Workflow to unblock account - works in SB but not PRD

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

:bangbang: Please be sure you’ve read the docs and API specs before asking for help. Also, please be sure you’ve searched the forum for your answer before you create a new topic.

I am hoping someone can point out what i am missing. We have written a workflow in SB that looks for an identity that is returning from LOA to Active LCS. It then finds the Epic account and removes the block for LOA. This is working in SB. We moved the workflow to PRD and changed the Epic source for the account that should get unblocked.

This is the unblock section set input from PRD.

{
"accountIds": "$.getAccounts.accounts[?(@.sourceId=='2c918087831429a501833366c17a31e9')].id",
"operation": "unlock"
}

it’s proceeded by a Get Accounts step.

The output of that step indicates it can’t find the Epic Account.

{
"accountsErrorDetails": [
{
"accountID": "$.getAccounts.accounts[?(@.sourceId=='2c918087831429a501833366c17a31e9')].id",
"errorMessage": "account not found"
}
],
"failedAccounts": [
"$.getAccounts.accounts[?(@.sourceId=='2c918087831429a501833366c17a31e9')].id"
],
"successfulAccounts": null
}

We have verified that the sourceId is correct for Epic PRD both in the GUI and in PostMan calls.

We can also verfiy that the account in question does have an Epic account.

What are missing?

Any suggestions on the next troubleshooting step?

2

In is this step an http request? If so, in these types of situations where I want to see the payload that’s being sent, I use something like webhook.site. Replace the request URL in your http request step with your webhook URL, then look at what the actual request body is showing.

3

Hi,

The error suggests that the JSONPath expression is being passed as a literal string rather than being evaluated to an account ID.

Notice how the output shows:

"accountID": "$.getAccounts.accounts[?(@.sourceId=='2c918087831429a501833366c17a31e9')].id"

instead of an actual account ID value.

A few things to check:

  • Review the Get Accounts step output and confirm the exact structure of the returned JSON.

  • Verify that the workflow variable syntax is correct for the accountIds input and that the expression is being evaluated.

  • Add a temporary debug/log step to output the result of:

    $.getAccounts.accounts[?(@.sourceId=='2c918087831429a501833366c17a31e9')]

    and confirm it returns the Epic account.

  • Check whether the account’s sourceId in the workflow output exactly matches the value you’re filtering on.

My first suspicion is that the filter is either not matching any accounts or the expression syntax isn’t being evaluated in that workflow step, causing the unlock action to receive the JSONPath string instead of the actual account ID.

4

I created a similar workflow based on the identity attribute (LMS training completion). Once it becomes true, we get the identity and all the accounts, in the next step will make sure that identity has an EPIC. Then will proceed with the unblock action.

image
image1250×637 69.7 KB

5

HI @swcoleman

Can you also share the information on how are you calling the get accounts action is it using identity or account?

6

If you can share the workflow body here by removing sensitive data maybe we can have a look on what’s happening

7

@mcheek Thanks for the suggestion on Webhooks. I have not played with those much.

@rabappy you were on the right track. In the manage accounts, step next to select accounts I had enter value, not choose variable. That was causing a literal string to be sent.

8

Glad it helped you move forward