Loopback connector

IdentityIQ (IIQ) IIQ Discussion and Questions
, , , ,
1

The more specific you can be (8.4 P1)
We have 2 SailPoint instances one is Low side and another one is high side we have implemented the IIQ Loopback connector in the high side and are aggregating roles and entitlements from the High side as entitlements to the Low side via webservice SCIM API connector.

All the Managed Attributes will be displayed as entitlements in the Low side SailPoint instance. In the High side roles have been configured as business roles and within each business role the technical roles have been attached with entitlements.

Now when we are raising Access request for roles from the low side it is sending the details to High side and the provisioning stops at the bundle level. It does not go further into the bundle to provision business role, technical role, entitlements.

In the attached log you can see that the provisioning plan only goes up to the bundle level

<AccountRequest application="IIQBundleLoopback connector" op="Modify">
    <AttributeRequest name="bundles.name" op="Add" value="API Gateway Admin"/>
  </AccountRequest>

image
image1205×237 70.4 KB

Please advise on how the roles can be provisioned as part of bundle how to handle in provisioning plan.

2

Did you try to modify the IdentityRequestConfiguration.xml on Low Side to expand business roles into technical/IT roles before provisioning:
in this Location: WEB-INF/config/IdentityRequestConfiguration.xml add/modify this:
this might ensure that when an access request is created in the Low Side, the provisioning plan includes all technical roles and entitlements.

3

another thing that might help:

If SCIM API only accepts predefined attributes, modify the SCIM request payload on Low Side to send technical roles and entitlements explicitly instead of only the “bundle name”.