Friday, September 10, 2021

Creating a Request using RequestManager API in Sailpoint IdentityIQ

Creating a Request using RequestManager and Request Object , Here in below Example i have created a plan and then used the same plan to Generate the Request using RequestManager.

public void createSnowAppRequestObject(SailPointContext context,String identityName,String operation){

		try {
			Date currentDate = new Date();
			String flow = null;
			String caseName = null;
			ProvisioningPlan plan = new ProvisioningPlan();
	
			switch(operation.toUpperCase()){
				case "DISABLE":
					//Plan to disable Account
					plan = buildPlanForDisableSnowApps(context,identityName, operation);
					caseName = "VIS Disable ServiceNow Integrated Applications Event: " + identityName;
					flow = "UserDisableSnow";
					break;
				case "DELETE":
					//Plan to delete Account
					plan = buildPlanForDisableSnowApps(context,identityName, operation);
					caseName = "VIS Delete ServiceNow Integrated Applications Event: " + identityName;
					flow = "UserDeleteSnow";
					break;
				case "TERMINATE":
					//Plan to remove all the underlying Access & Disable Account
					plan = buildPlanForTerminateSnowApps(context,identityName);
					caseName = "VIS Terminate ServiceNow Integrated Applications Event: " + identityName;
					flow = "UserTerminateSnow";
					break;
				default:
					break;
			}
			if(plan != null && !plan.isEmpty() && plan.getAccountRequests() != null ){
				
				String workflowName = "LCM Provisioning";
				Workflow workflow = context.getObject(Workflow.class, workflowName);

				//Creating attributes to be used in Request Object
				Attributes requestArguments = new Attributes();
				requestArguments.put(sailpoint.workflow.StandardWorkflowHandler.ARG_REQUEST_DEFINITION, sailpoint.request.WorkflowRequestExecutor.DEFINITION_NAME);
				requestArguments.put(sailpoint.workflow.StandardWorkflowHandler.ARG_WORKFLOW, workflowName);
				requestArguments.put(sailpoint.workflow.StandardWorkflowHandler.ARG_REQUEST_NAME, caseName);
				requestArguments.put("requestName", caseName);

				Attributes workflowArguments = new Attributes();
				workflowArguments.put("identityName", identityName);
				workflowArguments.put("notificationScheme", "none");
				workflowArguments.put("approvalScheme", "none");
				workflowArguments.put("flow", flow);
				workflowArguments.put("plan", plan);
				workflowArguments.put("workflow", workflow.getId());
				requestArguments.putAll(workflowArguments);

				//Creating Request object for kicking off another workflow.
				Request requestObject = new Request();
				RequestDefinition requestDefinition = context.getObject(RequestDefinition.class,"Workflow Request");
				requestObject.setDefinition(requestDefinition);
				requestObject.setEventDate(currentDate);
				requestObject.setName(caseName);
				requestObject.setAttributes(requestDefinition, requestArguments);
				System.out.println("Request Object " + requestObject.toXml());

				RequestManager.addRequest(context, requestObject);
			}else{
			}
		} catch (Exception exception){
		}
	}	
   public ProvisioningPlan buildPlanForDisableSnowApps(SailPointContext context,String identityName, String operation) throws GeneralException{
		
		Identity identity = (Identity)getObject(context,identityName,Identity.class);		
		ProvisioningPlan plan = new ProvisioningPlan();		
		Filter filter = null;
		List objectPropertiesToFetch = new ArrayList();
		
		Map objectPropertiesFetched = new HashMap();
		objectPropertiesToFetch.add("type");
		objectPropertiesToFetch.add("toDisable");
		
		String VIS_SNOW_APPLICATION_TYPE = "DelimitedFile";
		
		//Iterate through identity links to create a disable/delete account request for the same
		if (identity != null) {
			List<Link> links = identity.getLinks();
			if (links != null && !links.isEmpty()) {				
				plan.setIdentity(identity);
				plan.setNativeIdentity(identity.getName());				
				String applicationName = null;
				AccountRequest accountRequest = null;		
				for (Link link : links) {				  
					applicationName = link.getApplicationName();				
					filter = Filter.eq("name", applicationName);	
					objectPropertiesFetched = getObjectProperties(context,Application.class, filter, objectPropertiesToFetch);
					if ( VIS_SNOW_APPLICATION_TYPE.equalsIgnoreCase((String)objectPropertiesFetched.get("type")) && "true".equalsIgnoreCase((String)objectPropertiesFetched.get("toDisable"))){			
						accountRequest = new AccountRequest();
						accountRequest.setNativeIdentity(link.getNativeIdentity());
						accountRequest.setApplication(applicationName);
						
						if("Delete".equalsIgnoreCase(operation)){							
							accountRequest.setOperation(ProvisioningPlan.AccountRequest.Operation.Delete); 							
						}else if("Disable".equalsIgnoreCase(operation)){							
							accountRequest.setOperation(ProvisioningPlan.AccountRequest.Operation.Disable); 							
						}					
						
						plan.add(accountRequest);						
					}
				}
			}
		}		
		return plan;
	}	
   public ProvisioningPlan buildPlanForTerminateSnowApps(SailPointContext context,String identityName) throws GeneralException{
		
		Identity identity = (Identity)getObject(context,identityName, Identity.class);
		
		ProvisioningPlan plan = new ProvisioningPlan();
		List accountRequestList = new ArrayList();
		List<Object> entitlementValuesList = new ArrayList();
		Application application = null;
		Filter filter = null;	
		Map objectPropertiesFetched = new HashMap();
		
		List objectPropertiesToFetch = new ArrayList();
		objectPropertiesToFetch.add("type");
		objectPropertiesToFetch.add("toDisable");
		
		String VIS_SNOW_APPLICATION_TYPE = "DelimitedFile";
		
		if (identity != null) {
			List<Link> links = identity.getLinks();
			if (links != null && !links.isEmpty()) {
				plan.setIdentity(identity);
				plan.setNativeIdentity(identity.getName());				
				plan.setIdentity(identity);
				plan.setNativeIdentity(identity.getName());
				
				String applicationName = null;
				AccountRequest accountRequestDisable = null;
				AccountRequest accountRequestModify = null;				
				AttributeRequest attributeRequest = null;
				String entitlementAttribute = null;
				
				for (Link link : links) {				  
					applicationName = link.getApplicationName(); 
					filter = Filter.eq("name", applicationName);	
					objectPropertiesFetched = getObjectProperties(context,Application.class, filter, objectPropertiesToFetch);					
					if("true".equalsIgnoreCase((String) objectPropertiesFetched.get("toDisable")) && VIS_SNOW_APPLICATION_TYPE.equalsIgnoreCase((String) objectPropertiesFetched.get("type"))){						
						application = (Application)getObject(context,applicationName, Application.class);						
						if(!application.getEntitlementAttributeNames().isEmpty() && application.getEntitlementAttributeNames() != null){							
							 entitlementAttribute = application.getEntitlementAttributeNames().get(0);							
							if( link.getAttribute(entitlementAttribute) instanceof String ){								
								entitlementValuesList = Arrays.asList( link.getAttribute(entitlementAttribute) );								
							}else if( link.getAttribute(entitlementAttribute) instanceof List ){								
								entitlementValuesList = (List) link.getAttribute(entitlementAttribute);
							}
						}
						
						accountRequestDisable = new AccountRequest();
						accountRequestDisable.setNativeIdentity(link.getNativeIdentity());
						accountRequestDisable.setApplication(applicationName);
						accountRequestDisable.setOperation(ProvisioningPlan.AccountRequest.Operation.Disable);	
							
						accountRequestModify = new AccountRequest();
						accountRequestModify.setNativeIdentity(link.getNativeIdentity());
						accountRequestModify.setApplication(applicationName);			
						accountRequestModify.setOperation(ProvisioningPlan.AccountRequest.Operation.Modify);
						
						for( Object entitlementName : Util.safeIterable(entitlementValuesList) ){							
							attributeRequest = new AttributeRequest(entitlementAttribute,ProvisioningPlan.Operation.Remove,entitlementName);
							attributeRequest.put("assignment","true");						
							accountRequestModify.add(attributeRequest);
						}						
						plan.add(accountRequestModify);						
						plan.add(accountRequestDisable);
					}
				}
			}
		}
		System.out.println(" Plan : " + plan.toXml());
		return plan;
	}
   
    public Object getObject(SailPointContext context,String objectName , Class objectClass) throws GeneralException {
	String filterString = "name == \""+objectName+"\"";
	Filter filter = Filter.compile( filterString );
	Object object = context.getUniqueObject( objectClass ,filter);
	return object; 
    }
   
	public Map getObjectProperties(SailPointContext context,java.lang.Class objectType, Filter searchFilter, List propertiesToFetch) throws GeneralException{
	Object[] objectProperties;
	Map propertiesMap = new HashMap();
	QueryOptions queryOptions = new QueryOptions();
	queryOptions.addFilter(searchFilter);
	Iterator iterator = context.search(objectType, queryOptions, propertiesToFetch);
	if(iterator.hasNext()){
		objectProperties = (Object[]) iterator.next();
		if (objectProperties != null ){
			propertiesMap = propertyArrayToMap(objectProperties, propertiesToFetch);
		}       
	} 
	Util.flushIterator(iterator);
	return propertiesMap; 
	}

	public Map propertyArrayToMap( Object[] objectProperties, List propertiesToFetch){
		Map propertiesMap = new HashMap();
		Iterator nameIterator = propertiesToFetch.iterator();
		for(Object value : objectProperties) {
			propertiesMap.put(nameIterator.next(), value);
		}
		Util.flushIterator(nameIterator);
		return propertiesMap;
	}
   

Plan (Termination Scenario) and Request Object Details 

Plan
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE ProvisioningPlan PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<ProvisioningPlan nativeIdentity="VKEJ">
  <AccountRequest application="Revenue Process Management" nativeIdentity="VKEJ" op="Modify">
    <AttributeRequest name="EntitlementName" op="Remove" value="Admin">
      <Attributes>
        <Map>
          <entry key="assignment" value="true"/>
        </Map>
      </Attributes>
    </AttributeRequest>
    <AttributeRequest name="EntitlementName" op="Remove" value="Super Read only">
      <Attributes>
        <Map>
          <entry key="assignment" value="true"/>
        </Map>
      </Attributes>
    </AttributeRequest>
  </AccountRequest>
  <AccountRequest application="Revenue Process Management" nativeIdentity="VKEJ" op="Disable"/>
</ProvisioningPlan>


Request 
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Request PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Request name="VIS Terminate ServiceNow Integrated Applications Event: VKEJ" nextLaunch="1631314916907">
  <Attributes>
    <Map>
      <entry key="approvalScheme" value="none"/>
      <entry key="flow" value="UserTerminateSnow"/>
      <entry key="identityName" value="VKEJ"/>
      <entry key="notificationScheme" value="none"/>
      <entry key="plan">
        <value>
          <ProvisioningPlan nativeIdentity="VKEJ">
            <AccountRequest application="Revenue Process Management" nativeIdentity="VKEJ" op="Modify">
              <AttributeRequest name="EntitlementName" op="Remove" value="Admin">
                <Attributes>
                  <Map>
                    <entry key="assignment" value="true"/>
                  </Map>
                </Attributes>
              </AttributeRequest>
              <AttributeRequest name="EntitlementName" op="Remove" value="Super Read only">
                <Attributes>
                  <Map>
                    <entry key="assignment" value="true"/>
                  </Map>
                </Attributes>
              </AttributeRequest>
            </AccountRequest>
            <AccountRequest application="Revenue Process Management" nativeIdentity="VKEJ" op="Disable"/>
          </ProvisioningPlan>
        </value>
      </entry>
      <entry key="requestDefinition" value="Workflow Request"/>
      <entry key="requestName" value="VIS Terminate ServiceNow Integrated Applications Event: VKEJ"/>
      <entry key="workflow" value="8a88b862734df7fc01734df888580351"/>
    </Map>
  </Attributes>
  <Definition>
    <Reference class="sailpoint.object.RequestDefinition" id="8a88b862734df7fc01734df83e4b0175" name="Workflow Request"/>
  </Definition>
</Request>

Thursday, September 9, 2021

Removing Role and Entitlement Assignment using Sailpoint IIQ API

 Removing Role and Entitlement Attribute Assignment using Sailpoint IIQ API

public removeRoleAssignments(String identityName, ProvisioningProject project){
    	
	Identity identity = context.getObjectByName(Identity.class, identityName);
	if (identity != null){
		ProvisioningPlan plan = project.getMasterPlan();
		AccountRequest accountRequest;
		List attributeRequests = new ArrayList();        
		if( plan != null){					  
			List accountRequestList = new ArrayList();			
			accountRequestList = plan.getAccountRequests("IIQ");
			accountRequestList.addAll(plan.getAccountRequests("IdentityIQ"));
			if(accountRequestList != null &amp;&amp; !accountRequestList.isEmpty()){			  
				for(AccountRequest account: accountRequestList){									
					ProvisioningPlan roleRemovalplan = new ProvisioningPlan();              
					roleRemovalplan.setIdentity(identity);         
					if(account != null){
						List roleAttributeRequests = new ArrayList();
						attributeRequests = account.getAttributeRequests("assignedRoles");
						if(attributeRequests != null &amp;&amp; !attributeRequests.isEmpty() ){
							AccountRequest roleRequest = new AccountRequest(AccountRequest.Operation.Modify, ProvisioningPlan.APP_IIQ, null, identity.getName());							
							for(AttributeRequest attributeRequest : attributeRequests) {														
								roleAttributeRequests.add(new AttributeRequest(ProvisioningPlan.ATT_IIQ_ASSIGNED_ROLES, ProvisioningPlan.Operation.Remove, attributeRequest.getValue()));							
							}
							roleRequest.addAll(roleAttributeRequests);
							roleRemovalplan.add(roleRequest);														
							Provisioner provisioner = new Provisioner(context);
							provisioner.setNoRoleExpansion(true);
							provisioner.execute(roleRemovalplan);			
						}		
					}              
				}               
			}             
		}		  
		context.saveObject(identity);      
		context.commitTransaction();
    }
}

public removeAttributeAssignments(String identityName, ProvisioningProject project){

    Identity identity = context.getObjectByName(Identity.class, identityName);
    boolean updateRequired = false;
	String createOperation="Create";
    if(null !=identity){
      List attrAssignments = identity.getAttributeAssignments();
      if(Util.nullSafeSize(attrAssignments)>0){       
        List attrAssigns = new ArrayList(attrAssignments);   
        if(project != null){
			List expPlans = project.getPlans();
			List accountRequestList = new ArrayList();
			for(ProvisioningPlan expPlan : Util.safeIterable(expPlans)){
            String source;
            source=expPlan.getSource();
            accountRequestList = expPlan.getAccountRequests();
				for(AccountRequest accRequest : Util.safeIterable(accountRequestList)){
				String operation=accRequest.getOp().toString();							  
					if(!Util.nullSafeCaseInsensitiveEq(createOperation,operation)){             
						for(AttributeRequest attrReq : Util.safeIterable(accRequest.getAttributeRequests())){
							if(attrReq!=null &amp;&amp; "Remove".equalsIgnoreCase(attrReq.getOp().toString())){
								String requestedgrp = attrReq.getValue(context).toString();
								for (AttributeAssignment attrAssignment : attrAssigns){
								String attAssignmentValue=attrAssignment.getValue();
									if(Util.nullSafeCaseInsensitiveEq(attAssignmentValue,requestedgrp) &amp;&amp; (Util.nullSafeCaseInsensitiveEq("LCM",source)||Util.nullSafeCaseInsensitiveEq("Batch",source))){
									attrAssignments.remove(attrAssignment);
									updateRequired = true;
									}
								}
							} 
						}
					}
				}
			}
        }
      }
      if (updateRequired) {
        identity.setAttributeAssignments(attrAssignments);
        context.saveObject(identity);
        context.commitTransaction();
      }
    }
  }