Webservice - Add entitlement error

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

In webservice connector…

The Create Account operation works. And create account with user user attributes…

image
image1492×672 31.2 KB

for example user:

image
image2433×283 20.4 KB

However then second Add Entitlement operation fails with error:

[“Exception while updating account.Url: https://dev.intasite.com/api/v1/member/create_account/, Message: 400 : Bad Request : {“non_field_errors”:[“An email or mobile number is required”]}, HTTP Error Code: 400”]

image
image1297×373 33.9 KB

I have created two Add entitlement operations…

First, should get the created account user emailAddress, and use it in body of second Add Ent operation, and set user_type_id=2.

image
image712×243 10.7 KB

image
image867×581 34.5 KB

image
image1107×473 21.9 KB

image
image766×597 33.6 KB

image
image653×446 22.6 KB

I already tried in body:

“email”: “$account.emailAddress$”.

The body is 100% correct. Because, if I use the same URL, and body with real user email on source Intaside DEV API. The user account user_type_id is updated.

I assume Sailpoint pass empty emailAddress in body. Thus the application returns the error above. Saying email is missing.

What is wrong in my logic?

2

shouldn’t this be a PATCH operation and not a POST? It looks like you are modifying an exiting account. Also what is the API spec for the endpoint you are trying to build this for?

Based on the error message your also going to need to send the mobile number along side the email.

3

@vasilcin3 Hi Ivan, had a look at your screenshots. The main problem is the body in step 2. $identity.emailAddress$ doesn’t resolve to anything, so the email goes out blank, and that’s exactly the error you’re getting. Since step 1 already maps emailAddress from the GET response, use that instead:

json

{
  "email": "$response.emailAddress$",
  "user_type_id": "$plan.user_type_id$"
}

I also swapped the hardcoded 2 for $plan.user_type_id$. Your failed event shows the request was for 3, so right now it would send the wrong value even after the email works.

In step 1, change the URL to /member/$plan.nativeIdentity$. $getObject.nativeIdentity$ won’t resolve in an Add Entitlement operation.

Last thing, step 2 is listed above step 1. Drag step 1 to the top, and if you see a Parent Endpoint option on step 2, point it to step 1. Otherwise step 2 won’t see the response from the GET.

This one came from an identity refresh, so the plan only has the entitlement, which is why the email has to come from the GET.

@SivaLankapalli

4

@vasilcin3 Why can’t this be achieved using a before operation rule instead of using 2 endpoints?

5

no there is rather email or mobile number needed. I have this tested already on Intasite API. And it works.

6

Hello Siva,

thanks this helped a lot.

I used what you suggested…

image
image847×477 25 KB

And entitlement is created in Sailpoint. However it is not updated on source. The user_type_id remains null.So maybe the step 2 is not called as you said.

I moved the Step 1 before Step 2.

image
image725×241 10.7 KB

What do you mean with “set Parent” ?

There is no such option on left side in Add Entitlement step.

7

well probably. But I have no skill in writing rules. And no idea how to update it. Probably over some API call in Postmann right? And I would like to avoid rules, that run somewhere in background. As this will also be hard to maintenance in future, for someone else. If it can be done in UI, I prefer that.

8

@vasilcin3 Actually before operation is a recommended approach for such use cases. One of the usage of before rule is to update the body with mandatory attributes. As accounts already exist in the system, you don’t need a separate endpoint ot get the email. Ideally you should read it from the link.

Reference article for before rule: Before and After Operation Rules - Web Services - #4 by iamnithesh