IdentityNow

IDN Export / Import API now in beta

Good News everyone (Prof Farnsworth)

We have just released Export / Import API for certain SP configurations in IDN. 

API Details: https://developer.sailpoint.com/apis/beta/#tag/SP-Config

Documentation: https://developer.sailpoint.com/docs/sp_config.html

Current Endpoints

Description REST API End-Point
List Config Objects GET /beta/sp-config/config-objects
Export Objects POST /beta/sp-config/export
Export Status GET /beta/sp-config/export/{id}
Export Results GET /beta/sp-config/export/{id}/download
Import Objects POST /beta/sp-config/import
Import Status GET /beta/sp-config/import/{id}
Import Results GET /beta/sp-config/import/{id}/download

As you will see currently the supported objects are limited (ETS / Rules / Sources / Transforms as I type this) but that list is set to grow as the API solidifies. The documentation is quite good and comprehensive on what you can do and how to. You can also take this to next step and incorporate / build your own CI/CD process to migrate your tenant config from sandbox to production. 

Disclaimer: This is still beta endpoints so please do test out the process and give feedback to SailPoint

By Piyush Khandelwal, ago

ProTip – Create Quick Postman Collection for IDN APIs

As you may already know we have a developer portal which is now the central repository for all public APIs for IDN (and other products). We all use Postman as a tool for using these APIs. Currently there isn’t an official Postman collection for SailPoint but you can easily build one from the developer portal via swagger imports. 

Quick guide on how to do so

 

 

 

 

  • Open Postman and click on File -> Import
  • Click on Upload File and select the previously downloaded swagger.json file

  • Click on Import

  • Once imported, you will have a collection of yours ready to go

Advance Tips: To make your life easier for administration, I highly recommend doing the following

Hope this help get you started in the API world with IDN & SailPoint.

By Piyush Khandelwal, ago

Find Multiple Accounts for Sources Redux – Excel Hack


So after doing the last post on how to find multiple accounts from a single source via API, I was asked by few people and one my clients to see if there is an easy way to do this.

I thought of my trusted Excel to find an easier way to do so. Here are the steps

  • Generate Identities Report via Admin -> Identities -> Identity List UI and download CSV

  • Open the CSV in Excel and look at Column “Source Accounts” ( Column P when I generated it). You will see some data like this. In this example I have a duplicate ServiceNow account for this user. He also has 1 x Workday, 1 x IDN cube and 1 x Okta account.
  • Then on another column (Column S in my instance) I created a new header called “ServiceNow [source]” and applied the following formula

Where

  • P2 = The column containing the “Source Accounts” value
  • $S$1 = Column Header “ServiceNow [source]”
  • LOWER() = Used to lowercase both strings as SUBSTITUTE is case sensitive

This will give me count of number of times “ServiceNow [source]” repeats in that line of text.

Done.

You can filter and find the rows you are interested in and give you all the users who have multiple accounts for a single source. You can expand this to other sources like I did above and create multiple columns.

 

By Piyush Khandelwal, ago

How to Integrate ServiceNow ServiceDesk with IdentityNow

There has been a surge recently in integrating SNOW (ServiceNow) with IDN (IdentityNow) to generate tickets during provisioning or certification events. Many use-cases come to mind: For example, on an identity joiner event you might want to create SD ticket to give laptop and phones to an employee. Or give / remove an application access which is not directly integrated with IDN. Below I will show you how to get up and running in less than 30 min with the integration

Notes

  • This integration is fast changing and the guide is correct as of 30th April 2021
  • This integration is an additional license cost to IDN. Please talk to your CSM about it.
  • This assume you already have a SNOW tenant in your company
  • The guide doesn’t go in-depth into advance scenarios requiring Velocity or rules.

Prerequisite

  • SailPoint for Service Desk Installed on SNOW tenant

  • SNOW Governance connector installed on IDN and users correlated between IDN and SNOW connector
  • Configure at least one virtual appliance cluster.
  • Configure at least one source to generate manual tasks for Provisioning.
  • Be familiar with Apache Velocity scripting.
  • Know the authentication option (Basic or OAuth2) to use for IdentityNow to authenticate into ServiceNow. For token generation and OAuth Client setup on the ServiceNow instance, see Create an endpoint for clients to access the instance.
  • Have the permissions requirements for a service account: A Service Desk Administrator must be assigned the x_sap_sdim.admin role.

Gather Information

  • Create a source which is going to be used for provisioning and has entitlements a user can request. In this example a flat file source with 3 entitlements.

  • Create an Access Profile and Requestable Role for this source

  • To set an integration source owner, select an org admin user and get their identity ID via API call {{api-url}}/v3/search 2c91808673a16fb20173b8523ecd0021
  • Get the Cluster ID of your VA via API Call {{api-url}}/beta/managed-clusters 2c918088737cf45e0173b8fb6727040d
  • Get the id for the provision source (Say flat file) created via {{api-url}}/beta/sources/ : 2c91808578daf04e0178dcb83b1a0173
  • Get the id for the SNOW governance source which correlates users between SNOW and IDN via {{api-url}}/beta/sources/ : 2c91808478daf0580178dcff779001b4
  • Get the SNOW Application sys_id from SNOW. 8053xxxedbffb300exxxxxxxdbxxxxcx123

 

Integration

Use the following API to create the integration: https://developer.sailpoint.com/apis/beta/#operation/createServiceDeskIntegration

Please populate the payload (attached separately) and replace the parameters with value

Parameter

Value

<ownerId>

2c91808673a16fb20173b8523ecd0021

<clusterId>

2c918088737cf45e0173b8fb6727040d

<Provision_Source_ID>

2c91808578daf04e0178dcb83b1a0173

<SNOW_Sys_ID>

8053xxxedbffb300exxxxxxxdbxxxxcx123

<SNOW_URL>

https://XXXX.service-now.com/

<requesterSource>

2c91808478daf0580178dcff779001b4

<username>

SNOW user

<password>

User Password

 

 

Integration Testing

  • For the provision source, create some Entitlements and create Access Profile and requestable role.
  • Request for a SNOW correlated user for the source

  • In Account Activity a pending request will show for the request with REQ Ticket Number

  • In SNOW “Service Catalog -> Requests” the ticket number shows up

  • Click on RITM and you will see the description of request

  • Once the ticket is closed, the Access Request in IDN will close after interval checks. This frequency can be configured as well (See Configuring a Schedule for Status Checks section in SDIM Integration API Reference Guide)

That should be it. You should be able to create provisioning tickets for the source now.

Hope that helped!!!

 

 

By Piyush Khandelwal, ago

How to attach a rule in IdentityNow #IDN101

Happy New Year Folks!!!

Hopefully this year is better than previous and as always.. stay safe!!!

Anyone who would have worked with IDN would have used or encountered rules. They are wildly used and inevitable component of any deployment to achieve your requirements. So you must be well aware that no client, partner and in fact most of internal SailPoint PS/ES also don’t have access to deploy their rules to their tenants. These rules are reviewed by a specialist team within ES and they upload it to the tenant. There are some very good reasons for doing so due to the SaaS nature of our product and IDN architecture.

There is a lot of work being done to reduce dependency on rules and also a lot in pipeline to make this process simpler. This also does increase our own workload on tickets, review and deployment and we want to reduce it too as IDN has exploded into the world in past few years and new tenants onboarding everyday.

Current Process of Rule upload

  • Send it to SailPoint as an ES ticket. Support will forward it to ES if not as rule review is a billable task.
  • Rule review is done and uploaded to tenant.
  • Ticket is responded to and closed after confirmation.

To make this process faster and seamless do follow some best practices

  • Read the whole rule guide .
  • Run the rule validator and send us the output of it.
  • Make sure the naming convention is followed for the rule names
  • Best to keep the same structure and print of code so it’s easy to see the difference in git for us.

Once the rule has been uploaded to your tenant, there might be a need of additional steps to attach the rule to your source (depending on the type of rule). Once the rule is uploaded you will need the RuleID for some of the rules (mentioned below) to attach it to your source. Please ask the ES person for it if not already given. It will be a long random GUID. We use Postman to execute the API calls but feel free to use your choice of client.

There is a great guide written internally by Neil McGlennon but I am expanding on it.

Few common things found below

  • {ruleID}: This is the rule ID generated after rule is uploaded to your tenant. Ask ES for it if not given already
  • {Rule Name}: This is the name of your rule.
  • {id}: This is the externalID of the source you want to attach it to. It is a long GUID and NOT the shortID found in the URL. You can obtain it by few different methods but simplest is by doing a GET /cc/api/source/get/{shortSourceID} where “shortSourceID” is the ID of the source found in the URL when clicking on it in the tenant.
  • All the API calls use https://{tenantname}.api.identitynow.com/ as the URL (before /beta/…)
  • All of these examples use a PATCH for a partial source update, however PUT operations will work too, as long as the entire source object model is provided.
  • For the PATCH operations, a op key has to be provided. For new configurations this is typically set to add as our example shows, however they can be any of the following:
    • add – Add a new value to the configuration. Use this operation if this is the first time you are setting the value, i.e. it has never been configured before.
    • replace – Use this operation to change the existing value. Use this operation if you are updating the value, i.e. you want to change the configuration.
    • remove – Removes a value from the configuration. Use this operation if you want to unset a value.

Beware! Removals can be destructive if the path isn’t configured properly. This could negatively alter your source config!

Identity Attribute Rule

This rule doesn’t need to be attached via API as it can be seen via UI under Attribute Mappings

 

Account Profile Attribute Generator

This rule doesn’t need to be attached via API as it can be seen via UI under Create Profile for any source which has one.

 

Account Profile Attribute Generator (from Template)

This rule doesn’t need to be attached via API as it can be seen via UI under Create Profile for any source which has one. (as above)

Correlation Rule
Manager Correlation Rule
Before Provisioning Rule
AfterCreate, AfterModify, AfterDelete, BeforeCreate, BeforeModify, BeforeDelete Rules
Build Map Rule
JDBC Provisioning Rule
WebServiceBeforeOperation Rule
WebServiceAfterOperation Rule

 

Once any of the rule is attached, it’s ready for use immediately by the source or profile.

Hopefully this covers all rule types and if you have any issues with attaching a rule in your tenant, please feel free to reach out to me or to Support / ES team.

By Piyush Khandelwal, ago