Unable to Delete the account

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi All,

I am trying to delete account in target application once the last role is been removed from SailPoint.

I have build the event config at source level like below.

“cloudServicesIDNSetup”: {
“eventConfigurations”: [
{
“eventActions”: [
{
“Action”: “ChangeOperation”,
“Attribute”: null,
“Value”: “Delete”
}
],
“Operation”: “Modify”,
“Entitlement Cardinality Update Triggers”: [
{
“Attribute”: “GroupID”,
“Value”: null,
“Operation”: “LastRemoved”
}
]
}
]
},
However I am receiving the error that user still has the group so can’t delete the account, actually I am removing the last role which has last group of application from the account in SailPoint.

Kindly suggest how can I fix this issue.

Regards,
Faizullah Shaik

2

Hello @FaizullahShaik

After reviewing your issue looks like you can use the “PostEntitlementUpdate” operation instead of "Modify".

Corrected event config should look:

"cloudServicesIDNSetup": {
  "eventConfigurations": [
    {
      "Operation": "PostEntitlementUpdate",
      "eventActions": [
        {
          "Action": "ChangeOperation",
          "Attribute": null,
          "Value": "Delete"
        }
      ],
      "Entitlement Cardinality Update Triggers": [
        {
          "Attribute": "GroupID",
          "Operation": "LastRemoved",
          "Value": null
        }
      ]
    }
  ]
}
3

Hi @asharma65 thanks for the reply it didn’t worked, only group got removed from the application but account still exits.

Regards,
Faizullah Shaik

4

Hi @FaizullahShaik, I had a similar use case and the code you have above should work. I would check your HTTP operations and make sure your delete operation is correct.
Another thing to check is if GroupID is the attribute name for entitlements on the source.

Are you removing the role through SailPoint? If it is locally removed SailPoint will likely just add the entitlement back.
The issue could be stemming from SailPoint needing an aggregation to see that the entitlement was removed.

5

Hi Caroline,

Yes you’re correct that It should work coz we have same condition in other sources as well and it is working there, but in this case I need to first remove the groups from user account then only I can able to delete the account.
I am able to remove the groups separately without involving deletion api call, but when I am trying to remove last group including deletion method then I am receiving an error.

image
image778×360 18.6 KB

That user still has groups so can’t delete the account