Configuring Web Services SaaS Entitlements

Multiple Group Objects

The Web Services source supports multiple group objects. Add a new endpoint for newly introduced groups or entitlements, such as:

Group Aggregation - <GROUP-SCHEMA-OBJECT-TYPE>
Get Object - <GROUP-SCHEMA-OBJECT-TYPE>
Add Entitlement - <GROUP-SCHEMA-OBJECT-TYPE>
Remove Entitlement - <GROUP-SCHEMA-OBJECT-TYPE>

Refer to the listSchema API and createSchema API for more information.

Adding a New Group Schema

To support multi groups, add the following API to add a new schema:

Method - POST
URI - /sources/<source-id>/schemas
JSON Payload:

The following JSON example adds the schema for the Role that follows:

{
    "name": "Role",
    "nativeObjectType": "Role",
    "identityAttribute": "Id",
    "displayAttribute": "Name",
    "hierarchyAttribute": null,
    "includePermissions": false,
    "features": [],
    "configuration": {},
    "attributes": [
        {
            "name": "Id",
            "type": "STRING",
            "schema": null,
            "description": "Role Id.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "Name",
            "type": "STRING",
            "schema": null,
            "description": "Role name.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        }
    ]
}

The resulting Role:

<Schema displayAttribute="Name" identityAttribute="Id" nativeObjectType="Role" objectType="Role">
<AttributeDefinition name="Id" type="string">
<Description>Role Id.</Description>
</AttributeDefinition>
<AttributeDefinition name="Name" type="string">
<Description>Role name.</Description>
</AttributeDefinition>
</Schema>

Updating the Existing Account Schema

As the new group schema (for role object type) has been created, update the relevant account schema attributes to point to the new group schema by making changes in the account schema through the UI, as SailPoint allows you to add the new entitlement in the account schema.

Add New Endpoint

Add a new endpoint for Group Aggregation, Get Object, and Add/Remove Entitlement operations. Update the connectionParameters attribute using the PATCH method as follows:

Add a new dummy endpoint such as Test Connection, Account Aggregation from the SailPoint UI and save it.

With the PATCH API, replace the required operation type with the respective operation type, such as:

Group Aggregation <GROUP-SCHEMA-OBJECT-TYPE>
Get Object <GROUP-SCHEMA-OBJECT-TYPE>
Add Entitlement <GROUP-SCHEMA-OBJECT-TYPE>

Remove Entitlement <GROUP-SCHEMA-OBJECT-TYPE>

Method - POST

URI - beta/sources/<source-id>/schemas

JSON Payload:

[
    {"op":"add","path":"/connectorAttributes/connectionParameters/0/operationType","value":"Group Aggregation-Role"},
    {"op":"add","path":"/connectorAttributes/connectionParameters/1/operationType","value":"Get Object - Role"},
    {"op":"add","path":"/connectorAttributes/connectionParameters/2/operationType","value":"Add Entitlement-Role"},
    {"op":"add","path":"/connectorAttributes/connectionParameters/3/beforeRule","value":"Remove Entitlement-Role"}
]

Important

Localization is not applicable for the value of the OperationType attribute added from the API. If you provide the operation type in a language other than English, the Web Services source does not configure the group aggregation type (for example, Groepsaggregatie - Rol).

Configuring Multiple Entitlement Requests

To enable the connector to send multiple entitlement requests of different enlistment types in a single request to the managed system, set the addRemoveEntInSingleReq parameter to true as follows:

<entry key="addRemoveEntInSingleReq">
   <value>
       <Boolean>true</Boolean>
   </value>
</entry>

You can configure the value of this attribute using the SailPoint REST API. Refer to SailPoint REST API - Update Source (Partial) for more information.

The following is an example of the payload:

{
  "addRoleIds": $plan.addRoleIds$
}

If addRemoveEntInSingleReq is set to false, then the placeholder value for the attribute marked as an entitlement is passed in separate API requests:

First request payload:
```
jsonBody={ "addRoleIds": "9dd23398-b905-4878-b7ad-bc02d22171d9" }
```
Second request payload:
```
jsonBody={ "addRoleIds": "8defe39c0-54f6-47b4-8a15-fcc2622923sk" }
```
If addRemoveEntInSingleReq is set to true, then the placeholder value for the attribute marked as an entitlement is passed as an array and is executed in a single request:

Single request payload:
```
jsonBody={ "addRoleIds": ["97ee39c0-54f6-47b4-8a15-fcc262292386","8defe39c0-54f6-47b4-8a15-fcc2622923sk"] }
```

Child Hierarchy

The Web Services SaaS connector supports child hierarchy for entitlements. To achieve this, perform the following:

Add the hierarchyAttribute property to the entitlementSchemas.
Add the childHierarchy: true property to the child entitlement.

Refer to the API Uploads source entitlements schema and Update Source Schema (Partial) in the SailPoint Developer Community for more information.

Sample Schema

The following example marks the roles attribute on a Role entitlement schema as supporting a child hierarchy:

<Schema displayAttribute="name" identityAttribute="sys_id" nativeObjectType="sys_user_role" objectType="Role">
  <AttributeDefinition multi="true" name="roles" type="string">
    <Description>List of roles contained within the role</Description>
  </AttributeDefinition>
  <Attributes>
    <Map>
      <entry key="childHierarchy" value="true"/>
    </Map>
  </Attributes>
</Schema>

Direct Permissions

The Web Services SaaS connector can read direct permissions for accounts. Configure direct permissions using after list account operations in customizers. Refer to Customizers for more information.

To add direct permissions for accounts, add the desired object to the permissions attribute under StdAccountListOutput as follows:

.afterStdAccountList(async (context: Context, output: StdAccountListOutput) => {
    const permissions = [] as unknown as Permission[];
    const permission = {} as Permission;
    permission.annotation = 'annotationValue';
    permission.rights = 'rightsValue';
    permission.target = 'targetValue';
    output.permissions = permissions;
    return output
})

Note

Configuring direct permissions requires additional processing, which may result in an increased duration of time to complete aggregation processes.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.