How to attach a rule in IdentityNow #IDN101

Happy New Year Folks!!!

Hopefully this year is better than previous and as always.. stay safe!!!

Anyone who would have worked with IDN would have used or encountered rules. They are wildly used and inevitable component of any deployment to achieve your requirements. So you must be well aware that no client, partner and in fact most of internal SailPoint PS/ES also don’t have access to deploy their rules to their tenants. These rules are reviewed by a specialist team within ES and they upload it to the tenant. There are some very good reasons for doing so due to the SaaS nature of our product and IDN architecture.

There is a lot of work being done to reduce dependency on rules and also a lot in pipeline to make this process simpler. This also does increase our own workload on tickets, review and deployment and we want to reduce it too as IDN has exploded into the world in past few years and new tenants onboarding everyday.

Current Process of Rule upload

  • Send it to SailPoint as an ES ticket. Support will forward it to ES if not as rule review is a billable task.
  • Rule review is done and uploaded to tenant.
  • Ticket is responded to and closed after confirmation.

To make this process faster and seamless do follow some best practices

  • Read the whole rule guide .
  • Run the rule validator and send us the output of it.
  • Make sure the naming convention is followed for the rule names
  • Best to keep the same structure and print of code so it’s easy to see the difference in git for us.

Once the rule has been uploaded to your tenant, there might be a need of additional steps to attach the rule to your source (depending on the type of rule). Once the rule is uploaded you will need the RuleID for some of the rules (mentioned below) to attach it to your source. Please ask the ES person for it if not already given. It will be a long random GUID. We use Postman to execute the API calls but feel free to use your choice of client.

There is a great guide written internally by Neil McGlennon but I am expanding on it.

Few common things found below

  • {ruleID}: This is the rule ID generated after rule is uploaded to your tenant. Ask ES for it if not given already
  • {Rule Name}: This is the name of your rule.
  • {id}: This is the externalID of the source you want to attach it to. It is a long GUID and NOT the shortID found in the URL. You can obtain it by few different methods but simplest is by doing a GET /cc/api/source/get/{shortSourceID} where “shortSourceID” is the ID of the source found in the URL when clicking on it in the tenant.
  • All the API calls use https://{tenantname}.api.identitynow.com/ as the URL (before /beta/…)
  • All of these examples use a PATCH for a partial source update, however PUT operations will work too, as long as the entire source object model is provided.
  • For the PATCH operations, a op key has to be provided. For new configurations this is typically set to add as our example shows, however they can be any of the following:
    • add – Add a new value to the configuration. Use this operation if this is the first time you are setting the value, i.e. it has never been configured before.
    • replace – Use this operation to change the existing value. Use this operation if you are updating the value, i.e. you want to change the configuration.
    • remove – Removes a value from the configuration. Use this operation if you want to unset a value.

Beware! Removals can be destructive if the path isn’t configured properly. This could negatively alter your source config!

Identity Attribute Rule

This rule doesn’t need to be attached via API as it can be seen via UI under Attribute Mappings

 

Account Profile Attribute Generator

This rule doesn’t need to be attached via API as it can be seen via UI under Create Profile for any source which has one.

 

Account Profile Attribute Generator (from Template)

This rule doesn’t need to be attached via API as it can be seen via UI under Create Profile for any source which has one. (as above)

Correlation Rule
Manager Correlation Rule
Before Provisioning Rule
AfterCreate, AfterModify, AfterDelete, BeforeCreate, BeforeModify, BeforeDelete Rules
Build Map Rule
JDBC Provisioning Rule
WebServiceBeforeOperation Rule
WebServiceAfterOperation Rule

 

Once any of the rule is attached, it’s ready for use immediately by the source or profile.

Hopefully this covers all rule types and if you have any issues with attaching a rule in your tenant, please feel free to reach out to me or to Support / ES team.

PSA: New Transform Types Available for IdentityNow

Hey Folks!!!

Since the last time we chatted about transforms and had said we are in process of adding new types in future. Well.. here we are with few news ones fresh out of the oven!!!

They will greatly help you achieve your goals without the need of rules. Please do revisit them while doing your design or upliftment. The goal is to minimise dependency on rules and by using transforms it gives you more control over the testing and deployment process.

For some new noteworthy ones

The date math transform allows you to add, subtract and round components of a timestamp to or from an incoming value. It also allows you to work with a referential value of “now” to run operations against the current date and time instead of a fixed value.

Imagine using this for LCS calculation if simple or just to get some dates for different systems say 10 days in future or so.

The username generator transform allows you to specify logic to use when attempting to derive a unique value for an attribute in an account create profile, . Oftentimes this can be as simple as combining parts of a user’s name and/or HR data (e.g., firstName.lastName), but sometimes generator logic such as a uniqueness counter might be needed to find a unique value in the target system (e.g., firstName.lastName1 if firstName.lastName is already taken).

How about ditching an AttributeGenerator rule and using this? 

The UUID generator is a simple transform allows you to create a universal unique id (UUID) in the form of a 36-character string. The underlying code is written in such a way as to provide a 1 in 68,719,476,736 chance of creating a string that actually collides with another string within the tenant.

Generate UUID on the fly

The name normalizer transform allows you to clean or standardize the spelling of strings coming in from source systems. Most commonly, this pertains to names and other proper nouns, but the transform is not necessarily limited to those data elements.

Get rid of the WiERd CasINg

The get reference identity attribute transform is an out-of-the-box rule transform provided via SailPoint’s Cloud Services Deployment Utility rule. It allows you to easily get the identity attribute of another user from within a given identity’s calculation. As a convenience feature, the transform allows you to use “manager” as a referential lookup to the target identity.

Want the manager’s employee number, email, phone and other details listed easily on the profile?? so easy now!!!

And so many more added.. Do review the full list here and see what can benefit you from removing rules and going down the transform path

How to run SailPoint IIQ on Synology NAS v2 – Slim Edition

So after my previous post I got a lot of queries about it. Thanks for reading it 🙂 

Wanted a slimmer edition which didn’t require all the additional dockers like LDAP etc

So v2 – slim edition

Note: All disclaimers still valid from previous post

Build

This time I am using this git repo: https://github.com/steffensperling/sailpoint-iiq

Only changes to docker-compose.yaml was the path to my own locations. Also ports as current 8080 were used for other containers. Passwords and ports obviously changed 🙂 

Main changes were to Dockerfile under iiq-build folder. The one on the github is not using latest debian and also had issues installing Oracle JDK

Here is the modified version

create_mysql_db.sh was also modified to use 8.1 version of identityiq tables create script

Finally I had to update few lines in create_identityiq_tables-8.1.mysql which comes in IIQ package for me to work

That’s it.. After a few runs I got it up and running on latest version (IIQ 8.1 at the time of writing) and with persistent storage.

 

 

Goodbye CSV… Welcome NELM!!!

This has been long time coming and an ask from many clients. We wanted to have a UI interface to be able to create non employees like contractors etc directly inside IDN (as a source). These type of records might not generally come from an HR source and are maintained directly in AD or other such places. Thus, we have got a new type of source called NELM (Non Employee Lifecycle Management) which has a UI interface where you can enter them. 

Currently its a two step release focusing on API based release happening over the weekend in the production orgs (already in your sandbox). Read more about it in this article.

You can

  • Have multiple sources – how about designing each via type like service account, contractors or say via departments? 
  • Approver for each creation – as above you can assign approvers per type or department and segregate.
  • Custom schema as per your liking
  • Manage these users as normal LCS and business rules like any other source.

Note: There is currently a launch limit of 20 NELM sources per org and 1000 identities per source. Also up-to 10 custom schema attributes. So take that into consideration of your design. I would see this lifted or eased in future as this is used more by customers.

Here is a screenshot of how it looks while creating a user for the source. 

 

A lot is currently via API but in a few months we will have more coming in UI.

You should start testing and possibly convert your csv sources and manual uploads of such users to a nice UI interface with better auditing and management. 

Let me know if any questions.

Edit: Documentation is live!!!

 

How to run SailPoint IdentityIQ on Synology NAS

I have a small home lab setup on which I do various stuff. I am running it on one of most beloved gadget – Synology NAS. It does so much for me like backup, stream, sync, upload, dockers, VM and more.. It just keeps giving!!! Worth having in every home!!!

A small glimpse of my current setup (I do much more than this on the NAS)

Homelab Setup

Hardware

  • NAS: Synology DS918+
  • RAM: 16GB
  • Disks: 4 x 12GB WD Elements (shucked). Setup in 3 x SHR + 1 standalone for secondary backup
  • SSD Cache: 2 x Samsung 970 EVO 250GB M.2

Docker Setup

Various containers running like

  • Pi-Hole – Excellent DNS for whole home to block ads
  • Home Assistant – Home Automation
  • Unifi SDN – For my home network hardware
  • SpeedTest – To keep a constant and historical graph of my internet and catch ISPs in a lie if they say “nothing changed – speed is good” – I slap the graph on the face (and have got money back from ISPs for compensation as well)
  • And many more like Grafana, Chronograf, Watchtower etc etc etc…

IdentityNow Setup

Running on the Virtual Machine Manager on the NAS

  • 1 x Windows Server running AD, IQService etc. To Install certificate for TLS, see my article.
  • 1 x Linux Server running OpenLDAP and other possible connectors
  • 1 x Standard VA deployment for my always on IDN

Goal

Now I wanted to tinker a bit with IdentityIQ due to various reasons and didn’t want to do the classic install (and why not – wanted a challenge). So I started to google and ask around and found that some people have actually dockerised the product – sweet. But couldn’t find a single guide on how to do it on my existing Synology hardware. So this became a weekend mission (in between actual work and COVID-19 lockdown).

DISCLAMER

  • You need to have a license with SailPoint to run your own IIQ Instance
  • The guide doesn’t contain ANY proprietary code
  • Not responsible for breaking your NAS or setup
  • This is not a supported setup by SailPoint or anyone else (including me). This is just for the enthusiasts.

 

Prerequisites

As said earlier, you need to have license from SailPoint and access to the download page. At the time of writing this guide, v8.1 is the latest version. Go to the download page and download identityiq-8.1.zip

Unzip it and grab the identityiq.war file for later use. Upload both the zip and war file to your NAS in a folder of your liking.

Build

I found many different ways to build the docker but I decided to go with the one done by IdentityWorks. They have their own git repo containing everything you need to do the works. 

They have various options there to build but I used the full stack method. Although I already had many of the requirements running as individual dockers due to other projects (traefik, ldap, mysql etc) but I thought to keep it simple and just do the whole build separately. Just in case I break anything.

NAS Customisation

Now If you run the guide as is then it will build it for you straight up from scratch in a new docker environment. But because I am running it on my NAS with existing dockers I came across various issues

  • Some build script commands don’t exist on Synology NAS
  • Some ports are already in use due to NAS UI / other dockers.

Build Script

In the build.sh script I found couple things which didn’t exist on my NAS

  • git command
  • unzip command
  • ant command
  • java package

To fix do the following

  • unzip command replacement

Replace the unzip with 7z command in the build.sh script

  • ant command

Install the package by adding a new repo in the package center. Follow the guide at https://github.com/rednoah/ant-installer

  • git command
  • java package

Install the packages which are available from Synology repo in package center

You should be now able to check if the above commands exist in the terminal

Docker Compose File

Since I am doing this setup on my existing docker, many of the ports were already in use. So I edited the file to change some default ports

Build It!!!

That’s it guys.. Hard work done. Do the deployment in the following steps

  1. Download Identity IIQ binaries
  2. Install additional packages on the NAS
  3. Login to the NAS and get root access
  4. Download the repo
  5. Upload the identityiq-8.1.zip and identityiq.war downloaded previously to the sailpoint-docker folder
  6. Edit the build.sh and docker-compose.yaml file as mentioned above.
  7. Run the rest of the commands

And you see the nice logs

Took around 30 min (apart from couple of hours of research) for the whole build to download various images and create containers and start them up. I kept an eye on the docker logs to see the status

(not the full list above – few more there)

And finally once everything was running and settled I tried going to the IIQ home page

http://xxx.xx.xxx.xxx:8085/identityiq/

I didn’t test the full extent of it. But I was able to create a source and test connection which was external to the docker and running on my VMM on the NAS itself.

Till the next time!!!