I have onboarded Reporthub Application into IIQ using a Webservices connector and configured all the connector operations, while testing when we request multiple groups to a user, only one group is being provisioned and the rest are not provisioned to the user, and the error says user is already assigned to the group, how can we configure this connector operation to provision multiple groups in the same request
Hi @sravan_kumar - have you verified if the API accepts multiple groups in a single request? Is this repeatable using a tool such as Postman?
Please try the same set of APIs that you have configured in SailPoint using Postman. Make sure that it is working.
API allows only one group in a request, my requirement is to make it to provision multiple groups in a request,
when tried in postman if i specify multiple group ID’s it simply ignores all and picks only the last one
@sravan_kumar
So, in this case, as you mentioned, Postman did not pick all the groups in the request. There is a limitation on the API. Is there any custom rule you are using for this purpose ?
@msingh900 I use a before operation rule to login and get cookies and pass to this API call and build the API request and then hit it
You need to call this API multiple times, depending on the number of groups you have, since it supports only one group at a time.
exactly I need to know how can i achieve this
for the first part of the rule I login with the admin user and collect the cookies and save this for this call and into the second half I byuild the Url by getting the required attributes from the provisioning plan and build the URL and return it..
here’s the second half of the rule
for(AccountRequest accReq : provisioningPlan.getAccountRequests()) {
for(AttributeRequest attReq : accReq.getAttributeRequests()) {
userid = accReq.getNativeIdentity().toLowerCase();
if(attReq.getName().equalsIgnoreCase(“groupid”)) {
groupid = attReq.getValue();
}
}
}
String newURL = application.getAttributes().get(“genericWebServiceBaseUrl”) +“admin/addmembertogroup?groupid=”+groupid+“&userid=”+userid;
requestEndPoint.setFullUrl(newURL);
return requestEndPoint;
From here, you cannot achieve this use case by calling your API in a loop for multiple groups. You can call your APIs in loop in before provisioning rule, after checking all the groups from your provisioning plan.
Dear colleagues,
as per my understanding the crucial point here is that the ReportHub API does not offer and endpoint which allows us to add/remove a set/list of entitlements at once.
It is a single object operation.
As a result we have to modify the ProvisioningPlan to split up the “Add” operations so the connector executes one “Add” after the other.
Please kindly give it a try and let us know the results.
Thanks,
Daniel
@sravan_kumar Normally IIQ provision multiple entitlements as a List in the single account request. you might want to split your plan to have one account request per entitlement as suggested by @daniel_neubert .
In case it doesn’t work, please share your before provisioning rule, before+after rule and provisioning plan printed in all these rules.
The best way to debug this is, first, to check or run it with Postman to add multiple access points. And see what the payload is expecting. And the same thing you can check in the SailPoint IIQ by adding debug logs (by placing the access request) and checking the API’s and payload. If SailPoint is not sending the way the application expects, then you have to change the logic in the before rule and the before provisioning rule based on your requirement.
@sravan_kumar - couple of questions here.
-
from postman if you pass one entitlement say e1 to user u1 as add request, the entitlement gets added and the status of user becomes u1 having e1. Is this correct?
-
Next using postman you add entitlement e2 to the user who already is having e1 previously, then in that case also the entitlement added successfully and the user status will be u1 having e1 and e2 both.
-
If you assign e3 and e4 to same user from postman, then only e4 gets assigned. And the user status will be u1 having e1, e2 and e4 . Is this understanding right?
if this is the case, then you have to pass entitlements in different requests. There are two options -
-
Either you restrict the app from SailPoint to request only one entitlement at a time. For this either you can develop a custom form for access request for this application, or you can throw and error from provisioning rule, in case there are more than one entitlement requested.
-
in before-operation rule itself you write the logic to assign those many entitlements to user by invoking APIs in loop. and the final entitlement can be put in the request to be processed by connector in proper way.