I’m working with a SailPoint ISC Web Services connector where multiple mandatory attributes need to be sent together in a single API call. Currently, these attributes are configured as separate entitlements, and during provisioning SailPoint generates separate Add Entitlement operations for each attribute.
Because of this, the BeforeOperation rule is executed separately for each operation and only receives the data for that specific operation. As a result, one operation contains only the role attribute, while another contains only the unit/group attribute, making it impossible to construct the required combined payload for the target API.
We attempted handling this in the BeforeOperation rule by iterating over the provisioning plan and extracting values, but the rule only has visibility of the current operation and cannot access data from other operations. Passing values between operations or merging provisioning plans also does not seem supported.
We also tried switching from Add Entitlement to Modify Account by converting entitlements to account attributes, but are facing challenges ensuring that both attributes are consistently available together in a single provisioning execution triggered via role assignment.
We are looking for guidance on the recommended approach to ensure that multiple required attributes are available together in one provisioning operation, so that a complete API payload can be constructed reliably.
I’ve run into this exact issue before and unfortunately couldn’t find a great workaround either. Our solution ended up being combining the two required attributes into a single entitlement to ensure we had all the necessary details in the provisioning plan.
This approach, of course, comes with trade-offs. The main one is that you have to combine every possible role/group attribute combination during the group aggregation. If you have a significant number of role/group attributes, this can create a massive volume of entitlements that are largely unused and can become difficult to manage.
Thanks @trettkowski ,
What I’m looking for is a solution from the SailPoint side that would allow all entitlement requests to be included in a single provisioning plan. Unfortunately, the target application is not currently able to provide an API that accepts and processes multiple entitlement assignments in a single request.
Is there any SailPoint configuration or approach that can consolidate all entitlement changes into a single provisioning plan or provisioning transaction before they are sent to the application?
I would appreciate any suggestions or best practices for achieving this from the SailPoint end.
What you are looking for is the addRemoveEntInSingleReq flag, which allows SailPoint to combine multiple entitlements of the same type into a single provisioning plan operation.
The reason this wasn’t suggested initially is because your scenario involves two completely different entitlement types, which this flag does not natively support combining.
However, if you are able to restructure your account schema so that both of these attributes are classified under the same entitlement type, this flag would work perfectly to group them into a single request. You can find the full configuration steps in the SailPoint Web Services Documentation.
Hi @trettkowski ,
Thanks for the suggestion ,
In our case, the entitlements belong to different types, and the payload needs to be constructed dynamically based on those entitlement types. For example, in some scenarios we need to build a payload containing a combination of entitlement types A and B, while in others it may be A and C.
We can distinguish the entitlements using the entType attribute associated with each entitlement. Given this requirement, is there a SailPoint-side approach that would allow us to collect all entitlement requests, group them based on the entType attribute, and then construct the required payload before provisioning?
Any guidance or recommendations for handling this use case would be greatly appreciated.