SailPoint IdentityNow PowerShell Module

Hi Developer Community. Great to see this community come to fruition.

Previously I’ve posted about the SailPoint IdentityNow PowerShell Module on Compass, but now with the Developer Community I’d like to solicit any feature enhancements, or even others that would like to participate (via pull requests) in keeping the functionality current.

If you’ve not previously seen or used the module, the summary of the latest version (1.1.2) can be found here.

The repo with all the latest info and full readme is on Github here.

Cheers,
DR

10 Likes

Thanks Darren,

I’m already a fan. Thanks very much for your invaluable module!
I’m going to be spending some time in here as I’m embarking on some Jira to IDN integration to get tickets raised for manual provisioning and I’m really hoping the community can help.
Cheers
Julian

Hey Darren, thanks so much for sharing this! I’ve went ahead and moved your post over to the Tools subcategory and I’m going to sticky your post to the top :slight_smile:

1 Like

Ran across your module a few months back and it’s such a great contribution to the IDNow community. Many thanks!

2 Likes

Thanks Phil, we are very glad to hear that you like it!

Originally I developed the module for a bunch of integration and automation we were doing for a customer. I had a huge number of scripts, but they weren’t manageable by our Managed Services team. So I built the original module and then release it as open source.

Later with Sean McGovern who’d started something similar, we combined our efforts and knocked out extending the functionality and standardized the authentication as the IDN platform changed.

It’s fantastic to see the number of downloads increasing, and hearing feedback of from the many users of it to automate implementations and bulk configuration tasks.

Cheers,
DR

1 Like

I have just released v1.1.4 of the SailPoint IdentityNow PowerShell Module.

More details for the updates here and it is published to the PowerShell Gallery.

There are 4 new cmdlets bringing the total now to over 90.

  • Export-IdentityNowConfig
  • Invoke-IdentityNowAccountCorrelation
  • New-IdentityNowSourceEntitlements
  • Search-IdentityNow

Numerous enhancements and updates to other cmdlets for recent API and Authentication changes.

Cheers,
DR

2 Likes

v1.1.5 of the SailPoint IdentityNow PowerShell Module is now published on the PowerShell Gallery.

No new cmdlets, but fixes to a couple as well as enhancements.

  1. Fix for New-IdentityNowCertCampaign bug whereby AuthN failed.
  2. Updates to Get-IdentityNowCertCampaignReport to handle API AuthN changes.
  3. Add additional detail to New-IdentityNowIdentityProfilesReport Report to show transforms
  4. Get-IdentityNowCertCampaignReport New functionality to return all reports within a period with an option to return incomplete or completed campaign reports.
  5. Associated ReadMe updates.

Cheers,
DR

2 Likes

Thank you for sharing this update, @darrenjrobinson!

I’ve just published v1.1.6 of the Community IdentityNow PowerShell Module.
Supporting blogpost here

Private APIs to v3 API transition
Key item is the start of the transition from private APIs to v3 APIs.
To make this more seamless and provide backwards capability the three updated cmdlets for v3 APIs maintain backwards capability without any changes. To use the v3 APIs with the three cmdlets you need to specify the -V3API switch.

The three cmdlets with the V3API switch are:

  • Update-IdentityNowRole
  • Get-IdentityNowSource
  • Update-IdentityNowSource

Finally, I’d love to have more assistance maintaining this module. Specifically adding new cmdlets for new IdentityNow features and updating cmdlets that now have v3 APIs.

Cheers,
DR

2 Likes

Hi @darrenjrobinson ,

Thankyou for this wonderful utility, this makes our job lot more easier.

I have installed he module in my local and trying to Test-IdentityNowCredential, but get below error:

PS C:\Users\DHEERAJ\git\powershell_module_identitynow> Test-IdentityNowCredentials
WARNING: Testing APIv3 credentials failed for devrel-ga-5700. Unable to continue.
WARNING: Unable to auth password grant type for devrel-ga-5700 v2:True v3:True cred:True pat:False
{"error":"invalid_client","error_description":"Unauthorized grant type"}
Personal Access Token not stored in IdentityNow Configuration.

i have set client id and secrete by creating config from API Management:

am i missing something here?

Hey Dheeraj. Are you on the latest version?
Create a Personal Access Token (via the IdentityNow Portal and your personal identity profile/account preferences) and add that to your configuration, test then save.


$orgName = “customername-sb”
Set-IdentityNowOrg -orgName $orgName

# IdentityNow Admin User
$adminUSR = "identityNow_admin_User"
$adminPWD = 'idnAdminUserPassword'
$adminCreds = [pscredential]::new($adminUSR, ($adminPWD | ConvertTo-SecureString -AsPlainText -Force))

# IdentityNow Personal Access Token as generated through the IdentityNow Portal and your personal identity profile preferences
$patClientID = 'yourClientID'
$patClientSecret = 'yourClientSecret'
$patCreds = [pscredential]::new("$($patClientID)", ($patClientSecret | ConvertTo-SecureString -AsPlainText -Force))

Set-IdentityNowCredential -AdminCredential $adminCreds -PersonalAccessToken $patCreds
Save-IdentityNowConfiguration

Regards,
DR

1 Like

Hi @darrenjrobinson ,

Thankyou for the response, i am able to run validate the credential now

image

1 Like

Hi Darren,

I have a whole process to make a new role based on current access that I am trying to figure out:

  1. Find out which accounts an identity has (Active Directory, SAP, etc…)

I can get the identity, but the accounts property show like this: accounts : {}

  1. Once I have that, I need to get the entitlements from the accounts.

  2. Add the entitlements to the new Access Profile (that have already been created by workflows).

Any tips would be appreciated.

Hey Aaron, your best bet is to use Search.
That can then return all the accounts on sources for an identity.

Search-IdentityNow -query "name eq darren.robinson" -indice identities  

If you want them all under one response then

$me = Search-IdentityNow -query "accountId eq darren.robinson" -indice identities  
$me.accounts

That works perfectly! Now I just need to get the entitlements from the specific accounts. I’m assuming I have to use Search-IdentityNowEntitlements. I’ll play with it and see what I can come up with.

Hi Darren,

I tried the following where nnn equals the AD account-id for this user:

Search-IdentityNowEntitlements -query "account-id eq nnn"

I got back entitlements, but not the one he actually has. He only has one and it wasn’t in the list. Am I doing this wrong?

Search-IdentityNowEntitlements is primarily for getting entitlements associated with a source or just entitlements in general.

Get the accountID of the account you want all the entitlements for.
Then

$account = Search-IdentityNow -query "accountId eq e06d19c6ddaa4726baf4dd9e4aa6edfc" -indice identities  
$account.access 

When I run the following line:
$account = Search-IdentityNow -query "accountID -eq useraccountID" -indice identities
I keep getting this error:

Search-IdentityNow : Bad Query or more than 10,000 results? Check your query.
At line:1 char:12
+ $account = Search-IdentityNow -query "accountID -eq NNN ...
+            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Search-IdentityNow
 
Search-IdentityNow : {"detailCode":"500.1.503 Downstream service 
unavailable","trackingId":"7d3872ba25d0435d9457cb068d539ec8","messages":[{"locale":"en-US","localeOrigin":"DEFAULT","text":"A downstream resource was 
unavailable."},{"locale":"und","localeOrigin":"REQUEST","text":"A downstream resource was unavailable."}],"causes":[]}
At line:1 char:12
+ $account = Search-IdentityNow -query "accountID -eq NNN ...
+            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Search-IdentityNow

Any idea why that is? There is nowhere near 10,000 results.