Logging for single application provisioning

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

IdentityIQ 8.4p1

We have webservices connector with Role Based provisioning. During failures, we are trying to capture API response in AfterOperation rule but it is not working. We tried ’ throwProvAfterRuleException’ but we could not get the logs from AfterOperationRule. We can see errors in After provisioning Rule but cannot see what was the API response.

What we need is to get logs when there is a failure during provisioning, especially what is the API response for that failure use case.

We wanted to enable logs but currently we found only connector level logging. This will occupy too much space on our drive, so we are looking for application specific logging where logs for specific application provisioning is captured.

Thanks,
Srikanth

2

Hi @srinamala03,

unlucky doesnt exist logs for specific application, like you say, you activate the logs for a the connector but logs for the application you must write you into the rules.

First of all, you must understand the error and remember that:

  • After Op. Rule → you have the response of API(and the possible error code that return of the API)
  • After Prov. Rule → you have the response plan created by IIQ where you can find the error

try to build the call on postman and try to find the correct way to construct the call, later set the operation in IIQ in the same way.

3

Hi @enistri_devo ,

Problem with this use case is, we do not know what is wrong with our request. Same user creation works following day with same attributes(requestBody). And this is not reproduceable error, like we do not know the pattern when we are getting this error. We are seeing this error approximately once in 3-4 days. So if we enable connector logging, we should keep it until we capture that error.

We have added logs in After Operation rule to capture API response but it is not going to AfterOperation Rule when there is a failure.

Any suggestion would be appreciated.

Thanks,
Srikanth

4

did you try in postman?

Also, can share the error?

5

You could try setting the isDevelopmentMode flag on the application in debug. You’ll still have to play around with some log levels and maybe add some filtering in your logging config, but this helps isolate web connector logging by application a little bit better.

<entry key="isDevelopmentMode">
  <value>
    <Boolean>true</Boolean>
  </value>
</entry>

Setting connector.common.http and connector.sdk.webservices to DEBUG in combination with that application attribute were what got me what I wanted last time I needed request/response info.

1 Like
6

Hi @srinamala03,

Please check the syslogs during that failure of provisioning transaction.

In audit you can see what kind of http error is it (http 4** or http 5**)when the transaction is made.

Whatever you are passing to webservice operation, you can log all of the arguments like provisioning plan, json body.. etc

Even the application team can enable logs at the target end to see what payload is being sent by identity iq.

Use postman to validate the http calls (GET/PUT/PATCH/POST) request and response or you can use CURL commands from the server.