Manager attribute provisioning using SAP Fieldglass SAAS Connector

SailPoint Human Fabric (SHF) SHF Discussion and Questions
1

Hello Everyone,

Has anyone able to setup fieldglass SAAS connector. We have followed the connector documentation and were able to setup the connection and aggregate accounts. Everything works great.

The issue i am facing is with the manager attribute aggregation, when we try to read to read the manager using ISC, it give the native fieldglass id for manager attribute like below

image

Alhough, in the User Report reports created in fieldglass, we maintain the value account id like below. So this would cause issues when i would want to sync attributes for manager as for us this is non-authoritative downstream application.

image

More over how would the provisioning will work for this attribute. Which format should it be sent as i tried sending normal manager field but that is not being accepted by the target application.

Any leads would be helpful.

Thank You
Regards
Vikas.

2

Hi @vguleria - SAP Fieldglass uses SCIM style provisioning. Manager values provisioned would be the unique id for the manager. This is defined in the connector docs: Provisioning Policy Attributes

My guess is your native SAP Fieldglass report uses the derived manager name from these id values, i.e. showing the name as it’s more human readable in the reports.

For provisioning this attribute, send the manager’s unique id from the SAP Fieldglass app.

Hope this helps

3

Hi @robert-hails

Thank you for the confirmation. Yes, that is the last option I had in mind and unfortunity in this case, then i will have to create two new additional identity attributes.

  1. One that will store the fieldglass native identity id.
  2. Another identity attribute will then find the manager of current user and then find its fieldglass native identity from step 1.

I will test this approach but do you know if any other way we can achieve it ? I do need to enable the attribute sync for this attribute and we do not prefer using update provisioning policies.

Thank You.
Regards
Vikas.

4

Depends, are you for or against using cloud rules?

If you want to use attribute sync, you’re going to have to use an identity attribute for this but could use an identity attribute rule to populate it and restrict to one attribute vs two.

You could also use a custom workflow to resolve this, but may not be something you’d want to go down considering wanting to use attribute sync.

5

Hi @robert-hails

Thanks for the feedback. No i am not in favour of using cloud rules :smiley: .

Although i am curious to know if i can reduce the number of identity attributes here even from two to one. I rechecked the documentation of identity attribute rule and it says , it can fetch me the identity attribute value for another identity.

So, with this also then i think i will need to have two identity attributes. One that will store fieldglass id for the every user.
Then i create fieldglass manager identity attribute and then use identity attribute rule to fetch the manager’s fieldglass id.
If there was a way, where I could simply get the manager and from manager’s account , i could get the account attribute value, then i think i can reduce the identity attribute.

Can you please let me know if i am missing something here ?

Thank You.
Regards
Vikas.

6

Believe you can simplify to one attribute

Try using a transform like this (replace with your own attribute and app values):

{
    "name": "Identity Managers Fieldglass UUID for Sync",
    "type": "static",
    "attributes": {
        "ManagerUUID": {
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "type": "static",
                        "attributes": {
                            "value": "$identity.getManager().getLinksByAppIdOrName(null,\"SAP Fieldglass\")[0].nativeIdentity"
                        }
                    },
                    "null"
                ],
                "ignoreErrors": true
            }
        },
        "value": "#if($ManagerUUID != \"null\")$ManagerUUID#end"
    }
}