JDBC provisioning - two required attributes

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

I have a JDBC connector that, for provisioning, calls a stored procedure that was recently modified by the vendor to require two attributes. Is there a way to send both attributes through regardless if they are being synced?

2

@josephacciani Create a provisioning policy and map those attributes and in your provisioning rule you will send then.

3

Option 1: Add these attributes as plan arguments and read them in Connector rule
Option 2: (little crooked) Add a new field in your query that will concatenate 2 attributes with a separator and assign it to the attribute that is marked as Account ID. Read this in Connector rule using accountRequest.getNativeIdentity() and then split using the separator

4

I am attempting option 1 but am a bit new to this. I added the additional attributes to the Update policy for the source.

How do I read them into the Connector rule? I can’t seem to find what I am looking for in the documentation.

Thanks for the assist.

5

Option 1, I meant to say to be done using Before Provisioning Cloud rule

6

You can send that via creating provisioning policy in Source Account .
Create a policy form via API that will pass the variables that you want. For example, you can pass ‘email’, ‘firstName’, ‘uid’ etc according to your requirements. Here is the API create-provisioning-policy | SailPoint Developer Community
You can then get the value that you have passed in plan via following method. For example, if you want to fetch email that you have sent from plan:

getAttributeRequestValue(account, "email")

The function can be found in JDBC provisioning template provided by Sailpoint here. JDBC Provision Rule | SailPoint Developer Community

public String getAttributeRequestValue(AccountRequest acctReq, String attribute) {

    if ( acctReq != null ) {
      AttributeRequest attrReq = acctReq.getAttributeRequest(attribute);
      if ( attrReq != null ) {
        return attrReq.getValue();
      }
    }
    return null;
  }

Hope that helps.

7

That all makes sense but I am struggling to get the attribute to be required even when it is not being updated during an attribute sync. The account name comes through fine as well as the attribute that needs to be updated but never the additional attribute that is required by the stored procedure.