Submit access request with multiple access profile selected

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

I am seeking some suggestion on how to create/modify user account when access request is submitted with multiple access profiles (has different entitlement types) .
It is a WebService Connector Source.

Say, we have a WSC Source and there are 3 types of entitlements (role,businessUnit,group). All of these 3 are configured under Entitlement Types and Source Account Schema has 3 multi-valued attributes for each of the entitlement type.

There are 2 roles, 2 BU and 30 groups. 30 access profiles has been created with different combinations of roles+BU+group. So each AP has 3 entitlements of each type in it.

Inorder to create/modify a user, combination of all three entitlement types are required in payload and same is being configured in “Create Account” HTTP Operation.

When I submit the request with multiple APs selected, the task in ISC is getting completed, however both the APs are not getting assigned to user account.

Account aggregation and entitlement aggregation ran successfully. Also create/modify account is working fine when the request submitted has 1 access profile.

Configured below HTTP Operations:

  • Account Aggregation
  • Group Aggregation for each type of entitlement
  • Single Account Aggregation
  • Add Entitlement(3) and Remove Entitlement(3) set individually for each type of entitlement

Note: Create account with ‘Ent’ request has been checked.

2

You will need to process the entitlements using code in a before or after operation rule. We have had to write rules like this to retrieve the list of existing access required from ISC and then merge that into with the entitlement being requested to make the proper API call.

3

Hi Alicia,
Thank you for the response. Can you please help with a sample.
I am selecting 2 access_profiles from request centre to create/modify account. Each access profile has 3 entitlements in it.

4

Hi

You need to set the addRemoveEntInSingleReq flag to true. Which need to configure in the connection parameters.

Ref:
https://documentation.sailpoint.com/connectors/webservices/help/integrating_webservicesv/additional_configuration_parameters.html

Thanks,
Siva.K