WebService connector does not aggregate multi valued attributes on 2nd call

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi all,

We are trying to add entitlements and accounts in a WebService connector.

The JSON response is as follows for our secondary account aggregation call:

[
    {
        "name": "jira-software-users",
        "groupId": "11eed5b9-d6bd-45de-a992-7e5f7d65a1c8",
    },
    {
        "name": "jira-users",
        "groupId": "59c5a0a4-be3a-4520-afe5-de5d9cae34d9",
    },
    {
        "name": "atlassian-addons-admin",
        "groupId": "25c3f0fc-b6e5-4767-a459-2394daeb4554",
    }
]

The problem we have is that we are not able to get more than one entitlement. For the secondary account aggregation operation in the response mapping section we have the following configuration:

image
image1170Ă—320 6.75 KB

We’ve tried all the below combinations of options for the Root Path in the Response Information, but to no avail:

$
$*
$[]
$.[]
$[].
$.[].
*

Now, when an account has only one entitlement, the entitlement is aggregated. However, if an account has more than one entitlement, the response it is left empty for that account’s entitlements. Anyone who can help?

WebService connector Multi-Role Aggregation Issue with Keycloak Endpoint Returning Top-Level Array
ISC: How to split an account attribute to make it multivalued
2

Your response is list of object and each object would be considered as separate RO. That’s the standard behaviour. Use after operation rule and combine all groupIds in one array under single key.

[{
“groupId”: “25c3f0fc-b6e5-4767-a459-2394daeb4554”,“59c5a0a4-be3a-4520-afe5-de5d9cae34d9”
}]

You would not get group name from this config so you will have to use group schema and group aggregation end point to get rest of the attributes for your group object.

3

In your root path, try $.[*] . You shouldn’t need to change your response mapping with the root path I provided. I typically use https://jsonpath.herokuapp.com/ to test out JSON path syntax on my input. Just make sure to select Goessner instead of Jayway.

4

I ran into the same problem once and used the solution mentioned by @chirag_patel as well. Here is a sniplet of the rule I used.


  import connector.common.JsonUtil;
  import java.util.HashMap;
  import java.util.Map.Entry;
  import java.util.Map;
  import java.text.DateFormat;
  import java.text.ParseException;
  import java.text.SimpleDateFormat;
  import java.util.Calendar;
  import java.util.Date;


    ArrayList result = new ArrayList();
    

    // Only proceed if we have results
    if (rawResponseObject != null) {
        ArrayList list = JsonUtil.toList(rawResponseObject);
        for ( int i = 0 ; i < list.size(); i++ ) {
            Map entry = (Map) list.get(i);
            if(entry != null) {
               String id = entry.get(\"id\");
               result.add(id);

                if (log.isDebugEnabled()) {
                    log.debug(\"Added id \" + id );
                } //end if log.isDebugEnabled
            } // end if entry != null
        } // end for loop
    
        Map resultMap = new HashMap();
        resultMap.put(\"Groups\", result);

        ArrayList resultList = new ArrayList();
        resultList.add(resultMap);

        Map finalResultMap = new HashMap();
        finalResultMap.put(\"data\", resultList);


        return finalResultMap;
    } // end of if rawResponseObject = null
    else {
        return null;
    }

This gave me a way to map Groups as a multivalue response.

Hope this helps.

Cheers.

2 Likes
5

I had the same issue. The particular API I was using allowed for a user ID to be passed in, so here’s how I did it
image

image
image717Ă—159 3.19 KB

image
image752Ă—214 4.52 KB

My thread on a similar issue

1 Like
6

I have experienced exactly the same issue as @gigisherer1 where the endpoint I was calling returns a response where the root element is an array itself. The path $.[*].property which tests correctly (as you say using https://jsonpath.herokuapp.com/ with Goessner selected). However, when using this path in the response mappings nothing gets returned. With debug logging enabled for the connector I could see errors being generated when the connector tried to parse the jsonPath expression. I will need to replicate the issue again to check what the exact error was.

Like @vkoldenh in the response below I had to implement an after operation rule (which is remarkably similar to his example) to parse the response.

7

I just checked internally with engineering just to make sure and it appears that creating a rule is the only option for this at this time. SaaS connectivity 2.0 which is in beta right now and should be released sometime this year will allow you to configure this directly in the connector code. Reach out to me if you would like more information on this.

2 Likes