Workflow ISC: Best way to revoke roles and delete accounts on target systems

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi all.

I currently have a workflow that creates a micro attestation campaign for an identity when it goes from active to inactive.
The attestation campaign revokes everything requested from the request center:

  1. Workflow creates and configure the certification campaign.
  2. Over HTTP I use the https://tenantid-sb.api.identitynow.com/v3/campaigns/{{$.createLeaverCampaign.id}}/complete call with the {“autoCompleteAction”: “REVOKE”} option.
  3. Over HTTP I use the endpoint to delete the account on the target system.

This works, however, I am concerned that between step 2 and 3 there is a timeout and the account will be deleted before ISC finishes “revoking” the roles (and entitlements), is there any way to ensure this does not happen, i.e. validate that from source X, there are no entitlements left and then I can delete the account?

I hope I have explained myself, thank you in advance for your support.
Regards!

1 Like
2

Hi,

You can try below.

After step2, add wait for 10 mins or 15 mins in workflow. Do an API call to ISC to check if any entitlements are present on source. If no then proceed to delete account. If yes send a notification to alert admin or try it again.

And if you are deleting account on target, what is the need of removing entitlements?

-Abhinov

1 Like
3

Hello!
Thanks for your reply, I will try and hope to succeed.

Answering your question, I want to delete the rights granted by exception (not the roles granted by birthright) because if I don’t delete them and just delete the account, those rights will trigger the account creation again (even if the identity is inactive). Honestly, I think this should not work this way, i.e. an inactive identity should no longer trigger account creation, but if the entitlement is still valid, it creates the account after I delete it.

4
  1. As @Abhinov7 suggested, add the wait time between step 2 and step 3. You can also consider the entitlements’ source account aggregation schedule when you add the wait time just to make sure the updated accounts are aggregated back through source aggregation before deleting the account. This may save you when you have any connectivity issue during revoke process, just my 2 cents on my experience.
1 Like
5

Hello.
Thank you very much for your suggestion.
Just to confirm that I got it right: You mean to perform an account aggregation while waiting between step 2 and 3?
I understand that this is to ensure that I have connection with the target system and then ISC will be able to remove the entitlements, right?

6

First thing, the campaign in your Workflow will anyway do the individual account aggregation via identity refresh and keep your identity with latest data. I suggest to consider the source aggregation to be extra cautious when error occurred during the revoke process, focusing later you are deleting an account. To your questions,

  1. Increase the wait time to align the Workflow with the scheduled source aggregation if the source aggregation is already scheduled and if it is more frequent. Do not add any source aggregation action in the Workflow which distract your Workflow purpose and not recommended to do that.
  2. Apart from connection check, it is to make sure you have an updated account correlated in ISC before deleting the account, otherwise it may create a new account in any exceptional cases.
1 Like
7

Thank you for the explanation, I will take it into account.

8

Hi,

When Identity changes to inactive you can also remove requested roles from workflow. Then trigger delete account.

No need of creating a certification.

-Abhinov

9

Hello!

Do you mean using the workflow action “Manage Access”?

10

Hi,

Yes you can get all access of identity and using manage access you can remove the access. But this should follow sequence of steps.

  1. Identity Change inactive and trigger workflow.
  2. Wait for 3-5 mins for birthright access to remove.
  3. Get the roles of the identity using “Get Access”.
  4. Remove the roles we got on step 3 using manage access.
  5. Get the entitlements of identity using “Get Access”.
  6. Remove the entitlements we got on step 5 using manage access.
  7. Trigger deletion of account.

If you follow this procedure no need of certification.

-Abhinov

11

Thank you for your support, I will do so to avoid certification.
Just one additional doubt, in step 2, why is it necessary to wait to remove the birthright access?
One rule to assign birthright is that our identity is active, do you mean to wait for ISC to remove those roles since the first condition is not fulfilled, or do we have to wait for another reason?

Thanks in advance.
Best regards!

12

Hi,

If we don’t wait and lets say the workflow processed and deleted account before birthright access removal then ISC will trigger account creation.

Also I see you are deleting account directly on target, so ISC wouldn’t know this until next aggregation.

So its not mandatory to add wait, but just to be sure that workflow removals and birthright removal don’t happen parallelly and to avoid any issue its better to wait and do steps in a sequential manner.

-Abhinov

13

Thank you for all your support. Every answer to the doubts we have helps, in addition to solving the use case, to strengthen the community.
Best regards!

1 Like
14

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.