SCIM 2 Saas Connector: how do i see what is being sent to the app?

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

I use ISC, and am trying to replace an Entra SCIM connector setup with an ISC one, using SCIM 2 SaaS connector.

This app is not a full SCIM implementation. There is no Groups endpoint, and the downstream app wants a ‘urn:ietf:params:scim:schemas:extension:workspacePermission:2.0:User:role’ attribute with possible values of (ADMIN, MEMBER, VIEWER, CONTACT) to be sent as an account attribute.

There’s only the 1 entitlement to send/read.

I am able to aggregate accounts, and even with some entitlement type tweaking/schema additions, have gotten ISC to see the attribute as an entitlement.

I’ve setup an Access Profile, and a Requestable Role to test provisioning.

I’ve selected the "Skip Group Update" to be able send entitlement as an attribute.

I’m able to manual post (create) and put (update) to the apps SCIM user endpoint using postman, so this is really about getting ISC to craft the same JSON.

In the entra scim docs, (which I’m referring to as a reference in trying to set this up in ISC, ) this seems pretty straightforward. The docs say to add an attribute to the account schema, and then for that attribute just use an “expression” to set the value of the attribute..

IIF(Instr([appRoleAssignments], “ADMIN”, “”, “”)>“0”, “ADMIN”, IIF(Instr([appRoleAssignments], “MEMBER”, “”, “”)>“0”, “MEMBER”, IIF(Instr([appRoleAssignments], “VIEWER”, “”, “”)>“0”, “VIEWER”, “”)))

I thought because GET was well defined and understood, POST/PUT would be fine.. But after a succesful SCIM POST from ISC, I’m not getting the right result when I do a get on the apps SCIM User endpoint.

There is no ‘urn:ietf:params:scim:schemas:extension:workspacePermission:2.0:User:role’ attribute previously set. The account exists, but without that attribute, they can’t do anything.

I’m missing something here. If I try to include this attribute in my provisioning plan, I don’t know how to give it value (I don’t know how to reference the entitlement for the value).

Checking the checkbox doesn’t seem to have done anything. (is this because that checkbox assumes some sort of certain entitlement types?)

How do I enable debugging for this connector? I’d really like to see what JSON is being sent, because I’m not sure what json is being crafted when the “Skip Group Update” checkbox is checked. (i believe that this checkbox is not inserting a named attribute (my entitlement type/schema attribute)

Does anyone have any advice on how to proceed with (what seems to be) limited information from ISC? Would it be better to be using by default the VA based SCIM connector because more visibility to what’s happening is possible?

2

Also, why can’t ISC just show me the json it sent? or even a template of the JSON it would send (given the configuration that is setup in ISC for this source)?

Its really fun knowing the JSON I need to send (it works in postman), but using obscure checkboxes, and ISC UX to try and match that output without actually seeing the output :(.

at this point is another option to recreate the SCIM connector using the webservice connector? that seems pretty silly TBH.

3

Have you tried using the CLI’s

sail conn logs

command? On the backend that hits the (undocumented) /beta/platform-logs API endpoint which is retained for 90 days. If you turn debugging on for the connector, you should get even more info in that log

4

I was not aware of this!! Thanks for the suggestion!