We are using the Web Services connector in SailPoint ISC for a target application that does not provide a “Get All Users” API endpoint. Because of this limitation, we are currently planning to use the application for provisioning only.
However, we have a couple of questions:
Since there is no endpoint to retrieve all users, how can we import or upload the existing user accounts from the target system into SailPoint?
Additionally, the application does not have entitlements. In this case, how can we trigger new account creation tasks within SailPoint?
You mentioned no endpoint for all users, but is there an endpoint for single users? If so, maybe you could loop through all the users and make separate calls in an after operations rule to grab all the users.
For the create account, you will need to create some sort of dummy entitlement on the source since you cannot invoke an account creation without an entitlement. This can be done in an after operations rule in the group/account aggregation operation to create that fake entitlement.
That makes sense, we can definitely explore the approach of looping through the single-user endpoint in an After Operation Rule.Though, the GET API has fairly strict rate limits so making individual calls per user during aggregation could become a challenging.
It would be ideal if there were a way to directly upload or bulk import all existing users into SailPoint.
You can create users on the web services connector by using the endpoint below. You’ll need to create a script for the one time upload, but after that, it should function fine as long as your Account Aggregation operation can capture all the users and it lines up with what you uploaded. Let me know if you have any questions on the process.
I would not even set this up as a source in this case. Rather, have a workflow that triggers based on certain identity attribute change and check if the identity qualifies for an account in this application, and if it does call the API to insert a record in the end system
its depend on how you wanna proceed:-
Case 1: You can create dummy entitlement in sailpoint and user can submit the request for that entitlement. Whenever sailpoint send provisioning in webservice before rule check if user already exist or not if exist if exit just call get api. And in after webservice rule map the attribute in sailpoint along with entitlement
Case 2 : where u can have logic where u can create account with some logic where like new identities onboard and so on.
I will go with first approch
If the app team can give one time extract of users, you can load them in to a local DB and have aggregation set up to that as JDBC. That would push the users and entitlements. For any request for Entitlement or creating new users from there on, the provisioning rule For JDBC u can call create operation on webservice along with with updating DB. At that point it will become JDBC connector with provisioning operation calling API with full gamut of operations.