Web Services Connector - Entitlement aggregation - result with jsonarray as the root

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hey everyone. I am trying to do something that should be pretty simple. I have a web services connector that will do the following

  • aggregate group entitlement
  • aggregate accounts
  • aggregate accounts group memberships (entitlements)

My source API for the groups is an array at the root, it looks like this:

[

    {
        "name": "ABC",
        "description": "Blah Falls",
        "code": "ABC",
        "linesOfCare": [
            "HomeHealth"
        ],
        "dateCreated": "2021-03-10T14:30:04.82Z",
        "dateUpdated": "2021-03-10T14:30:04.82Z",
        "id": "1233"
    },
    {
        "name": "Test Security Group",
        "description": " ",
        "code": "TEST_SECURITY_GROUP",
        "linesOfCare": [
            "HomeHealth"
        ],
        "dateCreated": "2021-03-10T14:29:09.08Z",
        "dateUpdated": "2021-03-10T14:29:09.08Z",
        "id": "1234"
    }
]

In my response configuration, I’ve tried a million different response mapping combos, trying to retrieve the “id” from this jsonarray. Only time I was able to pull an id is if I limit my response to the first element in the array in via a root path of $[0]. Has anyone solved this? Seems pretty basic, thanks for any help. Below is what I would expect to be a logical jsonpath solution.

image
image931Ă—262 6 KB

image
image881Ă—287 10.9 KB

2

Hi @questjj ,

Response mapping in web service connector users Goessner JSON Path. Try this:

*.id

I pasted your sample into https://jsonpath.herokuapp.com/ and selected the Goessner output type. You can find information about Goessner JSON Path online, and we also have some documentation in our portal.

3

Thanks Colin, knowing its Goesner will help in the future im sure. However, still not picking up this entitlement using *.id for response mapping and $ for root path. Any other ideas?

4

Try using * as the Root Path and id as the attribute path.

The Root Path defines a prefix that will be applied to all of your Attribute Paths. So a Root Path of * and Attribute Path of id will condense to *.id when the connector evaluates the logic. If your Root Path is $ and your Attribute Path is *.id, it will evaluate to $.*.id, which isn’t valid JSON path.

1 Like
5

No luck. The only way I’ve got anything to link is grabbing only one item in the array

$.[0] And id

6

Ok, I think I have it. I implemented a web service connector that returns an array for account aggregation. The API for the source returns the following:

[
  {
    "id": 0,
    "username": "string",
    "name": "string",
    "avatar_template": "string",
    "email": "string",
    "secondary_emails": [
      null
    ],
    "active": true,
    "admin": true,
    "moderator": true,
    "last_seen_at": "string",
    "last_emailed_at": "string",
    "created_at": "string",
    "last_seen_age": 0,
    "last_emailed_age": 0,
    "created_at_age": 0,
    "trust_level": 0,
    "manual_locked_trust_level": "string",
    "flag_level": 0,
    "title": "string",
    "time_read": 0,
    "staged": true,
    "days_visited": 0,
    "posts_read_count": 0,
    "topics_entered": 0,
    "post_count": 0
  }
]

Here is what I did to get the attributes of each array item:

image
image2338Ă—311 27.6 KB

image
image2327Ă—743 49.2 KB

7

Add to your test, a second account aggregation that retrieves an array of entitlements, and pull all entitlements into a multivalued entitlement column. Thats the problem im facing.

8

I think I have that one too :slight_smile:

After my first account aggregation, I get a list of user IDs. I need to use these user IDs to call a separate endpoint to get each user’s multi valued entitlements. My second account aggregation uses the Parent Endpoint tab to configure this.

Here is what the second API returns:

{
  "id": 0,
  "username": "string",
  "name": "string",
  ...
  ...
  ...
  "groups": [
    {
      "id": 0,
      "automatic": true,
      "name": "string",
      "display_name": "string",
      ...
    }
  ]
}

Here is how I configured Account Aggregation 2 to aggregate the groups as multivalued entitlements for each user.

image
image2328Ă—738 47.8 KB

image
image2328Ă—308 26.2 KB

image
image2323Ă—469 35.1 KB

image
image2323Ă—303 26.4 KB

1 Like
9

Close! Try to do it with a groups array that doesnt have have a “groups” node. just

[
{
“id”: 0,
“automatic”: true,
“name”: “string”,
“display_name”: “string”,
…
},
{
“id”: 1,
“automatic”: true,
“name”: “string1”,
“display_name”: “string”,
…
}, …
]

10

That should just be a root path of $ and attribute path of id

11

that was the first thing I tried. If you get a chance, see if you can get it to work from your sample project.

12

abandoning ship and going custom connector.

13

hey @colin_mckibben I have a similar path I’m trying to go down

Here is the json when you ask for the group membership of a specific user

{
    "header": {
        "relationships": [
            "SysGroup",
            "SysRole",
            "SysUser",
            "SysUser",
            "SysGroupPermission",
            "SysGroup"
        ],
        "query_rows": 1,
        "sort_order": [
            "me.update_ts",
            "me.rel_id"
        ],
        "primary_key": [
            "rel_id"
        ],
        "data_rows": 1
    },
    "data": [
        {
            "rel_id": 169,
            "group_id": 121,
            "create_ts": "2022-02-17 15:11:18.215613+00",
            "update_user": 254,
            "create_user": 254,
            "role_id": null,
            "user_id": 255,
            "update_ts": "2022-02-17 15:11:18.215613+00"
        }
    ]
}

And here is what my configuration looks like

Context URL

/api/v1/user_group?user_id=$response.user_id$

Root path

$.data

Response Mapping

Schema attribute Attribute Path
entitlements [*].group_id

And here’s my account schema

image
image1536Ă—362 11.1 KB

1 Like