JDBC Provisioning

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hello Experts,

I m testing a account provisioning scenario, during the update operation need to request for 2 different types of entitlements and both entitlements needs to be passed to the same table and both are mandatory, but once requested from SailPoint getting 2 different requests for each entitlements.

Any idea on how to pass both in same request.

2

Pass them as role or Access Profile. The plan will then have comma separated entitlements in a single request which you can pull into your code. Split role/AP with comma (,), then you will get each entitlement in a single request and can send it into table.

3

Hey @rkhade, assuming that you’re requesting these entitlements individually from request center. If yes, then that is an expected behavior as SailPoint creates individual entitlement requests leading to individual provisioning plans for them.

If you have them mapped inside an access profile or a role, then SailPoint inherently collates individual attribute requests into single account request.

Below is an example provisioning plan I’ve seen being generated by SailPoint if you combine multiple entitlement types into an accessprofile or role:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE ProvisioningPlan PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<ProvisioningPlan nativeIdentity="Test User1">
  <AccountRequest application="TEST_SOURCE" nativeIdentity="Test1" op="Modify">
    <AttributeRequest name="role" op="Add" value="Analytics">
      <Attributes>
        <Map>
          <entry key="allowSimplification">
            <value>
              <Boolean>true</Boolean>
            </value>
          </entry>
        </Map>
      </Attributes>
    </AttributeRequest>
    <AttributeRequest name="group" op="Add" value="Reporting">
      <Attributes>
        <Map>
          <entry key="allowSimplification">
            <value>
              <Boolean>true</Boolean>
            </value>
          </entry>
        </Map>
      </Attributes>
    </AttributeRequest>
  </AccountRequest>
  <Attributes>
    <Map>
      <entry key="accessRequestType" value="GRANT_ACCESS"/>
      <entry key="identityRequestId" value="<>"/>
      <entry key="requester" value="<>"/>
      <entry key="source" value="LCM"/>
    </Map>
  </Attributes>
</ProvisioningPlan>

If you notice, SailPoint automatically adds the flag called allowSimplication : true to the plan by default, which is what I’m assuming would help you achieve your ask.

Now, in your JDBC provision rule, you can iterate through the account request - > attribute request to get both the entitlement values from the plan and execute the desired SQL query to update it on the database table for the user record.

Hope this helps.

Thanks,
Arshad.