JSON Query Path to fetch user groups in Web Service After Operation Rule

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hello All,

I’m trying to query a REST API based application from a Web Services - After Operation Rule to get the group memberships of a user from REST API endpoint and update it on the user accounts during aggregation.

The way I’m trying to simplify this is by using the below statements in the rule :

String queryPath = "JSON Query path to get user groups if condition matches";
String RESPONSE = "My JSON response from the target as documented in below section"

for (Map account : processedResponseObject) {
    String id = account.getNativeIdentity(); 
    List groups = JsonPath.parse(RESPOSE).read(queryPath, List.class);
    account.put(Groups, groups);
}

The above code would store the group membership which matches with the given JSON query path in the “groups” list and will be returned back to response object to be stored under Groups attribute.

However, I’m facing difficulty in constructing the JSON query path for fetching the groups. The way I need the JSON query is :

  • From below JSON response, If Resources > members > value == 8122001845556664, then I need its Resources > id as output from the JSON query
{
	"totalResults": 2,
	"startIndex": 1,
	"itemsPerPage": 2,
	"schemas": [
		"urn:ietf:params:scim:api:messages:2.0:ListResponse"
	],
	"Resources": [
		{
			"displayName": "account users",
			"members": [
				{
					"display": "user1, iam",
					"value": "8122001845556664",
					"$ref": "Users/8122001845556664"
				},
				{
					"display": "user2 iam",
					"value": "1410384382558463",
					"$ref": "Users/1410384382558463"
				}
			],
			"id": "304938766536524"
		},
		{
			"displayName": "TEST Group",
			"members": [
				{
					"display": "user3, iam",
					"value": "7609153611047458",
					"$ref": "Users/7609153611047458"
				},
				{
					"display": "user4, iam",
					"value": "3303558023366295",
					"$ref": "Users/3303558023366295"
				}
			],
			"id": "738595786832639"
		}
	]
}

Any help with constructing the JSON query to fetch details as mentioned above is really appreciated.

Thanks,
Arshad.

2

Hey @Arshad , Instanciate the JSON Object and use .get .

best,

3

Yes Ivan, looks like I cannot use the JSON query path for this requirement. Probably need to iterate using JsonUtil as JSON objects.

4

Hi Arshad,

If you have already imported the jsonUtil library, then you can use the below code snippet to convert json to Map and then as Ivan mentioned, you can use get the values.

Map response = (Map) JsonUtil.toMap(“JSON AS STRING”);
response.get(“KEY”);

Thank You.
Regards
Vikas

5

Yes Vikas, the template might not be a simple one as I have to iterate through multiple maps within the JSON and parse it in a nested manner.

6

@arshad, what you can do in the rule is , get all the groups, put in a variable and them see if the user has it in the IDN memory instead of doing multiple requests.

Best!

7

@ipobeidi Can you please elaborate more on this approach?

8

Sure,

If you have a endpoint where it returns the groups and inside of it you have all the members of each, you dont need to be executing the call for that endpoint every time.
You can simple query the groups endpoint and check on the java code, without api calls, if the users is in the group. If so you just add it to the responseMap .

that way you make only one API call on your code.

Best.

9

Thanks for the explanation @ipobeidi

That’s the approach I was thinking of as well.

To have a string attribute to hold all the groups response from target by writing a method to call the target for groups and its members:

String GROUPS_RESPONSE = getJSONGroupsResponse();

And the iterate the processedResponseObject from the connector to fetch each user ID and check if they’re part of GROUPS_RESPONSE, and if yes, then parse it with JsonUtil and get the Group value of each user and return it back.

10

Exactly! thats the best way to do it. One thing, when you have the group response, already instanciate it so you don have to be re-writing it on the memory.

Hope my answer was your solution :wink:

1 Like