Webservices connector customization rule workaround while migrating IIQ to ISC

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hey Sailors,

As part of migration of webservices connector from IIQ to ISC
We have encountered the following situation

In IIQ we have account customisation rule which performs email null checks && other than @xyz.com return null
Otherwise return account object

How we can implement similar thing in ISC

Any ideas will help

2 ) ISC aggregating disabled accounts even after using Account Enable status attribute
Status=active Iā€™m i missing anything here

2

Hi @amulpuru

For the first requirement, I would suggest that you can have a after web service operation rule where you loop through the data received from the prior aggregation and then apply the same logic to convert the emails to null or actual value.

For second one also then you can filter out the disabled objects in the same rule where you remove these accounts from the aggregated accounts.

Ideally i believe ISC should be able to read all of the objects where are in target application to fully manage those accounts but if you have a good use-case to ignore disabled users, you could leverage above approach.

Simpler approach although would be to have some sort of filter on the web service where you can do the both instead of running this process in ISC as it may not be helpful in terms of time taken by the whole aggregation activity.

I hope this help.

Regards
Vikas.

3

Hi @vguleria ,

I wanted to achieve the following logic of IIQ account customization rule in
ISC as part of Migration from IIQ to ISC

this is achievable in ISC webservices afterOperations rule

 
  String type = object.getObjectType(); 
  if(type != null && type.equalsIgnoreCase("account")) {
    String email = object.getStringAttribute("email");
    String status = object.getStringAttribute("status");
    if(status == null || (status != null && !status.equalsIgnoreCase("active")) ||
       email == null || 
       (email != null && !email.toLowerCase().endsWith("xyz.com"))) {   
      return null;
    }
  }
  return object;
4

Hi @AvisEst

I do not have expertise in the iiq, I believe you are here getting the attributes from the account and then based on email and status of the account you are then excluding them. I would say yes, it should be possible but then you will need to write after operation rule on aggregation process.

The aggregation will read all the accounts including the staus= inactive or null or email = ā€œxyz.comā€ . Then once the aggregation is finished, the rule will kick in where you will have to apply the similar logic but it should be applied on the rawResponse receieved from the aggregation.
Using this logic, then you will exclude the disabled accounts and the ones with particular mail domain and set them to a map and return that map such that it updates the accounts schema.

You can check the below documentation for more information about the web service after operation rule

The code will be little bit longer in ISC than what i see in your post but should be possible. By the way i am assuming this web service application is not an authoritative source in your case or is it ?

If it is authoritative source, then you should read all the accounts and may be move them to some NeedCorrection LCS such that these can be monitoring. If that case, In my view, you should make use of the transform approach.

I hope this helps.

Regards
Vikas.

5

Hi @vguleria ,

I guess this webservices afterOperations rule is not required we can levarage the OOTB feature feature string

by appling the following filter
"filterString": "( status!= \"active\" || !email.endsWith( \"@xyz.com\" ) )",
has full filled my requirement thanks for your inputs so far