Web Services Connector - Entitlement Aggregation

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Hey everyone.
I have a web services connector that consists of the following endpoints

  • Endpoint to get All Users
  • Endpoint to get All Roles
  • Endpoint to get 1 user’s roles based on the user’s id that has been passed in the URL.

So, I made 2 account aggregation methods:

  • Parent one to get all users.
  • Another account aggregation one to get the user’s roles.

Now the Issue is that I am getting only 1 role id or nothing but in fact the user should has at least 1 role. And I believe that the issue will be in the root path or the response mapping.

Here is sample of the output of getting from the user’s roles based on the user’s id in postman.

[
    {
        "id": "658ee00b-a955-4a3f-81ae-4f370cdf5377",
        "name": "default-roles-demo-realm",
        "description": "${role_default-roles}",
        "composite": true,
        "clientRole": false,
        "containerId": "e4b5a5e0-768f-4bae-b434-908cb0f2e273"
    },
    {
        "id": "607e6e01-f46d-4b08-8e61-2449d0cfa794",
        "name": "Cell-Info-Role",
        "composite": false,
        "clientRole": false,
        "containerId": "e4b5a5e0-768f-4bae-b434-908cb0f2e273"
    }
]

Response configuration:

image
image1837×400 15.4 KB

2

Hello @MBaraka

Could you please try root path as $[*] – this would ensure to iterate over each object in the response array

3

Hi @jainanimesh

Just tried it and unfortunately, only few users got 1 role and the others didn’t any role.

4

Hello @MBaraka

Could you please check the attribute type in schema? It should be marked as multivalued.

5

Here is the attribute from the schema

image

6

Hi @Mostafa_Baraka

Try not keeping anything in root path and update attribute path as $[*].id

7

Hi @MBaraka

The issue is with rootpath and attribute path. Please configure in below mentioned way.
Root path - $[*]
Attribute path - $[*].id

8

Hi @Arpitha1 & @tharshith

Just tried both the solutions but unfortunately the issue still exists. :smiling_face_with_tear:

9

use Root path = $[*]
Attribute Path = id

10

Unfortunately the issue still persist.

11

Try only putting Attribute path as $[*].id and Remove root path completely.

12

Tried it before and it didn’t work.

13

Any hint on this one guys?

14

Hi @MBaraka, can you try with the path below? I know someone already gave you this one, but please try that and make an after rule that prints the rawResponseObject & processedResponseObject? This will point you in the right direction to what it’s grabbing from the raw data and how it’s being formatted into the processed data.

use Root path = $[*]
Attribute Path = id

Hopefully this will point you in the right direction to what’s wrong with the mapping. Worst case, you may need an after rule to format the data properly.

15

Hi @trettkowski

Thank you for your response.

I figured out that if the user has more than 1 role the roles not being grabbed but if he has only 1 role it appears.

image
image608×347 12.7 KB

16

It was solved by adding the roles in the after-provision rule of the operation.

import java.util.HashMap;

import java.util.Map;

import java.util.ArrayList;



log.info("After Operation Rule Started");



if (rawResponseObject != null) {

    log.info("Raw response: " + rawResponseObject.toString());

    

    try {

        // Parse the roles response

        ArrayList rolesList = JsonUtil.toList(rawResponseObject);

        log.info("Parsed roles array, size: " + rolesList.size());

        

        // Extract role IDs/names

        ArrayList result = new ArrayList();

        for (int i = 0; i < rolesList.size(); i++) {

            Map roleEntry = (Map) rolesList.get(i);

            if (roleEntry != null) {

                log.info("Processing role: " + roleEntry.toString());

                

                // Try to get 'id' first, then 'name' as fallback

                String roleValue = (String) roleEntry.get("id");

                if (roleValue != null) {

                    result.add(roleValue);

                    log.info("Added role: " + roleValue);

                }

            }

        }

        

        log.info("Total roles extracted: " + result.size());

        log.info("Roles list: " + result.toString());

        

        // Create the special structure that SailPoint WebService connector expects

        // for multi-valued attributes to work correctly

        Map roleMap = new HashMap();

        roleMap.put("MOIroles", result);  // Use the attribute name from your mapping

        

        ArrayList dataList = new ArrayList();

        dataList.add(roleMap);

        

        Map finalResult = new HashMap();

        finalResult.put("data", dataList);

        

        log.info("Final structured result: " + finalResult.toString());

        log.info("=== Multi-Valued Roles Fix Completed ===");

        

        return finalResult;

        

    } catch (Exception e) {

        log.info("ERROR processing roles: " + e.getMessage());

        log.info("Returning original response due to error");

        return rawResponseObject;

    }

} else {

    log.info("Raw response is null - returning null");

    return null;

}
17

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.