Rapid Setup Application Depedency

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

I’m on 8.4, i’m looking to find a better solution than what I have in place which works but not sure if it’s great.

We have a dependency where ServiceNow accounts relies on the AD account getting created prior to use samaccountname etc for data fields in ServiceNow. Right now, I have provisioning done and then a step afterwards that makes a plan and provisions for service now after a refresh.

Would there a better OOTB/Configuration way of doing this? or is this best case scenario?

2

You can add “Active Driectory” under “Application Dependencies” in your ServiceNow application configuration.

image
image1575×707 46.5 KB

3

How is the behavior of this? does it still provision during the joiner?

4

Hi Thomas

Taking a look at this doc(8.4 Application Configuration Guide)

When an Application Dependency has been defined, IdentityIQ’s provisioning process will check to see if there is an account on the application(s) listed. If not, when IdentityIQ processes a provisioning request for a new account, a request for the an account on specified system(s) is added.

So it should run on Joiner. If you have AD set as a dependency for SNOW. When you try to create a SNOW account if the user has no AD account, one will be created and you can use the values in your SNOW provisioning policy

5

@thasheider1 - As per SailPoint documentation - When an Application Dependency has been defined, IdentityIQ’s provisioning process will check to see if there is an account on the application(s) listed. If not, when IdentityIQ processes a provisioning request for a new account, a request for the an account on specified system(s) is added.

6

@thasheider1 Lets say you have two apps: App1 and App2.. and you want to only create App2, when App1 is created.

so, if you setup Application Dependencies, then if a plan is created for App2 without App1 account, then IIQ will automatically updates the plan to have one request for App1 as well. In this way it’ll create app1 first automatically and then app2 account.

In case your requirement is if App1 is created, then only submits the request for App2. you can use Roles. Create a Business role and add the assignment logic to check for App1 attribute, as soon as it satisfies, Roles will be assigned and can take care of creating account in App2. (you don’t need to define entitlement, just have a Role with ProvisioningPolicy).

Note: Found a fix? Help the community by marking the comment as solution. Feel free to react(:heart:, :+1:, etc.) with an emoji to show your appreciation or message me directly if your problem requires a deeper dive.