Single request with addRemoveEntInSingleReq parameter

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello guys,

I’m having trouble configuring the “addRemoveEntInSingleReq” parameter; it’s not working as described in the documentation.

If addRemoveEntInSingleReq is set to false, then the placeholder value for the attribute marked as an entitlement is passed in separate API requests.

  • First request payload:

    jsonBody={ “RoleID”: “9dd23398-b905-4878-b7ad-bc02d22171d9” }

  • Second request payload:

    jsonBody={ “RoleID”: “8defe39c0-54f6-47b4-8a15-fcc2622923sk” }

If addRemoveEntInSingleReq is set to true, then the placeholder value for the attribute marked as an entitlement is passed as an array and is executed in a single request.

Single request payload:

jsonBody={ “RoleID”: [“97ee39c0-54f6-47b4-8a15-fcc262292386”,“8defe39c0-54f6-47b4-8a15-fcc2622923sk”] }

I configured the parameter in connectorAttributes:

“addRemoveEntInSingleReq”: true

I also configured the parameter as a string and nothing.

Have you ever had this problem? How did you solve it?

He keeps sending multiple requests instead of consolidating them into a single request.

2

Hi @originalmths

How are you sending the requests that you would expect to be together? Is it an access request / certification / role provisioning? I found depending on the request type, SailPoint treats sending requests separately vs together differently.

3

I try with Access Request

4

If those are entitlement based requests, then that would explain it. Try putting the entitlements you want in an access profile, then requesting it. You should see them grouped together.

5

Hi @originalmths

Hope you used this payload, while setting it -
[
{
“op”: “replace”,
“path”: “/connectorAttributes/addRemoveEntInSingleReq”,
“value”: “true”
}
]

6

This only works for Roles and Access Profiles. If you go to the Request Center and select multiple entitlements to request, it will not unify the request.

7

Hi Everyone,

I have followed the configuration for addRemoveEntInSingleReq=true, but I am encountering a 422 Validation Error during the Create operation when requesting access via the Request Center.

The error message indicates that the roles attribute is not being sent as a valid list:
Provisioning error:

Exception occurred while performing ‘Create’ operation on identity ‘null’: Url: https://baseurl/stage/account/v2/users, Message: 422 : {“error”:{“message”:“validation errors”,“resource”:“/account/v2/users”,“detail”:[{“loc”:[“body”,“roles”],“msg”:“value is not a valid list”,“type”:“type_error.list”}],“body”:{“firstName”:“TEST 2”,“lastName”:“TEST 3”,“roles”:“[\”[\\\\\“ROLE_CMRC_READ_CART\\\\\”,\\\\\“ROLE_CMRC_READ_PAYMENT_METHOD\\\\\”,\\\\\“ROLE_CMRC_READ_QUOTE\\\\\”,\\\\\“ROLE_CMRC_SEARCH_BILLING_ACCOUNT\\\\\”,\\\\\“ROLE_VIEW_ACCOUNT\\\\\”]\“]”,“email”:"TEST2.TEST3@test.com"}}}, HTTP Error Code: 422

Looking at the request body in the error, it seems the roles are being “double-stringified” and escaped:

In my Web Services CREATE Op Body:

  • {
    “email”: “$plan.email$”,
    “firstName”: “$plan.firstName$”,
    “lastName”: “$plan.lastName$”,
    “roles”: $plan.roles$
    }

Has anyone encountered this where SailPoint wraps the Entitlement list in extra quotes/escaped characters instead of sending a raw JSON array? How can I ensure the roles are sent as a clean array like ["Role1", "Role2"]?