Role and ownershipData attributes

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello,

I am trying to integrate SailPoint with Riversand, and it seems like once I am trying to aggregate the accounts, the Role and the owernshipData attributes will turn blank once the account aggregation is done. Any clue what could be the cause?

2

Hello Alexandru,

Can you send a screenshot of how it looks like? Also, is everything properly mapped in your account schema? Also, what source are you using?

3

Account schema

image
image1902×607 20.9 KB

Response mapping for account aggregation

image
image1233×555 25.7 KB

Note: if i get rid of properties for lastName and firstName, it will happen the same for them, but apparently they are mapped correctly. I suspect the mapping might be wrong for those 2 attributes.

4

It’s important that your account schema attributes replicate the schema attributes in your Account Aggregation operation. Thereafter it’s importantt that all Attribute Paths have the correct JSONPath expressions.

If you send a code snippet of the JSON-format, I can see if you’ve mapped something incorrectly!

(Don’t send any sensitive information here)

5

Example of json path

{
    "response": {
        "entityModels": [
            {
                "id": "a.statie@vidaxl.com_user",
                "name": "Alexandru Statie",
                "type": "user",
                "properties": {
                    "createdService": "entityManageModelService",
                    "createdBy": "system_user",
                    "createdDate": "2024-03-04T20:38:50.054+0800",
                    "userConsentDisplayTime": "2024-03-04T12:38:52.070Z",
                    "roles": "readonly",
                    "firstName": "Alexandru",
                    "lastName": "Statie",
                    "email": "A.Statie@vidaxl.com",
                    "userConsentStatus": false,
                    "modifiedService": "entityManageModelService",
                    "modifiedBy": "system_user",
                    "modifiedDate": "2024-03-08T20:39:57.306+0800"
                }
            }
        ]
    }
}

Note that role can be an array with multiple values
image

6

So for roles, the JSONPath that works for me is:

$.response.entityModels[*].properties.roles

Or if multiple values

$.response.entityModels[*].properties.roles[*]

First enter the response node, then the entityModels array where properties node is. Within the properties node lies roles

This tool is good for trying out JSONPath expressions.

7

Still not working unfortunately.

8

Have you tried setting the roles attribute to Entitlement and Multi-valued in your account schema?

9

image
image1862×77 2.05 KB

it was always this way from the beginning

10

So you are currently getting 0 Entitlements in your source?

11

I have entitlements. The group aggregation work fine.

12

But no entitlements on the user accounts?

13

The process that I saw is the following. When i go to the request center and request for an entitlement for a user that does not yet have an account, it will create the user but not in the UI because the user does not have the id.

image
image975×427 36.5 KB

Once I am running the aggregation, the id is provided to the user, but the role and ownershipdata values will vanish once the account is created in the target system.

image
image1898×740 27.6 KB

14

image
image1881×460 23.3 KB

Are you seeing 0 Entitlement Assignments?

15

You can leave the data as it is, as it is dummy data. After aggregation I see no ownershipdata and no entitlements (roles) assigned. Once I make the access request, I can see everything as intended like in the first picture posted from my end. However, after aggregation there will be 0 entitlements (roles) assigned and no ownershipdata at all. For ownershipdata i used a transform to map it to displayname.

16

I don’t see any ownershipdata key in the JSON snippet you sent, is there more to the JSON body?

17

image

Some accounts have, some do not. it will be an attribute under properties that will be a string basically as mentioned in the account schema. however the problem is still there, roles still have this issue, ownershipdata still have this issue.

18

So from the JSON body you sent me, I would configure the attribute paths like this:

id: $.response.entityModels[*].id
name: $.response.entityModels[*].name
type: $.response.entityModels[*].type
firstName: $.response.entityModels[*].properties.firstName
lastName: $.response.entityModels[*].properties.lastName
email: $.response.entityModels[*].properties.email
roles: $.response.entityModels[*].roles
roles[]: $.response.entityModels[*].properties.roles[*]
ownershipDate: $.response.entityModels[*].properties.ownershipData

Can you try these expressions and send me a screenshot of how it looks like?

19

So from the JSON body you sent me, I would configure the attribute paths like this:

id: $.response.entityModels[*].id
name: $.response.entityModels[*].name
type: $.response.entityModels[*].type
firstName: $.response.entityModels[*].properties.firstName
lastName: $.response.entityModels[*].properties.lastName
email: $.response.entityModels[*].properties.email
roles: $.response.entityModels[*].roles
roles[]: $.response.entityModels[*].properties.roles[*]
ownershipData: $.response.entityModels[*].properties.ownershipData

Can you try these expressions and send me a screenshot of how it looks like?

20

Should I use those in the response mapping?