Web Service - Multiple endpoints for same operation

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi! We are facing a web services connector, which web service has 2 endpoinst for updating users (one for some groups of attributes, and the other for the rest).

Is there some configurable way to achieve it?

If not, I think it could be done via an before operations rule, perhaps generating both url and body payload, but I am not sure what should happen for example, if the upcoming plan contains attributes from both calls.

Any idea would be appreciated!

PS: is a closed app, so asking to change endpoints is not feasible
PS2: an ETL system could be put in middle, but should be last option

3

yes, you can achieve this

Create 2 HTTP Operations for Update Account, each with their own endpoint

On Update, ISC will call the operations in the sequence you have listed.

We do something similar with disable account. we have 2 operations, first to remove groups and second to set active=false

2 Likes
4

Hi @jsosa ,
Based on my understanding and your kind input and my knowlage, here you are the options:

Before Operation Rule (Recommended):
Use a WebServiceBeforeOperationRule to detect which attributes are being updated, and programmatically call the required endpoints. You can trigger both endpoints in the same rule using restClient.sendRequest(), then return null to skip the default call.

Multiple Operations in Connector Config:
You can define two separate “update” operations in the Web Services connector… however, this only works if the attributes in the plan are clearly split and each operation is triggered based on attribute presence (this is more static and less dynamic).

Last option/resort - ETL or Middleware:
As you said, using a middleware like an ETL tool can sit between SailPoint and the target app to handle routing and transformation logic, but use this only if connector-side options aren’t viable.

Since you can’t change the app’s API, the Before Operation rule gives you the most flexibility…

Regards,
Mustafa

1 Like
5

Hi Jason!! Thanks for your response.

This case is more weird. Suppose identity as attribute A, B, C, D, E. If attributes A, B and C are updated, we need to use Endpoint_1. If attributes D and E are updated, we need to use another endpoint, Endpoint_2. It depends on what attributes are updated.

6

Hi Muhammad! Thanks for responding! I think also that Before Operation is the last choice. I am not seeing other way. If I have 2 update operations with 2 different endpoints, how can I trigger Endpoint_1 if updated attributes are A, B or C, and Endpoint_2 if updated attributes are D or E? (always talking of a configurable option).

7

I understand, it is really a different requirement, Any entitlements in these 5 attributes ?

8

Hey Julian

In this case, in my HTTP Operation, I would set the context url to be /placeholder

Then I would have a Before Operation rule that looks for which attributes are being updated, then I would replace “placeholder” with the appropriate value

requestEndPoint.setContextUrl() to set the new value

9

If the updates need to be consecutive, you can also create two operations, one of type ‘Update Account’ and the second of type ‘Get Object’. Select for the second operation (of type Get Object) to have as the parent the ‘Update Account’. This way it will trigger only after the first was done and you can even pass in information that you might need from the first operation into the second.

Example:

     {
        "resMappingObj": {
          "accountId": "id",
          "firstName": "attributes.firstName",
          "lastName": "attributes.lastName",
        },
        "contextUrl": "/user-update-1",
        "httpMethodType": "POST",
        "pagingInitialOffset": 0,
        "pagingSize": 50,
        "sequenceNumberForEndpoint": "10",
        "uniqueNameForEndPoint": "Update Account - 1",
        "curlEnabled": false,
        "operationType": "Update Account",
        "rootPath": "$",
        "body": {
          "bodyFormData": null,
          "jsonBody": "{\n    \"attributes\": {\n        \"uid\": \"$plan.nativeIdentity$\",\n        \"firstName\": \"$plan.firstName$\",\n        \"lastName\": \"$plan.lastName$\",\n    }\n}",
          "bodyFormat": "raw"
        },
        "responseCode": [
          "2**"
        ]
      },
      {
        "resMappingObj": {
          "email": "attributes.email",
        },
        "httpMethodType": "POST",
        "pagingInitialOffset": 0,
        "sequenceNumberForEndpoint": "11",
        "uniqueNameForEndPoint": "Update Account - 2",
        "rootPath": "$",
        "body": {
          "bodyFormData": null,
          "jsonBody": "{\n    \"attributes\": {\n        \"email\": \"$plan.email$\",\n    }\n}",
          "bodyFormat": "raw"
        },
        "responseCode": [
          "2**"
        ],
        "contextUrl": "/update-account-2",
        "pagingSize": 50,
        "curlEnabled": false,
        "operationType": "Get Object",
        "parentEndpointName": "Update Account - 1"
      }
1 Like
10

this is great idea @sauvee!!!

11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.