Service standard IdentityNow Before Provisioning Rule

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi,

I’m using “Service standard IdentityNow Before Provisioning Rule” to remove entitlements when LCS is terminated. But I don’t see the entitlements getting removed. Any suggestions would really help!

‘’‘[
{
“op”: “replace”,
“path”: “/connectorAttributes/cloudServicesIDNSetup”,
“value”: {
“eventConfigurations”: [
{
“eventActions”: [
{
“Action”: “RemoveEntitlements”,
“Attribute”: “RESPONSIBILITIES”,
“Value”: null
}
],
“Identity Attribute Triggers”: [
{
“Attribute”: “cloudLifecycleState”,
“Value”: “terminated”,
“Operation”: “eq”
}
],
“Operation”: “Disable”
}
]
}
}
]’‘’

2

This value need to be terminated despite of active

3

Also hope you have added this source in disable source for the terminated LCS

4

@vishal_kejriwal1 sorry My bad, I’m actually using ‘terminated’ here. Updated the above post..

5

@vishal_kejriwal1 Yes, Source is added there

6

Can you try adding g below additional entry in action ?

{
“Action”: “RemoveStickyEntitlements”,
“Attribute”: “RESPONSIBILITIES”,
“Value”: null
}

7

@vishal_kejriwal1

Yes, I tried updating the conditions. But still no luck.

    {
        "op": "replace",
        "path": "/connectorAttributes/cloudServicesIDNSetup",
        "value": {
            "eventConfigurations": [
                {
                    "eventActions": [
                        {
                            "Action": "RemoveEntitlements",
                            "Attribute": "RESPONSIBILITIES",
                            "Value": null
                        },
                        {
                            "Action": "RemoveStickyEntitlements",
                            "Attribute": "RESPONSIBILITIES",
                            "Value": null
                        }
                        
                    ],
                    "Identity Attribute Triggers": [
                        {
                            "Attribute": "cloudLifecycleState",
                            "Value": "terminated",
                            "Operation": "eq"
                        }
                    ],
                    "Operation": "Disable"
                }
            ]
        }
    }
]```
8

It is now working with OPERATION set as “Modify”. But I see this is working only for LCS = terminated [Calculated from Transform]. But not when the LCS is manually set to “terminated”

9

wired it should work.

10

Can any one help me with the event configs if the rule works when the LCS changed manually as well.

Thanks,

11

image
image1858×793 60.6 KB

Disable account is fired before the LCS set is complete.. I think that could be the reason of remove entitlement didn’t work.

12

No it disable will fire only once LCS changed to terminated .

2 Likes
13

Check if the target source has the information about the rule in “beforeProvisioningRule” feature and also is the termination lifecycle state triggers a Disable account request on the target source ? if it’s not you should switch the operation to modify and also is this “Identity Attribute Triggers” triggers an action in the target source, is there any attribute synchronization or any configuration that launch a process on the source ?