WebServiceBeforeOperationRule to remove the roles from the user and then disable the user

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Team,

We have requirement for webservice connector where we need to remove the roles from the user and disable the user.

I think we can achieve using WebServiceBeforeOperationRule but does anyone can suggest how to implement using WebServiceBeforeOperationRule and steps to be followed?

Thanks
Kalyan

Thanks
Kalyan

2

Hi,

You can create the rule using below documentation.

After creation you need to attach the rule to webservice operation.

Let me know if you looking for any specific scenario.

Thanks,
Abhinov

3

Hi @Abhinov7 thank you for your reply and could you please provide any code to remove the roles from the user and disable the user other than documentation rule at Web Services Before Operation Rule | SailPoint Developer Community

Thanks
Kalyan

4

Hi,

Can you let me know your exact requirement?

Are you trying to remove roles directly on target/ or you want to remove roles using ISC.

  1. If you are trying to remove on target then you need to make API calls directly to target application using WSBO.
  2. If you are trying to remove on target using ISC then you cannot achieve it using WSBO. You need to write a before provisioning rule.

Thanks,
Abhinov

5

Hi @Abhinov7 thanks for the reply.

My requirement as per below:

Whenever user leaves/departs from the company we need to remove the roles associated with that user related to the target web service application and disable the user on the target web service application. I think we may not be able to achieve using HTTP remove and disable operation as we may not combine two different operations in a single HTTP operation. How can we achieve using Web Service Before operation rule and any sample code and steps to be followed.

Thanks
Kalyan

6

Hi,

You can configure disable account operation and remove entitlement operation on webservices.

When LCS changed to resigned, disable the webservices application. As part of disablement you can remove groups as well.

In this case you need a before provisioning rule. This cannot be achieved with WSBO.

I have attached the generic rule. Change it according to requirement.
Generic.java (1.9 KB)

Thanks,
Abhinov

7

Hi @kalyannambi2010 as @Abhinov7 says you can use before provisioning rule for disabling the account and remove groups when user terminate.

I have tried with Webservice Operation Rule but it not works for me.

So better you can write an before provisioning rule or you can get help with Sailpoint Expert Service to deploy the default rule “Service Standard Before Provisioning Rule”

Please refer the below post for more info

Thanks,
Shantha Kumar

8

Hi @Santhakumar thank you for the update and can before provisioning rule be applied to webserice connector?

Thanks
Kalyan

9

Hi @Abhinov7 thank you for the update and can before provisioning rule be applied to webserice connector?

Thanks
Kalyan

10

Hi,

Yes you can apply the before provisioning rule to webservice connector. But it would be a cloud rule. We need SailPoint support help to deploy rule into tenant.

Thanks,
Abhinov

11

Yes you can use the rule for webservice connector. However you can use the Service Standard Rule by importing into your tenant with the help of sp-config.

Use the below link to download the rule from Mock Project:
https://community.sailpoint.com/t5/IdentityNow-Forum/IdentityNow-Mock-Project-Services-Standard-BeforeProvisioning/td-p/216158

If you want the updated rule you can contact Sailpoint Support Service as @Abhinov7 says.

Thanks,
Shantha Kumar

12

Hi @Santhakumar and @Abhinov7 thank you for the update.

Thanks
Kalyan

1 Like