We’re using IdentityNow and have a workflow that checks for SoD conflicts using the built-in SoD policy trigger. This works well when the user already has access A and requests B, and a conflict is identified.
However, we’re facing a limitation when two conflicting entitlements are requested at the same time (i.e., in the same access request). In this case, IdentityNow does not detect the conflict during the approval process.
Our Goal
To handle this use case, we’re trying to implement a second validation step using the IdentityNow API:
POST /sod-violations/predict
This API can check for conflicts between entitlements provided in the same payload.
Required Payload Format
We want to dynamically generate the following JSON structure inside the workflow, based on the entitlements requested:
{
“identityId”: “ID_OF_THE_IDENTITY”,
“accessRefs”: [
{
“id”: “ENTITLEMENT_ID_1”,
“type”: “ENTITLEMENT”,
“name”: “Entitlement Name 1”
},
{
“id”: “ENTITLEMENT_ID_2”,
“type”: “ENTITLEMENT”,
“name”: “Entitlement Name 2”
}
// … more entitlements …
]
}
What We’ve Done So Far
• The workflow starts with the default SoD validation trigger.
• If no violation is found there, and two or more accesses are requested:
- We loop through each access profile in the request.
- For each, we use an API call to retrieve the linked entitlements.
- We collect the id and name of each entitlement.
So far, we’re able to gather a list of the entitlements requested.
The Challenge
We are now stuck trying to build the final JSON payload in the format above within the workflow, so that we can send it in an HTTP Request action to /sod-violations/predict.
My Questions:
- Is it possible in IdentityNow workflows to dynamically construct a JSON object with a nested array (accessRefs) based on a looped list of entitlements?
- If yes:
o How should we structure the variables?
o Can we use a combination of For Each and Build JSON/Write JSON actions to append objects to a JSON array?
o Do we need to construct this manually as a string or is there a better native approach? - Does anyone have an example workflow or approach that builds a dynamic JSON payload like this in IdentityNow?
Regards
Reinaldo Santos