Provisioning role to bulk users from rule

[sanjay_528 (sanjeev kumar)]

Which IIQ version are you inquiring about?

Version 8.3

Share all details related to your problem, including any error messages you may have received.

Hi
I am writing one rule which is reteieve users based on some criteria using queryOptions and provisions a business role to them. the count of users for provisioning is in thousands, when i am trying to dothis its giving error like “please contact your administrator” beacause of no of provisionings. Is there any chance to do this by rule

Thanks.

[enistri_devo (Emanuele Nistri)]

can you share the logs or the code if you can?

[enistri_devo (Emanuele Nistri)]

@sanjay_528

ProvisioningPlan plan = null;
List plans = new ArrayList();
if(managersMap != null && !managersMap.isEmpty())
{
for(Map.Entry entry : managersMap.entrySet())
{
String identityName =entry.getKey();

		Identity identity = context.getObjectByName(Identity.class, identityName);
		if (identity != null)
		{

			AccountRequest iiqAccReq = new AccountRequest(AccountRequest.Operation.Modify, "IIQ", null, identity.getName());
			iiqAccReq.add(new AttributeRequest("assignedRoles", entry.getValue(), roleName));
			plan = new ProvisioningPlan();
			plan.add(iiqAccReq);
			plan.setIdentity(identity);			
			Provisioner prov = new Provisioner(context);
			prov.execute(plan);
		}
	}
}

Somethings:

Are you put all the necessary libray?
You are declaring the second iterator with same name of the first
you are not declaring the variable identity

[sanjay_528 (sanjeev kumar)]

Hi @enistri_devo
I used all neccessary libraries and I updated map with identity name and opreation which i need to perform. and I used identity obj in map iteration.
I need soultion for provision10k identies with one role in a rule

[enistri_devo (Emanuele Nistri)]

you have 2 way:

1. Assign the role & refresh
   build the filter
   search all the identity and put in a list of identity
   assign the role on the identities and save with a for
   launch a refresh for those identities
   something like this:

Iterator iterator = context.search(Identity.class, qo);
Identity idn = iterator.next();
idn.setRoleAssignment(rolAsign);
context.startTransaction();
context.saveObject(identity);
context.commitTransaction();

2. build plan
   build the filter
   search all the identity and put the name in a list
   build a plan for each identity

I was a little lost in you rule, I suggest to you to build the plan only in one place. A plan needs the Identity, NativeIdentity, Source, Operation, AccountRequest with operation, AttributeRequest with value and operation

[dylanfoggan]

Hi @sanjay_528 ,

I would not suggest using a rule to achieve the desired result.

My recommendation would be to use the “script” match criteria in a business role configuration to either return True / False based on the criteria you define.

After this has been achieved you can execute the Identity Refresh task with “refresh assigned, detected role and promote additional entitlements” selected in the task.

Please let me know if this helps.

[vishal_kejriwal1 (Vishal Kejriwal)]

Why you are not using ootb batch request option ?

[ashutosh08 (Ashutosh Singh)]

Hi @sanjay_528,

If the use-case is just about role provisioning with some filters to assign Role, then have you tried using assignment rule of Role to provision business Role.

Let me know if there is some gap in the understanding of the requirement.

Thanks