SCIM Group Creation Issue Via Entitlement Catalogue "Import"

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

8.5p1

Share all details about your problem, including any error messages you may have received.

Best Practice for Bulk Creating Groups in a SCIM App with a Target-Generated ID

I’m seeking guidance on the correct approach for bulk creating groups in a SCIM-connected application where the unique ID is generated by the target system, not defined in IdentityIQ.

image
image728×241 10.3 KB

Environment:

  • IdentityIQ Version: IIQ8.5
  • Application: Atlassian Suite - Cloud (via the generic SCIM connector)
  • Goal: To bulk create several hundred new groups.

Group Schema XML

    <Schema created="1784064770044" displayAttribute="displayName" featuresString="PROVISIONING, GROUPS_HAVE_MEMBERS" id="0ad200e19f621bbe819f628bfffc001b" identityAttribute="id" nativeObjectType="Group" objectType="group">
      <AttributeDefinition name="displayName" type="string">
        <Description>A human-readable name for the Group. REQUIRED.</Description>
      </AttributeDefinition>
      <AttributeDefinition multi="true" name="members" type="string">
        <Description>A list of members of the Group.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="id" type="string"/>
      <AttributeDefinition name="externalId" type="string"/>
    </Schema>

The Challenge:

The Atlassian SCIM API, like many SCIM implementations, generates the unique identifier (the id attribute, which maps to our account’s nativeIdentity) upon group creation. When you POST a new group with a displayName, the API responds with a 201 Created status and a body containing the full group object, including the new server-generated id.

This presents a problem for the standard bulk import process using a CSV file. The CSV format for creating accounts expects a unique value for the identity column.

My CSV looks something like this:

# type, attribute, value, displayName, iiqElevatedAccess
# application=Atlassian Suite - Cloud
group, groups, , iiq-confluence-user-org, FALSE

I cannot populate the value (native identity) column because it doesn’t exist yet. It’s defined by Atlassian after the create operation is sent.

What I’ve Tried:

  1. Leaving the value field blank: This is not a valid format for the import.
  2. Using a dummy/placeholder value: This causes the provisioning to fail, as the connector attempts a PUT or GET on an ID that doesn’t exist, rather than a POST to the /Groups endpoint. The provisioning plan likely interprets this as an update to an existing account rather than a create request for a new one.

It seems the standard bulk create via delimited file is not designed for this SCIM pattern. My only current alternative is to create each group manually through the UI, which is not feasible for a large number.

My Question:

What is the recommended, scalable method in IdentityIQ for bulk-triggering the creation of new accounts (in this case, groups) on a SCIM connector where the unique ID is generated by the target?

Is there a different bulk request method I should use, or is the standard approach to write a custom rule (e.g., a RuleRunner task) that reads from a list of group names and programmatically generates a ProvisioningPlan for each new group?

Any examples or pointers to best practices would be greatly appreciated.

Thanks in advance.

2

@acrumley You can put the data in a csv with desired column and create objects programmatically. Please check this post for sample file import utility: File Upload via iiq forms - IdentityIQ (IIQ) / IIQ Discussion and Questions - SailPoint Developer Community

In you executor, you need to read details from csv and call ManagedAttribute APIs to create groups.

3

Hello Alex. The Entitlement Catalog import only creates ManagedAttribute records in IIQ; it does not provision groups to Atlassian.

A custom Run Rule task should be a suitable approach here. You could read your group names from a CSV or a Custom object, loop through them, and for each group create an ObjectRequest with ObjectOperation.Create, type group, and displayName. You would want to leave nativeIdentity and id unset because Atlassian generates the ID.

ProvisioningPlan plan = new ProvisioningPlan();
ObjectRequest objReq = new ObjectRequest();
objReq.setApplication("Atlassian Suite - Cloud");
objReq.setType("group");
objReq.setOp(ObjectOperation.Create);
objReq.add(new AttributeRequest("displayName",
    ProvisioningPlan.Operation.Set, groupName));
plan.add(objReq);

Provisioner provisioner = new Provisioner(context);
ProvisioningProject project = provisioner.compile(plan);
provisioner.execute(project);

The create request should go to the SCIM /Groups endpoint. After the bulk run, running an Account Group Aggregation should bring the generated IDs and groups into the Entitlement Catalog.

4

Thank you for this solution! To get IIQ to read CSV data easily, I will likely have to use both solutions to both populate the role with the right data, and then iterate through it to create the groups.

thank you @punna0001 for the snippet!