Use after operation rule to create entitlements in SailPoint

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Problem

We have an internal home made application which only connection method for provisioning is a SOAP WebService with one operation for create and update accounts. However this web service does not include any read operation for either accounts or entitlements.

Solution

One way I think I could solve this is by configuring the aggregate group operation with the provisioning endpoint of the web service and send an invalid request. Then implement an after operation rule which will have harcoded the list of entitlements that the application requires.

Has someone created an integration like this?

Is it possible to modify the processedResponseObject in the after operation rule and add a list of hard code entitlements?

Creating an Account WEBSERVICES
2

Hey @drios!

Yes, you can do something like this. If you just have the operation call something, you can setup a Web Services After Operation rule to create ā€œfakeā€ entitlements. Here is an example of what this rule could look like.

Map newEntitlement = new HashMap();
List perms = new ArrayList();

newEntitlement.put("id", 1);
newEntitlement.put("name", "New Entitlement");

perms.add(newEntitlement);

updatedMapInfo.put("data", perms);
return updatedMapInfo;

This creates one new entitlement with the id=1 and the name of ā€˜New Entitlementā€™. You can add in any attributes needed, just make sure they are also in the corresponding entitlement schema.

  • Zach
2 Likes
3

Hi Zach, thanks a lot for your response :+1:

4

An even ā€˜betterā€™ option is not to have it hard-coded in the rule, but let the rule get an attribute from the source (that you create yourself). Then fill that attribute with the entitlement value(s) that you want to return on the source. That way you can use the same rule across different sources.

1 Like
5

Hi Edwin, thanks a lot. Thatā€™s actually a great idea, so that the manintenance of the entitlements would be easier and no need to modify the code. I will look into it.

6

An example that Iā€™ve used

Add attribute ā€˜entitlementsā€™ under the ā€˜connectorAttributesā€™ in the source.

"entitlements": [
       "entitlement-1"
       "entitlement-2"
],

A snippet of code from the after operation rule:

for (String ent: application.getAttributeValue("entitlements")){
    Map dummyEntitlementMap = new HashMap();
    dummyEntitlementMap.put("displayName",ent);
    dummyEntitlementMap.put("value",ent);
    dummyEntitlementMap.put("description",ent);
    dummyEntitlementList.add(dummyEntitlementMap);
}
7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.