IDN

How to upload Connector Rules into IDN via API

So I did a post couple of days ago that now we are allowed to upload some rule types via API

Here is a quick guide on how to do so. In this example, I will take a very basic BuildMap rule. 

Previously we would submit the rule like above to ES team to upload. Now you just need to take the code and upload yourself.

Now the real trick – You need to escape the actual java code else you will not be able to upload it and postman will show errors.

So head down to https://www.freeformatter.com/java-dotnet-escape.html and paste the code part of above. There are other such websites or can be some easier local method in your editor.

You will get some output like

Rest is then easy as per the API links

You should get a 201 Created and see a similar output

That is it. You should be able to see and use this rule now on your source. 

Please remember to follow the IDN Rule Guide on what is allowed and what is not.

And if you want you can reverse the process by getting existing rules via API, unescape it via the URL above and get the neat looking java code.

By Piyush Khandelwal, ago

PSA: Connector Rules can now be deployed directly by clients

In my previous guide I had mentioned that how to deploy and attach rules in IDN. But there is a big change to this announced.

Client can now directly attach what we call as “Connector Rules” into their IDN tenants without going through the rule review process. Reason behind it

Connector-Executed Rules or Connector Rules are rules that are executed in the IdentityNow virtual appliance, and are usually an extension point of the connector itself. The rules are commonly used for performing complex connector-related functions, and likewise are very specific to only certain connectors. Because these rules execute in the virtual appliance, they do not have access to query the IdentityNow data model, or fetch information from IdentityNow; instead they rely on contextual information sent from IdentityNow. Connector-executed rules may also have managed connections supplied in their contexts in order to support querying end systems or sources. While these managed connections may be used, making additional connections or call-outs is not allowed.

This should make it much easier and faster for clients to upload and modify rules themselves. The rule types allowed are

  • Before Creation Rule
  • Before Modify Rule
  • Before Delete Rule
  • After Creation Rule
  • After Modify Rule
  • After Delete Rule
  • Build Map Rule
  • JDBC Build Map Rule
  • JDBC Provisioning Rule
  • SAP Build Map Rule
  • SAP HR Provisioning Modify Rule
  • Web Services Before Operation Rule
  • Web Services After Operation Rule

This is done via REST API Calls. 

Name

Path

List Connector Rules

GET /beta/connector-rules/

Get Connector Rule

GET /beta/connector-rules/{id}

Create Connector Rule

POST /beta/connector-rules/

Update Connector Rule

PUT /beta/connector-rules/{id}

Delete Connector Rule

DELETE /beta/connector-rules/{id}

Validate Connector Rule

POST /beta/connector-rules/validate

There are some restrictions in the rule which will auto reject them

Please go and have a full read in our IDN Rule Guide

 

By Piyush Khandelwal, ago

ProTip – Create Quick Postman Collection for IDN APIs

As you may already know we have a developer portal which is now the central repository for all public APIs for IDN (and other products). We all use Postman as a tool for using these APIs. Currently there isn’t an official Postman collection for SailPoint but you can easily build one from the developer portal via swagger imports. 

Quick guide on how to do so

 

 

 

 

  • Open Postman and click on File -> Import
  • Click on Upload File and select the previously downloaded swagger.json file

  • Click on Import

  • Once imported, you will have a collection of yours ready to go

Advance Tips: To make your life easier for administration, I highly recommend doing the following

Hope this help get you started in the API world with IDN & SailPoint.

By Piyush Khandelwal, ago

Find Multiple Accounts for Sources Redux – Excel Hack


So after doing the last post on how to find multiple accounts from a single source via API, I was asked by few people and one my clients to see if there is an easy way to do this.

I thought of my trusted Excel to find an easier way to do so. Here are the steps

  • Generate Identities Report via Admin -> Identities -> Identity List UI and download CSV

  • Open the CSV in Excel and look at Column “Source Accounts” ( Column P when I generated it). You will see some data like this. In this example I have a duplicate ServiceNow account for this user. He also has 1 x Workday, 1 x IDN cube and 1 x Okta account.
  • Then on another column (Column S in my instance) I created a new header called “ServiceNow [source]” and applied the following formula

Where

  • P2 = The column containing the “Source Accounts” value
  • $S$1 = Column Header “ServiceNow [source]”
  • LOWER() = Used to lowercase both strings as SUBSTITUTE is case sensitive

This will give me count of number of times “ServiceNow [source]” repeats in that line of text.

Done.

You can filter and find the rows you are interested in and give you all the users who have multiple accounts for a single source. You can expand this to other sources like I did above and create multiple columns.

 

By Piyush Khandelwal, ago

Find Multiple Accounts from Sources #IDN101

Currently there is no easy way in our default search UI to find all identities who have more than one accounts from a single source. There are other ways like doing account link search or via accounts CSV etc. 

But there is a way to do find them (not pretty but still helpful) via search aggregation API. I found this somewhat easier if the result is small. If its a large set, you can always parse it to you liking. I am no coder 🙂 

Here is the call

The result will be something like this

Here you can see multiple accounts for a user from Azure AD

Similarly another user having duplicate accounts in Google Suite and Active Directory.

You can’t filter to get particular sources only but at least this will give you all users with more than one account from all sources.

Hope this helps!!! 

By Piyush Khandelwal, ago