Workflow to delete identities

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I’m trying to build a workflow to delete identities based on a scheduled trigger running daily. It’s built to grab a list of identities based on a search query and loop through each identity to grab the ID, then make an HTTP Request to delete the identity.

Right at the loop is when I get the error:

image
image1132×952 64.9 KB

That gives me this error:

{
“loopOutput”: {
“failureItems”: [
{
“errorMessage”: “task failed: activity error (type: sp:internal:http, scheduledEventID: 7, startedEventID: 8, identity: 1@sp-workflow-worker-stg-us-east-1-f44968fcc-t7k2s@sp-workflow-engine): request failed (type: Bad Request, retryable: false): 404 - 404 Not Found: (type: HTTP Response Returned a Client Error, retryable: false): request failed (type: Bad Request, retryable: false): 404 - 404 Not Found (type: fundamental, retryable: true) (type: WorkflowFailure, retryable: false): task failed: activity error (type: sp:internal:http, scheduledEventID: 7, startedEventID: 8, identity: 1@sp-workflow-worker-stg-us-east-1-f44968fcc-t7k2s@sp-workflow-engine): request failed (type: Bad Request, retryable: false): 404 - 404 Not Found: (type: HTTP Response Returned a Client Error, retryable: false): request failed (type: Bad Request, retryable: false): 404 - 404 Not Found (type: fundamental, retryable: true)”
}

The Get Identity action returns nothing, and the HTTP request is the delete call trying to feed the identity’s ID into it as a parameter.

Is this 404 error a SailPoint related issue or is my input invalid?

2

Is your loop input correct? I see $.getListOfIdentities, but I would expect something like $.hTTPRequest or something like that. If you open the variable selector and choose the Get List of Identities action, it should give you the correct variable name.

I have a similar workflow, with a HTTP request action feeding a loop and my input is: $.hTTPRequest.body

Matt

3

The variable selector in the loop input has the option for the previous Get List of Identities action which defaults to $.getListOfIdentities.identities. When I changed it to $.hTTPRequest.body, it cleared the error but gave no good output when tested. Wondering if the Get Identity action in the loop is configured wrong. I have the input to $.loop.loopInput.

4

Oh I see - apologies. In the past, I’ve use the HTTP operation action with an API call to the search API. That’s what I assumed when you said you were looking up identities with a search query. The Get Identities action does indeed look like it should be “$.getListOfIdentities.identities” from the variable selector.

What does the configuration for the Get Identity inside of the loop look like. One more question, why have a Get Identity, when you have already retrieved a list of identities that has the id for each of them?

5

I have the input to $.loop.loopInput.

Maybe try $.loop.loopInput.id

6

Yeah this is my initial testing that gave the error I mentioned in the initial post. Having it end in .body clears the error but returns no results when I am expecting some. Something is weird with the loop input request and I don’t understand the 404 error.

7

It’s working for me:

image
image1333×568 41.4 KB

As I said above, $.loop.loopInput.id

However, I still don’t understand why you need a get identity in the loop. Just go straight to the delete identity step, passing $.loop.loopInput.id to it. No need for all the additional lookups.

8

Yeah it’s working now. so werid. How can I call the identity ID directly into the HTTP Request into the loop?

9

Why you want to delete the identity using workflow? How identity are getting created? Not sure about your use case but it would be good to delete the identity via the source which is creating these identities.

10

It’s a flat file source and have no way of automated deletion. Otherwise we have identities that stick around for years with no access or source accounts or any needs at all.

11

I got this part figured out but now I’m running into a 405 error when trying to make the HTTP request to delete the identity.

image
image932×1005 48.5 KB

I tried various ways to modify parameters such as using ‘filters’ or ‘id’ as the key and giving it the $.loop.loopinput.id variable. Even tried throwing it in the request body and the request URL but no luck. Any suggestions here?

12

Maybe I just can’t see it in your screenshot, but I don’t see the /:id at the end of the identities Request URL. Have you looked at the API spec?

You should have something like /v2025/identities/{{$loop.loopInput.id}}

13

@812kay why dont you delete the user at the trusted source itslef ?Since it will again be created in Sailpoint after aggregation

14

If the source is a flat file and you cannot truly delete the record upstream, then deleting the identity in ISC should usually be paired with some guardrail so it does not get recreated on the next aggregation.

For example, I’d check whether the identity is already uncorrelated / has no active accounts, and whether the flat file feed is still sending that record at all. Otherwise the workflow may succeed technically, but the identity can come back as soon as the source reintroduces it.

So the safe pattern is usually:

  1. confirm the person is no longer present or no longer in scope in the flat file,
  2. verify there are no remaining linked accounts,
  3. then call the delete endpoint with the loop item id.

That makes the workflow a cleanup mechanism, instead of a delete/recreate cycle.