Hi,
An user account can have only one entitlement. Now When I remove the entitlement, Account should be deleted directly. Now When I do this in SailPoint ISC. Access profile and account stays until net scheduled aggregation.
Note: I cannot use BeforeProvisioningRule
how to handle this situation in SailPoint ISC
Hello Chandra. Since this is a JDBC source, the JDBC Provision Rule is where you would handle this. It’s a connector rule that runs on the VA, so unlike the Before Provisioning Rule, it doesn’t go through SailPoint’s cloud rule review. You can manage it directly through the connector rule APIs.
The entitlement removal comes into the rule as a Modify account request with an attribute operation of Remove. Since your account can only have one entitlement, you can detect that removal and delete the record from the database:
if (AccountRequest.Operation.Modify.equals(account.getOperation())) {
AttributeRequest attrReq = account.getAttributeRequest("<entitlementAttribute>");
if (attrReq != null &&
ProvisioningPlan.Operation.Remove.equals(attrReq.getOperation())) {
statement = connection.prepareStatement(
"DELETE FROM your_table WHERE id = ?");
statement.setString(1, (String) account.getNativeIdentity());
statement.executeUpdate();
result.setStatus(ProvisioningResult.STATUS_COMMITTED);
}
}
Once the record is gone from the database, a full account aggregation will clean up the account from ISC too. Just make sure Account Deletion is enabled on the source and the deletion threshold allows it, otherwise ISC won’t remove the stale account record.
Also, I would skip the Manage Accounts > Delete action in a workflow for this. That option currently only works for flat-file sources, not JDBC.
This is the expected behavior of SailPoint ISC. You need to customize it from SailPoint ISC end and trigger a delete account operation.
@punna0001 I’m trying the same. But looks like single account aggregation is getting triggered when there is a remove entitlement request. I tried to remove the “getObjectAfterProvision” from the source config and still see single account aggregation happening which ends up error as account is already deleted in the table.