PAT scope auto-generator(?)

SailPoint Human Fabric (SHF) SHF Discussion and Questions
,
1

Hi,

Do we have tool (and if not, I think that there should be), that you can input the API endpoints that you are using, confirm read/write status, and it outputs what the minimum scope for you PAT token is?

eg. I need to read (GET) from these three endpoints for my workflow:

https://tenant.api.identitynow.com/sod-policies/v1/{{$.trigger.policy.id}}

https://tenant.api.identitynow.com/historical-identities/v1/{{$.getIdentity.id}}

https://tenant.api.identitynow.com/sources/v1/{{$.defineVariable.source}}

I think that this is the minimum, but is this enough/correct?
idn:identity-history:read
idn:sod-policy:read
idn:sources:read

2

Yes, this looks correct. The three scopes you listed are the minimum required for these GET APIs.

I also think this is a good idea for a tool. It would make it easier to identify the minimum PAT scopes required for any API endpoint and follow the least-privilege approach. It should also consider the PAT owner’s access/user level, since access is not limited to scopes alone.

4

Hi Phil,

That is a neat idea - drop your endpoints and methods into a tool and have it provide the minimum required scopes. I’m not aware of one today that’s officially part of the Community Toolbox. Would love to see it though.

Matt

5

There isn’t currently a SailPoint tool that automatically analyzes API endpoints and calculates the minimum PAT scopes required.

For the endpoints you listed, your proposed scopes look correct:

idn:sod-policy:read

idn:identity-history:read

idn:sources:read

The best way to validate is to create a PAT with only those scopes and test the API calls. If any request returns 403 Forbidden, add the additional scope indicated by the API documentation. Using the least-privilege approach is generally the recommended practice.

6

The scoped credentials work fine when its created as one of my PAT tokens.
However, if I try to create credentials via Admin/security settings/API management, the workflow fails on this end point: https://sailpoint.api.identitynow.com/sod-policies/v1/:id because (I think) of this statement:
“This gets specified SOD policy. Requires role of ORG_ADMIN.”

Is there a way to fix this problem other than creating a service account as an identity, scoping a PAT token, and assigning it the above Role?

7

Hi @PhilRawlings1

That is interesting idea for a tool specially when it can compare the capabilities across multiple endpoints, it would be really useful.

For your case, i do not think read scopes will be sufficient. Here is what i see based on the documentation

https://tenant.api.identitynow.com/sod-policies/v1/{{$.trigger.policy.id}} → Requires

scopes: idn:sod-policy:read, idn:sod-policy:manage

user levels: ORG_ADMIN, SOD_POLICY_ADMIN

https://tenant.api.identitynow.com/historical-identities/v1/{{$.getIdentity.id} Requires →
scopes: idn:identity-history:read, idn:identity-history:manage

https://tenant.api.identitynow.com/sources/v1/{{$.defineVariable.source}} → requires

scopes: idn:sources:read, idn:sources:manage

user levels: ORG_ADMIN, SOURCE_ADMIN, SOURCE_SUBADMIN

So i would start here with the user levels

[SOURCE_SUBADMIN , SOD_POLICY_ADMIN ]

And scopes like

idn:sod-policy:read
idn:sources:read
idn:identity-history:read (not sure here though if exisiting user levels will be sufficient)

I think you will need another user where you can try assigning above user levels and generate the PAT with mentioned scopes. I hope this helps.

Regards

Vikas

8

Hey @PhilRawlings1,

Your question actually inspired me to build a solution for this!

I created a Workflow PAT Scope Analyzer that maps SailPoint’s API specs from GitHub against the endpoints and HTTP methods in your workflow JSON, outputting the exact minimum scopes needed.

In case you or anyone else in the thread wants to try it:

  1. Web Tool: identityexe.com/tools/workflow-scope-analyzer (Quick upload/paste to test)
  2. Tenant Integration Walkthrough: Developer Community Blog Post (Requires membership in the Blog Writers group to view if still in review)

Thanks for sparking the idea!

9

That’s amazing. Great work