Configuring IdentityIQ to Integrate with Atlassian Cloud Jira Service Management

This section provides the required information for configuring IdentityIQ to integrate with Atlassian Cloud Jira Service Management.

This is intended as an introduction to the configuration required to integrate IdentityIQ with Atlassian Cloud Jira Service Management. It outlines some examples that must be used as a reference point for implementation. Some changes may be required to meet specific use case and expertise around both systems are a must for the successful implementations.

SailPoint provides a default Atlassian Cloud Jira Service Management configuration. This configuration implements the integration between IdentityIQ and the Atlassian Cloud Jira Service Management to fulfill (fulfillment of the ticket is done manually) creation of tickets based on IdentityIQ access certification remediation events.

The default configuration is located in the following directory, where iiqHome is the location where IdentityIQ was installed:

iiqHome/WEB-INF/config/connector/IdentityIQforAtlassianCloudJiraServiceDesk.xml

Once the following configuration information is populated then import the IdentityIQforAtlassianCloudJiraServiceDesk.xml file. This would create an application.

The configuration must include the following entries:

url*

The base URL of Service Desk System based on the authenticationType as follows:

• Basic: https://your-domain.atlassian.net
• OAuth2: https://api.atlassian.com/ex/jira/{cloudid}

authenticationType*

Authentication method that is supported by the managed system

• Basic
• OAuth2

For more information, see Authentication Method.

requesterSource

The application name by which Atlassian Cloud Jira Service Management accounts are aggregated. Required for Plan Initializer script.

ticketType

Enter one of the following ticket type to generate ticket on Service Desk system:

• serviceRequest
• incident
• changeRequest

Applicable if authenticationType is selected as Basic

username*

Service Account username.

password*

Service Account user’s API Token.

Applicable if authenticationType is selected as OAuth2

token_url

URL for generating refresh token.

For example, https://auth.atlassian.com/oauth/token

For more information, see Generating Refresh Token, Client ID and Client Secret.

grant_type

Enter the following type of Grant:

REFRESH_TOKEN

client_id

Client Id for OAuth2 authentication.

client_secret

Client secret for OAuth2 authentication.

refresh_token*

(Applicable if Grant Type is selected as Refresh Token) A valid refresh token for grant type authentication.

Application Configuration XML would have all configurations for Service Request, Incident and Change Module. Depending on the type of selection for ticketType, respective configuration would be executed by connector for the request processing.

Each module would have provision and checkStatus entries as mentioned below:

Provision:

<entry key="customfield_10033">    
<value>
<Map>
<entry key="value" value="Normal" />
</Map>
</value>
</entry> 

Check Status:

If any changes required in the mapping, change the default value/key values in statusMap as mentioned in the following tables:

statusMap for Service Request

statusMap for Incident

statusMap for Change Request

Retryable Mechanism

For availing the advantage of some of the logic around retryable situations, add the retryable error messages list to the attributes map on an application. The retryableErrors entry is a list of strings through which the connector searches when it receives a message from the managed application. If one of the strings in the entry exists in the error, the connector attempts to retry the connection. When the configured error string is not a part of the error message returned from the connector, then IdentityIQ would not attempt a retry.

For example:

<entry key="retryableErrors"> 
    <value> 
      <List> 
        <String>Connection reset</String> 
      </List> 
    </value>
</entry>

Enter the following command to enable log4j2 logging on Service Desk component:

logger.JiraSDIM.name=openconnector.connector.servicedesk.ServiceDeskConnector
logger.JiraSDIM.level=info

Managed Resources

You can manage the IdentityIQ applications through the Atlassian Cloud Jira Service Management. To manage the applications, you need to add them individually as a ManagedResource under the ProvisioningConfig tag provided in the IdentityIQforAtlassianCloudJiraServiceDesk.xml file.

For example, to add three applications such as Procurement_System, HR_System, and Finance_System, add them individually as a ManagedResource as shown below:

<ProvisioningConfig>

<ManagedResource>

<ApplicationRef>

<Reference class="sailpoint.object.Application" name="Procurement_System" />

</ApplicationRef>

</ManagedResource>

<ManagedResource>

<ApplicationRef>

<Reference class="sailpoint.object.Application" name="HR_System" />

</ApplicationRef>

</ManagedResource>

<ManagedResource>

<ApplicationRef>

<Reference class="sailpoint.object.Application" name="Finance_System" />

</ApplicationRef>

</ManagedResource>

<PlanInitializerScript>

......................

......................

</PlanInitializerScript>

</ProvisioningConfig>