Hi All, First time here creating a PowerShell After Scripts for IQService. The script I am writing now is to invoke a POST Method API to passed values from AD to a third party application. This third party application will be the one to provision/deprovision mailbox.
I use the following below to try retrieve the values from AD application.
# Get xmlFactory object to retive application configuration
$xmlFactory = [sailpoint.Utils.xml.XmlFactory]::Instance;
# Read the environment variables
$sReader1 = $env:Application
# Retrive application configuration object
$appObject = $xmlFactory.parseXml($sReader1)
#Retrive Attributes value from AD
$adid = $appObject.sAMAccountName
$email =$appObject.email
I need to get the values for $CreateOperation and $DisableOperation in the identity Attribute and use it for the if-else logic so my script would know which API call to invoke.
If I understand your requirement correctly, I think you will need to have two separate rules, one AfterCreate rule and the other one AfterModify (For Disable operations) those will then invoke the respective APIs for third party application.
$operation = $requestObject.Operation
The request object within rule will give you information about the operation. (Create/Enable/Disable etc)
Kindly check the documentation on After Rules here. This link has detailed samples for the rules too so you can check the contents of the request and response object available in the script.
I tried to use the connectoraftermodify rule to invoke my de-provisioning API, but I am encountering this error
["Error(s) report back from IQService - After script return non zero exit code: 255: "].
It looks like your script execution is being blocked, either by a policy or firewall or antivirus on the server. Please work with your networking team to to identify the program blocking it.
My aftermodify script is now calling my powershell script. I used before provisioning rule to add the attributes I need in the AttributeRequests. Now I can log the Request as XML object. How can I get the value from the XML object?
I tried using the requestObject.sAMAccountName syntax but it’s not working. Any advice please. thanks
by the way, I resolved the error "["Error(s) report back from IQService - After script return non zero exit code: 255: " by adding the following attributes in the Connector rule:
There is a function Get-AttributeValueFromAccountRequest in the After script template which helps you get the desired attribute from your account request.
Snippet from the doc below:
#if we have a non-null account request, get our value; otherwise return nothing
function Get-AttributeValueFromAccountRequest([sailpoint.Utils.objects.AccountRequest] $request, [String] $targetAttribute) {
$value = $null;
if ($request) {
foreach ($attrib in $request.AttributeRequests) {
if ($attrib.Name -eq $targetAttribute) {
$value = $attrib.Value;
break;
}
}
} else {
LogToFile("Account request object was null");
}
return $value;
}
Error: Item = -> Message = Cannot process argument transformation on parameter 'request' Cannot convert the "system.Object[]" value of type "System.Object[]" to type "sailpoint.utils.objects.AccountRequest"
Exiting After Modify SailPoint rule
