Use plan.entitlementAttr programmatically

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Hi!

I have a question regarding $plan.nativeIdentity$ and $plan.entitlement$ that can be used in the request body in a given http operation (create user or add entitlement e.g.) for example like this:

{ 
“userid” : $plan.nativeIdentity$

“groups” : $plan.entitlement$

 }

Let’s say this was in an add entitlement operation of the web service connector. Then they would resolve to the account id and the current entitlement being added.

I can also fetch them in a before rule by accessing the provisioningPlan but it would require me to iterate through provisioningPlan > accountRequest > attributeRequest verify the operation (add/delete e.g.) for the attributeRequest and then extract it.

I can also fetch the requestEndpoint > get the request body and extract it with maybe regexp or json-methods substringing etc (maybe I’m not using JSON at all).

My question is:

Is it possible to use $plan.entitlement$ or $plan.nativeIdentity$ programmatically in a rule just like it can be used in the http-body for the operation?

I can’t quite understand the architecture but it seems a bit cumbersome to go through a provisioningPlan that contains all attributes being changed along with all operations with at least two for-loops or use regexp/substrings etc from the requestEndpoint body when the information I want in the correct context can obviously be fetched just not in a rule?

Nino

2

Hi @ninosp ,

You can get the entitlements values directly in the JSON body of the plan. Find the attribute that represents entitlements in the web service connector. Then, when you request any entitlement web service connector add/remove operation, the entitlement value is stored in the attribute. For example, if is an entitlement you have groups defined in the application schema, you can get the add entitlement operation using “$plan.groups$”.

Thanks,

PVR.

3

Yes I detailed this in my question, that is one way. I’m asking for a third way but I doubt it is supported.

4

@ninosp,

Can you share more context on this request? What are you trying to do?

Thanks,

PVR.

5

@ninosp AFAIK you can only use the methods by getting plan → accountrequest → attributerequest only. There is no other direct way available.