We are integrating SailPoint ISC with ServiceNow Service Catalog and would like to create separate record producers for individual applications. The requirement is for each record producer to display only the requestable access associated with a specific application in ISC. What is the recommended approach to configure this requirement?
TIA
Hello Rashmi,
Yes, I think this should be doable.
I would first set it up properly in ISC. Create/configure the Access Application under Admin > Access Model > Applications, add the related access profiles to that application, and make sure Visible in Request Center and Allow Access Requests are enabled.
On the ServiceNow side, you can use the OOTB SailPoint Access Request record producer as the base and clone it for each application. Then update the SailPoint access object widget on each cloned record producer so it only shows the access for that specific application/source.
The widget has an Encoded Query for items under Add Access option, which can be used to refine what roles, access profiles, and entitlements are shown. So for each cloned record producer, apply the right filter there and test it with one application first.
This keeps the request UI separated by application in ServiceNow, but ISC still controls the real requestability, approvals, account selection, and provisioning. Also make sure the access profiles are requestable in ISC, otherwise they will not show even if the ServiceNow filter is correct.
Thank you for your response.
The issue I am facing is that I am unable to locate the widget within the Record Producer as referenced in the documentation.
Below are the steps I have performed:
Cloned the SailPoint Record Producer.
Cloned the “ISC Access Object Selection 2” variable and updated the default value in the JSON for the “Encoded Query for items under Add Access” field. The default value was similar to:
@apps(id:123456)
As per the SailPoint Record Producer documentation, the next step is to update the widget configuration from the Variables related list within the Record Producer. However, I am unable to find any widget-related entry or configuration in the Record Producer.
Could you please advise if there are any additional steps required, or if the widget configuration is maintained elsewhere in the integration?
In the record producer, SailPoint widgets are not a separate section. They sit inside the Variables related list as widget/macro type variables. When the SailPoint doc says “select Widget from the Variables related list,” it means open that variable and check the Default Value tab. That is where the widget reference and JSON options live.
So I would check: open your cloned record producer, go to Variables related list, and confirm your cloned ISC Access Object Selection 2 variable is actually attached there. If you cloned the variable separately but did not attach it back, the record producer may still be pointing to the original or not rendering the widget config at all.
For the query, @apps(id:123456) is valid ISC search syntax for access profiles associated with an Access Application. so that approach should be fine. You can also try source.name:"Source Name" if you want to filter by source directly. A bad or too-strict query can return zero results, which can make it look like the widget itself is broken when it is actually just the filter.
Get the variable linked correctly first, then test the query. Those are two separate problems and easier to debug one at a time.
Hi @punna0001 - We were able to connect the widget to the Record Producer. We cloned the “ISC Access Object Selection 2” widget and associated it with the “Access Object Search” variable. Within the widget configuration, we updated the options schema to include the Application ID as the default value.
However, when submitting an access request through the new Record Producer from Employee Center, the filter does not appear to be working. Users are still able to view all requestable access profiles in the environment rather than only those associated with the configured application.
Please find the widget options JSON below. Do you have any thoughts on what might be causing this behavior or if there are any additional configuration steps required?
Good progress on linking the widget. I think the issue might be where the query is being set. From the JSON, it looks like you updated the widget’s Options Schema. That defines what options the widget supports, but it may not be the actual runtime value your cloned record producer reads. For record producer level filtering, the encoded query needs to be set in the Default Value tab of the widget variable attached to your cloned record producer. That is the value it picks up when the page loads.
So I would check: open the cloned record producer > Variables related list > open the widget variable > Default Value tab > set the encoded query there.
Also, I can see add_roles_encoded_query and add_entitlements_encoded_query are both empty. So even if the access profiles filter works, the Roles and Entitlements tabs will still show everything. Either set those queries too, or configure the search results tab to only show Access Profiles.
For testing, try using a known source.name:"Your Source Name" or even a fake ID. If it still shows everything, the option is not being picked up from the record producer config. If it returns zero results, the mechanism works and you just need to get the right query value
