Sailpoint- Racf Integration

IdentityIQ (IIQ) IIQ Discussion and Questions
, , ,
1

IIQ 8.4.

Please share any images or screenshots, if relevant.

No Image

Please share any other relevant files that may be required (for example, logs).

NA

Share all details about your problem, including any error messages you may have received.

For integration of racf application with sailpoint, we are getting one attribute called modelid from racf application. How to store this modelid in sailpoint? Another question, we user select the modelid in the create provisioning form by default a default group and groups has been selected which is attached with the modelid and after submission of form a new racf id is being generated. Everytime when user goes for manage user access and fill the form, a new racf id will be generated based upon his selection of modelid. so when user select multiple entitlement for request so multiple racfid should be generated, how to acheive this scenario and how we can restrict the duplicacy of racf id generation?

2

@saurav_accenture

  • Have you tried storing modelid as the a]schema attribute?
  • To get a default group/s in create form, you need to store the mapping somewhere, may be in Custom object. Using that you should be able to set the groups.
  • On the multiple racf id part, I didn’t quite get the requirement but is this something we should be able to handle in before provisioning rule where you can set the racfid based on the groups/modelid selected.

Note: Found a fix? Help the community by marking the comment as solution. Feel free to react(:heart:, :+1:, etc.) with an emoji to show your appreciation or message me directly if your problem requires a deeper dive.

3

@neelmadhav thanks for the reply. For multiple racf id actually the requirement is RACF id generation is associated with the modelid and whenever user request for any entitlement through manage user access, the create form should always open and user should select the modelid from the drop down which decides a new racf id always. so whenever user submit the request after provision a new racf account should be created instead of the feature coming under add entitlement. Because you know what the ideal scenario is once the account has been created when next time user goes for raising any request for entitlement it should come under add entitlement. But here the ask is to create a new account when user is requesting for next time and he need to select a different modelid in the form. Please let me know if more clarity you required for this usecase.

4

or the requirement can be broken into much simpler way:-

  1. Every Manage User Access request must create a NEW RACF account
  2. User must always select a modelid
  3. modelid always drives RACF ID creation
  4. Even if the user already has RACF accounts:

    • The request must never go to “Add Entitlement”

    • It must always behave like “Create Account”

  5. One request = one RACF ID
  6. Next request (different modelid) = another RACF ID
  7. No reuse of existing RACF IDs