The ISC source [Web Service using Direct Connection] schema includes Owner and Requestable flags, but they aren't mapped to the actual Entitlement fields. What caused this, and how can it be resolved?

SailPoint Human Fabric (SHF) SHF Discussion and Questions
,
1

  • In the Entitlement Schema defined in the source, the attributes “Owner” and “Requestable” are present but not mapped.

  • To update the individual entitlement’s Owner and Requestable flags, you have the option to do so through the user interface or by calling the Patch API on the entitlement.

  • Is there any way or configuration available to map these values from the aggregation data?

image
image952×640 20.3 KB

image
image976×565 15.9 KB

2

Hi @shsakshi ,

Good day.
Please follow the below documentation for setting owner and mark them requestable.

image
image884×409 26.1 KB

3

Hi @suraj_gorle

Is it possible to update metadata during the aggregation process?

Specifically, not after aggregation through the UI, but at the time when the entitlement is aggregated to the Source, such that attributes like owner, description, and requestable are updated, similar to how the entitlement ID and entitlement name are populated.

image
image1590×567 25.1 KB

4

Hi @shsakshi ,

I dont think so it is possible in ISC as of now. Anyone has better idea please share.

5

Hi @shsakshi Have you set up Group Aggregation as an HTTP operation? That is where you need to do the mapping. Detected Groups (ie those from an Account Aggregation) will only include the Group ID without a separate Group Aggregation.

6

I agree with @j_place that you should be doing this from the Group Aggregation, not through the Account Aggregation to get the owners.

If that is not working, please describe your process for running the aggregations. Also note that if you aggregated these entitlements less than 24 hours ago, there may be some delays seeing the information, per previous comments from SailPoint.

7

Hi @j_place @gmilunich

I have done it through Group Aggregation only
And for the Response Mapping:

I have mapped the data attribute returned from the API to the Schema Attributes of Entitlement. But it is nothing related to Actual Entitlement Attributes

image
image920×799 35.6 KB

image
image1311×559 40.4 KB

This is the schema for Entitlement in the Source: [Where only Entitlement ID and Name are mapped]

image
image1410×712 46.9 KB

And these are attributes that the API return:

image
image607×365 43.8 KB

Yes, I have waited for more than 2 days, but the attributes still have not been mapped.

8

Hi @shsakshi Apologies, I misunderstood what you are after. I know of no OOB way to map the ISC fields Primary Owner and Requestable from the Source response during Entitlement Aggregation.

9

Hi @j_place
Thank you for your input; I truly appreciate it.

10

Hi @j_place @gmilunich

Is it possible to map these Entitlement Metadata Attributes from group aggregation?

image
image1426×778 48.6 KB

11

Hi SAKSHI,

The best way would be to use patch API for entitlements nd put reuestable and owner using powershell scripts.

If you only need when aggrgation is happening, you may have to call this patch api of entitlements inside the After operation rule for every entitltment. So if the source has 3000 entitlements, this API will get called 3000 times and perfomance will hit.

If users/entoitlements are less, u can download the entitlement csv after aggregation, change the fields u require nd reupload it back.

12

Hi @rahulb635

Thank you for the suggestion

13

Conclusion:

  • Currently, Attributes being mapped: Name, Description, Privilege level [Through custom configuration- Entitlement Management > Privilege Classification]

  • Not Mapped: Entitilement Owner, Requestable

    • Note:

      • They are governance properties on the ISC entitlement object.

      • They are not automatically driven by source schema mapping the way name and description are.

    image4
    image41541×446 19.1 KB

    • Solution: MetaData Attribute Update API
      • In the case of Requestable, we can use the bulk update API for the same update to bulk entitlements:
      • For the Owner, either to do it from the ISC UI or patch the entitlement API
        • patch-entitlement | SailPoint Developer Community
        • Patch Entitlement
          • PATCH {{tenant}}/v2025/entitlements/{{entitlementId}}
          • Body: 
            • [
  {
    "op": "replace",
    "path": "/requestable",
    "value": "{{requestableBool}}"
  },
  {
    "op": "replace",
    "path": "/description",
    "value": "{{description}}"
  },
  {
    "op": "replace",
    "path": "/owner",
    "value": {
      "type": "IDENTITY",
      "id": "{{ownerId}}"
    }
  }
]