One Entitlement at a time on webservice connector

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi All,

I have a Web Services (Oracle WMS) source where a user can hold only one group at a time in the default_group attribute (isEntitlement: true, isGroup: true, isMulti: false, fixedPlanMultivaluedAttribute: false).

Problem:

When a user requests a new entitlement (e.g. ASG SuperUser → Warehouse User), the BeforeOperation rule correctly updates the target. However, ISC retains both the old and new entitlement in the identity’s access catalog, causing SYSTEM to generate repeated Identity Refresh operations flipping the target back and forth indefinitely.

Approach being considered:

A Before Provisioning Rule at the source level to intercept the plan, remove the old default_group attribute request and keep only the new one — preventing duplicate Add Entitlement calls entirely.

Questions:

  1. Is the Before Provisioning Rule the right place to clean duplicate single-valued entitlement requests from the plan?

  2. Has anyone solved this pattern for a Web Services connector where the target supports only one entitlement value at a time?

  3. Is provisioningPlan.getRequesters() reliable for detecting SYSTEM-generated refresh operations vs human-initiated access requests inside a BeforeOperation rule?

Thanks in advance.

2

Have you considered using a dynamic role for this? Seeing as this is entitlements I would suggest using roles. This does both add and remove for you based on the criteria that you define and would prevent a user from having multiple entitlements.

A before provisioning rule should only ever be considered when you have fully ruled out all other options. Did you also review the available connectors for Oracle? This may have already been solved with an OOTB connector.

{B27DA1EC-26E5-46FD-A219-F70C32F6E316}
{B27DA1EC-26E5-46FD-A219-F70C32F6E316}488×1149 58.6 KB

3

Hi Mark, Thanks for the quick reply.

I am using pure web service and configured HTTP calls.

When I requested to add an entitlement on exiting the operation, I am updating the account using addEntitlement, and it updates properly. However, I see the system triggering a refresh on identity to send the previous entitlement again to the target to override.

Thanks,

4

Are you using roles to manage this? Or do you have it hard coded in your WebServices connector config?

5

I am using the entitlement request to manage via an access request.

6

in that case you need to submit 2 request for the user. 1 to remove and 1 to add. I would recommend looking at roles to do this. as that gives you flexibility and the remove will happen automatically when the user no longer meets the criteria. Also assuming that you have the remove entitlement defined in your webservices operations. You might even look into Workflow to see if that will meet you need if roles don’t work.

7

in Add ent http op,

  1. use remove ent api instead.
  2. Then add a getObject operation and use Add Ent Api that you have.
  3. Lastly , on getObj http operation , use parent endpoint as Add entitlement Http operation
8

Hello All, Quick update.

it is working after I made a change in the account schema’s attribute default_group type to String from group.

Thanks,

@SivaLankapalli