account.getAttributeRequest("OfficeID") and account.getAttributeRequest("RoleGroupID") are NULL, why are they assigned on the Identity Cube in Sailpoint?
Shouldn’t those be NULL too then?
Also, why are account.getAttributeRequest("OfficeID") and account.getAttributeRequest("RoleGroupID") showing as NULL, when their respective Entitlements show that they have values?
!
What am I missing fam? Am I not using account.getAttributeRequest() correctly? I wish I could see the ProvisioningPlan so I could see what these values look like, but plan.toXml doesn’t work in Sailpoint IDN/ISC….
A Haiku:
I need your help, please.
I've lost my mind with this one.
All help is welcomed.
Thank you! <3
