Options for dynamically populating Provisioning forms allowed fields from external source

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Hi All,
What are the options to dynamically populate a custom Provisioning forms field allowed values from an external source. For example, we have a custom application where projects are managed. We would like to present the user with a select box of active projects so they can request access to one of the projects. Projects will be continually added to the application so static configuration in IIQ is not optimal. I noticed that the field attribute AllowedValuesDefinition allows including a script or beanshell reference. Can either of these call out to an external web service to fetch the active projects? Or is there a way to push values into IDM using a middleware service?

Thanks,

Joe

2

Depending on the frequency of the projects changes, an alternative approach could be to create a custom object that retrieves the value from the external source, and schedule a task to update the values multiple times per day, based on how often the project codes are added or removed. Implementing this approach could potentially reduce the resource usage and improve the performance and simplicity of your forms.

In addition, creating a custom object for the retrieved value may also facilitate referencing the value in other areas as needed.

1 Like
3

The best way to do this within the IIQ framework would be to represent those “projects” as entitlements in your entitlement catalog. Once you have that, you can then have a Field in your ProvisioningPolicy which is of type ManagedAttribute and filters on ManagedAttributes (entitlements) from that application that are of type “project”.

If you are using a Web Services or JDBC connector for example, you could set it up to aggregate the projects as entitlements that are associated with the account objects that are aggregated by the connector as well.

2 Likes
4

Hello Joe,

I think Sunny and Patrick already express some standard approach which you can achieve the goal. But let’s say this allowed values updated frequently then you can of course, write logic within the rule to retrieve the values dynamically. (Let me know if you need a short example for this).

1 Like