SaaS custom connector - how to deal with 2 type of entitlements?

Identity Security Cloud (ISC) ISC Discussion and Questions
1

hi! I am dealing with a system where users have 2 types of entitlements, name it group and roles.

I am developing a SaaS custom connector because system API is a little tricky.

Group and Roles entitlements are indepenendents, so I can read and display them on catalog for being requested, but they have diffferent API calls to insert or remove users from group or roles.

Also, I read in SaaS doc that entitlement schema only supports group type. Is there some way to recognize which entitlment type is being requested and call appropiate call?

I have a B plan, which is adding a G_ or R_ when reading for entitlement aggregation, in order for recocnize, but I am trying to avoid this.

And a C plan, making 2 connectors, taking advantage of entitlements being independent between them.

But it would be desired that final users see groups and roles with the same name that in their application, and I can recognize them internally on connectors code.

2

Hi @jsosa , I think you can manually create multiple entitlement schemas, and then map it to the account attribute that stores the entitlement reference.
I haven’t tried this but I believe it should work just like any other connector.

All the best!

3

Hi Gaurav! My first SaaS connector too hehe… this connector has that limitation, only type group is allowed for entitlements:

image
image1142Ă—334 52 KB

That is causing me some problem, because I need to distinguish between 2 types, because Rest Calls for each type is different.

I am designing a solution, in which I concatenate “_G” or “_R” to the id of the entitlement, and when some of them are requested, I can know which Rest call to use. I think I will go in that way.