We currently have NERM connected to IdentityNow. IdentityNow assigns groups to identities like ORG_ADMIN, for example, however, there is no possibility to customize the groups, let’s suppose we want to assign the group “Approvers_group” so that in NERM the role “Approvers” is assigned.
But, what would be the best way to do it?
Can I do it through a workflow from NERM or can I do it through API call?
Should this manual assignment from the API persist or would NERM remove it?
Hi Gilberto, perhaps the IdentityNow Management Connector can help with assigning those User Levels. Then treat the User Levels as entitlements, provisioning based on the aggregated NERM accounts attributes.
There are no roles for profiles in NERM. I think you are talking about roles for users , “User Roles”.
If you have SSO configured with IDN, then the best way is to assign group in IDN to users and create a corresponding role in NERM and map the group from IDN in NERM role, similar to what you have for ORG_ADMIN.
If you have SSO, then assigning roles via API will be overridden when the user logs in NERM.
A doubt, do you know if this type of connector allows to create new user levels?
I mean, what if none of the existing ones help us because we want one called “APPROVERS”, is that possible?
Correct, thanks for the observation. I have corrected the title of the topic.
But what if I want a group of users to be approvers. The group that assigns them that role is the group “APPROVERS”, how can I make them have that group or directly the role if I can’t customize the groups in IDN and if the Role will be overwritten?
The ISC User Levels are fixed, but may be somewhat dynamic using Sub-Admin User Level, where User has the same permissions for Search and reports as Source Admins. However, they can perform the following actions only on the sources associated with the governance groups they are members of.
You may be able to associate sub-admin user levels to entitlements and grant access to certain sources based on the NERM account’s attributes, like their department or status.
I have been trying to achieve the same use case for NERM but this doesn’t seem to work for some reason when assigning ISC user levels to identities via ISC roles.
In my case as well, the users will login to NERM with ISC as the IdP. And NERM only checks the user’s identity level as group strings to evaluate user roles on the NERM side for system users.
Thats’ correct observation. I will have to reach out to SailPoint for this. @ZackTarantino-Woolson Is this a limitation of the product, can you confirm?
This saas connector can be used to manage the users in NERM - NERM Users Connector. It treats the NERM roles as entitlements which can be assigned to users.
Hi!
I have tested the connector, however, I can’t get it to work, currently when I test the connection or when I try to add accounts, I get the following error:
[ConnectorError] error receiving response from connector: stream client connection is broken (connector process may have crashed)
In the CLI I see the following, what could be the error?
[2024-04-26T14:01:17.500-06:00] INFO | invokeCommand ︎ Command execution started : std:account:list, for connector version 1.
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ node:internal/modules/cjs/loader:1080
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ throw err;
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ ^
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ Error: Cannot find module ‘/app/connector’
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ Require stack:
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ - /usr/bin/index.js
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ at Module._resolveFilename (node:internal/modules/cjs/loader:1077:15)
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ at Module._load (node:internal/modules/cjs/loader:922:27)
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ at Module.require (node:internal/modules/cjs/loader:1143:19)
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ at Hook._require.i.require (/usr/bin/index.js:35:2011540)
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ at require (node:internal/modules/cjs/helpers:121:18)
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ at 99318 (/usr/bin/index.js:40:165350)
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ at nccwpck_require (/usr/bin/index.js:59:331218)
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ at 6144 (/usr/bin/index.js:40:157768)
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ at nccwpck_require (/usr/bin/index.js:59:331218)
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ at /usr/bin/index.js:59:331546 {
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ code: ‘MODULE_NOT_FOUND’,
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ requireStack: [ ‘/usr/bin/index.js’ ]
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ }
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎
[2024-04-26T14:01:18.173-06:00] INFO | connectorMessage ︎ Node.js v18.17.1
[2024-04-26T14:01:20.216-06:00] INFO | commandOutcome ︎ Command failed with [ConnectorError] error receiving response from connector: stream client connection is broken (connector process may have crashed): std:account:list, for connector version 1.output_count=0 keep_alive_count=0 state_count=0. Elapsed time 2691ms
@GilbertoOledo14 I have not seen this error before. Have you tried testing the connection with an instance of the connector running locally? There is a SaaS Connectivity Postman collection that can help with this. Your payload would be something like the following:
︎ Command execution started : std:account:list, for connector version 1.