Remove all Access when user state changes from Inactive to Terminated

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi All,

I have configured workflow which removed the entitlement when user lifecycle state changes from Inactive to Terminated.

  1. Detect Trigger
  2. Get Access : Entitlement
  3. Using Loop with LoopInput : $.getAccess.accessItems[*]
  4. Manage Access : Request Type : REMOVE

But I want to remove, Role + Access Profile + Entitlement (ALL)
I tried to check mark all the options (Get Access Profiles + Get Roles + Get Entitlements), but no luck.

I tried differnet workflow using the HTTP Request but that does not remove the birthright access.

Requirement is to removes all the access (birthright + access requested)
Please assist

2

Hey Ritika,

When you say:

Do you mean you don’t get all the accesses ( ent + role + access profile ) or are you not able to remove those accesses?

3

Hi Zeel,

I am not able to remove

4

Any error message you get? Might help to debug the issue.

5

This use case can be handled using 3 steps:

  1. Use Identity profile config to auto remove entitlements for sources.
  2. Use before provisioning rule to remove residual entitlements.
  3. Use this workflow to remove all sticky Roles and other access items by submitting revoke access request. Workflow - Remove Entitlements from selected source - #7 by colin_mckibben
3 Likes
6

image
image1712Ă—684 64.9 KB

User has : 1 Role, 4 Ent and 1 AP

Config,

image
image1234Ă—520 39 KB

image
image1321Ă—580 29.1 KB

image
image1364Ă—570 31.8 KB

image
image1396Ă—558 31.7 KB

8

@RitikaK

After Get Access action, can you directly pass on the input to Manage Access action instead of looping using loop operator?

image
image905Ă—348 15.1 KB

Reference

Also please check the JSON input to the Mange Access Action for troubleshooting
Thanks

1 Like
9

please help me with the Http operation, if I want to remove all the access Profile + All Roles + All Entitlements
is this correct approach?
$.hTTPRequest.body[0].access[?(@.type == “ACCESS_PROFILE” && @.type == “ENTITLEMENT”)]

10

Hi @RitikaK

Having problem when tried to remove all access. The fact is that Manage Access input should be the Get Access output, and there is a limitation of revoking only one entitlement at a time.

Your approach is fine, you have only to change 4 - Managge access for an HTTP Request action, on which it calls the ISC API to remove each account.

image
image1250Ă—573 38.6 KB

image
image1245Ă—632 47.6 KB

image
image1243Ă—583 46.9 KB

image
image1282Ă—551 49.2 KB

In this case, JSON body should be:

{"requestType":"REVOKE_ACCESS","requestedFor":["{{$.loop.context.id}}"],"requestedItems":[{"comment":"Usuario Desligado","id":"{{$.loop.loopInput.id}}","name":"{{$.loop.loopInput.name}}","type":"{{$.loop.loopInput.type}}"}]}
  • note that I changed names to be more readably, but Get Entitlements is a Get Access action.

As you need to revoke all types, you can make 3 HTTP Request actions in cascade, each with each type hardcoded (with 2 string compare operations checking what type comes in the loop item).

1 Like
11

with reference to,
Remove all entitlements with workflow - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community

is this correct approach to remove both Ent and AP in Loop Input?
$.hTTPRequest.body[0].access[?(@.type == “ACCESS_PROFILE” && @.type == “ENTITLEMENT”)]

12

@RitikaK this is what you need

Best!

1 Like
13

@RitikaK no, because each body call must be ENTITLEMENT OR ACCESS_PROFILE OR ROLE. That’s why you should follow this approach, with the difference to have 3 HTTP Request, one for ENTITLEMENT, other for ACCESS_PROFILE and other for ROLE.

1 Like
14

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.