Configuring Web Services Entitlements

Multiple Group Objects

The Web Services source supports multiple group objects. Add a new endpoint for newly introduced groups or entitlements, such as:

Group Aggregation - <GROUP-SCHEMA-OBJECT-TYPE>
Get Object - <GROUP-SCHEMA-OBJECT-TYPE>
Add Entitlement - <GROUP-SCHEMA-OBJECT-TYPE>
Remove Entitlement - <GROUP-SCHEMA-OBJECT-TYPE>

Refer to the listSchema API and createSchema API for more information.

Adding a New Group Schema

To support multi groups, add the following API to add a new schema:

Method - POST
URI - /sources/<source-id>/schemas
JSON Payload:

The following JSON example adds the schema for the Role that follows:

{
    "name": "Role",
    "nativeObjectType": "Role",
    "identityAttribute": "Id",
    "displayAttribute": "Name",
    "hierarchyAttribute": null,
    "includePermissions": false,
    "features": [],
    "configuration": {},
    "attributes": [
        {
            "name": "Id",
            "type": "STRING",
            "schema": null,
            "description": "Role Id.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "Name",
            "type": "STRING",
            "schema": null,
            "description": "Role name.",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        }
    ]
}

The resulting Role:

<Schema displayAttribute="Name" identityAttribute="Id" nativeObjectType="Role" objectType="Role">
<AttributeDefinition name="Id" type="string">
<Description>Role Id.</Description>
</AttributeDefinition>
<AttributeDefinition name="Name" type="string">
<Description>Role name.</Description>
</AttributeDefinition>
</Schema>

Updating the Existing Account Schema

As the new group schema (for role object type) has been created, update the relevant account schema attributes to point to the new group schema by making changes in the account schema through the UI, as SailPoint allows you to add the new entitlement in the account schema.

Add New Endpoint

Add a new endpoint for Group Aggregation, Get Object, and Add/Remove Entitlement operations. Update the connectionParameters attribute using the PATCH method as follows:

Add a new dummy endpoint such as Test Connection, Account Aggregation from the SailPoint UI and save it.

With the PATCH API, replace the required operation type with the respective operation type, such as:

Group Aggregation <GROUP-SCHEMA-OBJECT-TYPE>
Get Object <GROUP-SCHEMA-OBJECT-TYPE>
Add Entitlement <GROUP-SCHEMA-OBJECT-TYPE>

Remove Entitlement <GROUP-SCHEMA-OBJECT-TYPE>

Method - POST

URI - beta/sources/<source-id>/schemas

JSON Payload:

[
    {"op":"add","path":"/connectorAttributes/connectionParameters/0/operationType","value":"Group Aggregation-Role"},
    {"op":"add","path":"/connectorAttributes/connectionParameters/1/operationType","value":"Get Object - Role"},
    {"op":"add","path":"/connectorAttributes/connectionParameters/2/operationType","value":"Add Entitlement-Role"},
    {"op":"add","path":"/connectorAttributes/connectionParameters/3/beforeRule","value":"Remove Entitlement-Role"}
]

Important

Localization is not applicable for the value of the OperationType attribute added from the API. If you provide the operation type in a language other than English, the Web Services source does not configure the group aggregation type (for example, Groepsaggregatie - Rol).

Configuring Multiple Entitlement Requests

The connector can send a single request for several instances of one entitlement type to the managed system. For example, you can send a single request for several instances of RoleID.

Note

The connector must send multiple requests for different entitlement types. However, each request for that entitlement type can include several instances.

To enable this feature, set the addRemoveEntInSingleReq parameter to true as follows:

<entry key="addRemoveEntInSingleReq">
   <value>
       <Boolean>true</Boolean>
   </value>
</entry>

You can configure the value of this attribute using the SailPoint REST API. Refer to SailPoint REST API - Update Source (Partial) for more information.

[
  {
    "op": "replace",
    "path": "/connectorAttributes/addRemoveEntInSingleReq",
    "value": "true"
  }
]

The following is an example of the payload:

{
  "RoleID": $plan.addRoleIds$
}

If addRemoveEntInSingleReq is set to false, then the placeholder value for the attribute marked as an entitlement is passed in separate API requests:

First request payload:
```
jsonBody={ "RoleID": "9dd23398-b905-4878-b7ad-bc02d22171d9" }
```
Second request payload:
```
jsonBody={ "RoleID": "8defe39c0-54f6-47b4-8a15-fcc2622923sk" }
```
If addRemoveEntInSingleReq is set to true, then the placeholder value for the attribute marked as an entitlement is passed as an array and is executed in a single request:

Single request payload:
```
jsonBody={ "RoleID": ["97ee39c0-54f6-47b4-8a15-fcc262292386","8defe39c0-54f6-47b4-8a15-fcc2622923sk"] }
```

Add Entitlements When Enabling Accounts

When you enable accounts via provisioning, you can associate entitlements with it at the same time.

To configure the connector to add entitlements to accounts you enable, add the following to your provisioning plan:

<ProvisioningPlan>
    <AccountRequest op="Enable">
        <AttributeRequest name="<Entitlement_Name>" op="Add" value="<Entitlement_Value>">
        </AttributeRequest>
        <AttributeRequest name="<Entitlement_Name>" op="Add" value="<Entitlement_Value>">
        </AttributeRequest>
    </AccountRequest>
</ProvisioningPlan>

Note

In the provisioning plan entry, substitute the attribute's name where the example says <Entitlement_Name> and the desired value for <Entitlement_Value>. Add additional AttributeRequest entries to add more entitlements.

Remove Entitlements When Disabling Accounts

When you disable accounts via provisioning, you can remove any associated entitlements at the same time.

To configure the connector to remove entitlements from accounts you disable, add the following to your provisioning plan:

<ProvisioningPlan>
    <AccountRequest op="Disable">
        <AttributeRequest name="Entitlement_Name" op="Remove" value="Entitlement_Value">
        </AttributeRequest>
        <AttributeRequest name="Entitlement_Name" op="Remove" value="Entitlement_Value">
        </AttributeRequest>
    </AccountRequest>
</ProvisioningPlan>

Note

In the provisioning plan entry, substitute the attribute's name where the example says <Entitlement_Name> and the desired value for <Entitlement_Value>. Add additional AttributeRequest entries to remove more entitlements.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.