SOAP API response mapping and Account Aggregation

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I need to aggregate accounts from an application that has available a SOAP API for that purpose. There are two useful endpoints in the API that I need to call to perform the aggregation. The first one is to get a list of the accounts UserNames and the other one using each username to retrieve the remaining information for each account. So, basically I’ve created a WebServices connector with two HTTP Operations - Account Aggregation 1 and Account Aggregation 2 - being the first one parent from the second one.

The first operation will result in the following response:

    <ns:listUsersResponse>
        <ns:return>admin</ns:return>
        <ns:return>andre.cedik</ns:return>
        <ns:return>apimadmin-test</ns:return>
        <ns:return>apim_reserved_user</ns:return>
        <ns:return>bjoern.kimminich</ns:return>
        <ns:return>diego.oliveira</ns:return>
        <ns:return>fabio.azevedo</ns:return>
        <ns:return>gerald.wiesinger</ns:return>
        <ns:return>henrique.encarnacao</ns:return>
        <ns:return>ian.chen</ns:return>
        <ns:return>jadwiga.dymon</ns:return>
        <ns:return>j.fernandes</ns:return>
        <ns:return>jinpy.he</ns:return>
        <ns:return>joao.nascimento</ns:return>
        <ns:return>juan.vanrooyen</ns:return>
        <ns:return>karsten.block</ns:return>
        <ns:return>kevin.schork</ns:return>
        <ns:return>neimar.silva</ns:return>
        <ns:return>pamela.fidelis</ns:return>
        <ns:return>paulo.ferreira</ns:return>
        <ns:return>rodrigo.ribeiro</ns:return>
        <ns:return>samir.roy</ns:return>
        <ns:return>technical.user.kniam</ns:return>
        <ns:return>test_user_consumer_external</ns:return>
        <ns:return>test_user_consumer_internal</ns:return>
        <ns:return>test_user_consumer_shipments</ns:return>
        <ns:return>test_user_consumer_warehouses</ns:return>
        <ns:return>test_user_provider_shipments</ns:return>
        <ns:return>test_user_provider_warehouses</ns:return>
        <ns:return>t.jansenvanvuuren</ns:return>
        <ns:return>yogesh.kumar</ns:return>
    </ns:listUsersResponse>

The mapping that I am doing here is:

userName → ns:return

Then in the second endpoint I call it with the following body:

<getUserClaimValues>
  <userName>$response.userName$</userName>
</getUserClaimValues>

The problem is that the second endpoint is not being called for each username, instead the $response.userName$ variable contains a list with all the usernames that comes from the first endpoint.

The error I got is something like this:

sailpoint.connector.ConnectorException: UserNotFound: User [“admin”,“andre.cedik”,“apimadmin-test”,“apim_reserved_user”,“bjoern.kimminich”,“diego.oliveira”,“fabio.azevedo”,“gerald.wiesinger”,“henrique.encarnacao”,“ian.chen”,“jadwiga.dymon”,“j.fernandes”,“jinpy.he”,“joao.nascimento”,“juan.vanrooyen”,“karsten.block”,“kevin.schork”,“neimar.silva”,“pamela.fidelis”,“paulo.ferreira”,“rodrigo.ribeiro”,“samir.roy”,“technical.user.kniam”,“test_user_consumer_external”,“test_user_consumer_internal”,“test_user_consumer_shipments”,“test_user_consumer_warehouses”,“test_user_provider_shipments”,“test_user_provider_warehouses”,“t.jansenvanvuuren”,“yogesh.kumar”] does not exist

Does anyone knows what I am doing wrong?

2

What have your defined as your Root Path for the endpoint configuration? It needs to be representative of each “user” object that would be returned, so I would think it would need to be //ns:listUsersResponse/ns:return. The issue here is the value you need to return is actually the text content of each ns:return node returned, there is not a child object such as:

<ns:return>
  <ns:Username>admin</ns:username>
</ns:return>

If your data was in this format, it would make it easier to map. Since is it not in this format, you may be able to use something like the text() Xpath operator in your Attribute Path and map it to a schema attribute of your choice. I am not 100% sure if this would work without testing. You may need to resort to use a WebServiceAfterOperation rule to parse the data properly so you can properly form the processedResponseObject list of account maps.