Workflow - Remove entitlements when a identity turns inactive

[Soundary (Soundarya R)]

Hi all,

I am working on a requirement to remove all the entitlement when a user turns inactive, and the ad account is disabled then all the entitlement of the ad should be removed So, some reason the entitlements are not getting removed. The loop step doesnt fetch the results

Identity trigger
$.changes[?(@.attribute == "cloudLifecycleState" && @.newValue == "inactive")]

FIRST HTTP JSON BODY

{
  "indices": [
    "identities"
  ],
  "query": {
    "query": "id:{{$.trigger.identity.id}}"
  }
}

Loop input:
$.hTTPRequest.body[0].access[?(@.type == "ENTITLEMENT" && @.source.name == "Active Directory")]

Second HTTP Request JSON Body:

{
  "requestType": "REVOKE_ACCESS",
  "requestedFor": [
    "{{$.loop.context.id}}"
  ],
  "requestedItems": [
    {
      "comment": "Please remove",
      "id": "{{$.loop.loopInput.id}}",
      "name": "{{$.loop.loopInput.name}}",
      "type": "{{$.loop.loopInput.type}}"
    }
  ]
}

[Soundary (Soundarya R)]

And the HTTP details for both are as follows
First HTTP CALL : https://TENANT.api.identitynow.com/v3/search
Second HTTP CALL: https://TENANT.api.identitynow.com/v3/access-requests

[phil_awlings (Phil Rawlings)]

You don’t have to use a workflow.
You could use:

• afterModify rule to catch the DISABLE function to then run a PS script
• run a scheduled script to remove all entitlements from any users that are disabled.

All depends on your coding preference

[suresh4iam (Suresh Kumar Palanisamy)]

Hello Soundarya,
You may follow the below link which will give you the high level information to your Workflow approach which considers the Workflow limitation, sticky entitlements and AD group default behaviors.

Sticky Entitlements

You can use Before Provisioning Rule to loop through all the assigned entitlements and remove it which could be a custom written code. Since you are using Workflow, you can handle it in Workflow itself by using Certification Campaign. I have implemented the same scenario using Workflow as below. Solution Summary: Trigger the workflow when identity’s LCS changed to inactive. Get the identity details by using Get Identity action. Create a search-based certification campaign to remove all the s…

Let me know whether it helps you.

[bhaskar-kancherla]

Try using Services Standard IdentityNow BeforeProvisioning Rule which has an action RemoveADEntitlements .

This is not deployed to your tenant by default . You can take support help to deploy this rule or you can deploy on your own.

Try Something Like this for your usecase :

[
{
“op”: “add”,
“path”: “/connectorAttributes/cloudServicesIDNSetup”,
“value”: {
“eventConfigurations”: [
{
“eventActions”: [
{
“Action”: “ADMoveAccount”,
“Attribute”: “AC_NewParent”,
“Value”: “OU=Disabled,OU=Users,OU=,OU=,DC=***,DC=”
},
{
“Action”: “ScramblePassword”,
“Attribute”: “password”,
“Value”: null
}, {
“Action”: “RemoveADEntitlements”,
“Attribute”: “memberOf”,
“Value”: “CN=Domain Users,CN=Users,
DC=testing,DC=com”
}
],
“Identity Attribute Triggers”: [
{
“Attribute”: “cloudLifecycleState”,
“Value”: “inactive”,
“Operation”: “eq”
}
],
“Operation”: “Disable”
}
]
}
}
]

[Soundary (Soundarya R)]

Hi Bhaskar,

can you give me the full steps on how to deploy this in our tenant?

[suresh4iam (Suresh Kumar Palanisamy)]

Unfortunately I couldn’t provide the JSON since it is implemented in a client tenant and you can refer the link which provides the JSON to built the basic workflow and on top of it you can customize it based on your requirement.

[sharvari (Sharvari Shah)]

You can try using the built in Get Access and Manage Access workflow actions instead of HTTP actions.

[Soundary (Soundarya R)]

Hi Bhaskar,

Which is the api you are using here? is it update-provisioning-policy | SailPoint Developer Community

[bhaskar-kancherla]

Hi Soundarya,

You need to make sure to have the rule deployed and then you need to patch the source .

Thanks,
Bhaskar.

[Soundary (Soundarya R)]

Hi Bhaskar,

The rule is already deployed in our tenant so let me know which is the patch API you used was it this update-provisioning-policy | SailPoint Developer Community?

[bhaskar-kancherla]

Please use v3 api to patch the source.
PATCH https://****.api.identitynow.com/v3/sources/{sourceid} - in body just modify the below content.

[
{
“op”: “add”,
“path”: “/connectorAttributes/cloudServicesIDNSetup”,
“value”: {
“eventConfigurations”: [
{
“eventActions”: [
{
“Action”: “ADMoveAccount”,
“Attribute”: “AC_NewParent”,
“Value”: “OU=Disabled,OU=Users,OU=,OU= ,DC=***,DC= ”
},
{
“Action”: “ScramblePassword”,
“Attribute”: “password”,
“Value”: null
}, {
“Action”: “RemoveADEntitlements”,
“Attribute”: “memberOf”,
“Value”: “CN=Domain Users,CN=Users,
DC=testing,DC=com”
}
],
“Identity Attribute Triggers”: [
{
“Attribute”: “cloudLifecycleState”,
“Value”: “inactive”,
“Operation”: “eq”
}
],
“Operation”: “Disable”
}
]
}
}
]

[Soundary (Soundarya R)]

Hi Suresh,

Yes, this helped, and I was able to remove all the entitlements. But in the get identity can the workflow take more then 100 users and process the campaign for them?

[suresh4iam (Suresh Kumar Palanisamy)]

Get identity will get a single identity on a iteration, so it will work and creates individual campaign for each identity