PolicyViolation WorkFlow , This WF is used to modify the violation object , This will remove the violation object and will remove if anything is added through LCM .
<?xml version='1.0' encoding='UTF-8'?> <!DOCTYPE Workflow PUBLIC "sailpoint.dtd" "sailpoint.dtd"> <Workflow explicitTransitions="true" handler="sailpoint.api.StandardWorkflowHandler" name="VIS Detective SOD Policy Violation Workflow" type="PolicyViolation"> <Variable input="true" name="approvalObject"> <Description>PolicyViolation to process. Note that we use approvalObject for consistency with other workflows, but the violation has already been persisted. Calling the commit or rollback actions will have no effect.</Description> </Variable> <Variable input="true" name="approver"> <Description>The user to receive the work item, normally the owner of the policy.</Description> <Script> <Source> import sailpoint.object.Identity; Identity newOwner= approvalObject.getOwner(); return newOwner.getName(); </Source> </Script> </Variable> <Variable input="true" name="violator"> <Description>The identity that has the violation.</Description> </Variable> <Variable name="approved"> <Description>Internal variable automatically set logically true an Approval process completes with no rejects. </Description> </Variable> <Variable name="action"> <Description>Variable that may be set in the approval page to determine the action to take on this violation. We handle violation approvals differently than most work items. There is no &quot;reject&quot; there is a selection of an action (mitigate, remediate, delete, ignroe) followed by buttons that always post approval.</Description> </Variable> <Variable name="expiration"> <Description>Variable that must be set to a Date (or the String representation of a Date) in order to use the &quot;mitigate&quot; action. This will be tested in the call:mitigate handler and logged if it is invalid. You may wish to have the worklfow do it&#39;s own validation.</Description> </Variable> <Variable name="comments"> <Description>Variable that may be set to comments to be included with a mitigation or remediation.</Description> </Variable> <Variable name="remediatables"> <Description>Variable that may be set to a list of things that can be selected for remediation. Currently this will only be set for Role SOD violations.</Description> </Variable> <Variable name="remediations"> <Description>Variable holding the remediatables selected in the work item.</Description> </Variable> <RuleLibraries> <Reference class="sailpoint.object.Rule" name="Rule Library"/> </RuleLibraries> <Step icon="Default" name="Logs" posX="98" posY="126"> <Arg value="ref:remediatables"/> <Script> <Source> import java.util.Map; import java.util.Date; import java.util.List; import java.util.HashMap; import java.util.ArrayList; import sailpoint.tools.Util; import sailpoint.object.Filter; import sailpoint.api.ObjectUtil; import java.text.ParseException; import java.text.SimpleDateFormat; import sailpoint.object.Identity; import sailpoint.object.QueryOptions; import sailpoint.api.SailPointContext; import sailpoint.object.EmailOptions; import sailpoint.object.EmailTemplate; import sailpoint.object.PolicyViolation; import sailpoint.object.ManagedAttribute; import org.apache.commons.logging.Log; import sailpoint.tools.GeneralException; import sailpoint.object.IdentityEntitlement; import org.apache.commons.logging.LogFactory; import sailpoint.object.IdentitySelector.MatchTerm; Log logger = LogFactory.getLog("vis.workflow.visDetectiveSODPolicyViolationWorkflow"); public boolean checkIfThroughLCM(String applicationName, String identityName, String entitlementName) { boolean wasThroughLCM = false; StringBuilder result = new StringBuilder(); String sDate1 = "06/05/2021"; Date date = new SimpleDateFormat("MM/dd/yyyy").parse(sDate1); result.append("date [").append(date).append("]\n"); Filter dateCheckFilter = Filter.gt("created", date); logger.debug(" new Date dt : "+ sDate1 + " new date : " + result); QueryOptions qo = new QueryOptions(); qo.addFilter(Filter.and(Filter.eq("source","Aggregation"),Filter.eq("application.name",applicationName), Filter.eq("identity.name",identityName),Filter.eq("value",entitlementName),dateCheckFilter)); List identityEntitlements = context.getObjects(IdentityEntitlement.class, qo); logger.debug("identityEntitlements :: " + identityEntitlements); if(identityEntitlements.size() > 0) { return true; }else { return false; } } public Map getEntitlementDetails(String entitlementValue, String applicationName) { QueryOptions qo = new QueryOptions(); qo.addFilter(Filter.and(Filter.eq("value", entitlementValue) , Filter.eq("application.name", applicationName))); Map entDetailsMap = new HashMap(); List managedAttributes = context.getObjects(ManagedAttribute.class, qo); if(managedAttributes != null && managedAttributes.size() > 0) { ManagedAttribute managedAttribute = managedAttributes.get(0); entDetailsMap.put("LogiplexName", managedAttribute.getAttribute("logiplexAppName")); entDetailsMap.put("EntitlementDescription", managedAttribute.getDescriptions().get("en_US") ); } return entDetailsMap; } //Main code starts here logger.debug("Startes Main code here"); String piiMarkerGroup = "<<Left Group>>"; String notificationTemplateForPolicyViolation = "VIS Policy Violation Notification Template"; Identity violationOnwer = approvalObject.getOwner(); EmailTemplate violationTemplate = context.getObjectByName(EmailTemplate.class,notificationTemplateForPolicyViolation ); Map emailVariables = new HashMap(); String ownerEmails= Util.listToCsv(ObjectUtil.getEffectiveEmails(context,violationOnwer)); List entitlementsTobeAddedToViolation = new ArrayList(); List PIIEntitlementsToBeAddedToViolation = new ArrayList(); if (approvalObject != null && approvalObject.getArgument("ViolatingEntitlements") != null) { Identity identityWithViolation = approvalObject.getIdentity(); String firstName = identityWithViolation.getFirstname(); String lastName = identityWithViolation.getLastname(); String lanId = identityWithViolation.getAttribute("lanId"); String identityName = identityWithViolation.getAttribute("displayName"); emailVariables.put("firstName", firstName); emailVariables.put("lastName", lastName); emailVariables.put("lanId", lanId); emailVariables.put("identityName", identityName); for (int i = 0; i < approvalObject.getArgument("ViolatingEntitlements").size(); i++) { sailpoint.object.IdentitySelector.MatchTerm entitlementViolatingAtTop = approvalObject.getArgument("ViolatingEntitlements").get(i); if (entitlementViolatingAtTop != null) { String applicationNameForViolatingEntitlement = ""; String entitlementValueForViolatingEntitlement = ""; String accountNameForViolatingEntitlement=""; if(entitlementViolatingAtTop.getApplication() != null ){ applicationNameForViolatingEntitlement = entitlementViolatingAtTop.getApplication().getName(); accountNameForViolatingEntitlement= getAccountNmae(identityWithViolation, entitlementViolatingAtTop.getApplication()); } if(entitlementViolatingAtTop.getValue() != null) { entitlementValueForViolatingEntitlement = entitlementViolatingAtTop.getValue(); } if(entitlementValueForViolatingEntitlement.equalsIgnoreCase(piiMarkerGroup)) { PIIEntitlementsToBeAddedToViolation.add(entitlementViolatingAtTop); }else { boolean checkThruLCMmethodResult = checkIfThroughLCM(applicationNameForViolatingEntitlement, identityWithViolation.getName(), entitlementValueForViolatingEntitlement) ; logger.debug("CheckThruLCMmethodResult:: " + checkThruLCMmethodResult ); if( checkThruLCMmethodResult == true ) { entitlementsTobeAddedToViolation.add(entitlementViolatingAtTop); Map entDetails = getEntitlementDetails(entitlementValueForViolatingEntitlement, applicationNameForViolatingEntitlement); auditDetectiveSOD( "Violation Detected","Aggregation",lanId,entDetails.get("LogiplexName"),entitlementValueForViolatingEntitlement,accountNameForViolatingEntitlement,approvalObject,"Aggregation",lanId ); emailVariables.put("entitltmentName",entitlementValueForViolatingEntitlement); emailVariables.put("entitltmentDesc",entDetails.get("EntitlementDescription")); if(violationTemplate!= null){ logger.debug("Violation temp loop"); Identity policyViolationApproverObject = approvalObject.getOwner(); if(null!=policyViolationApproverObject && ( Util.listToCsv(ObjectUtil.getEffectiveEmails(context,policyViolationApproverObject)) != null)){ approverEmails = Util.listToCsv(ObjectUtil.getEffectiveEmails(context,policyViolationApproverObject)); EmailOptions ops = new EmailOptions(approverEmails, emailVariables); try { context.sendEmailNotification(violationTemplate, ops); }catch(Exception e){ log.error("Could not send email to GS team as : " + e); } logger.debug("Email Sent "); } } } } } } } if(entitlementsTobeAddedToViolation != null && entitlementsTobeAddedToViolation.size() >0){ entitlementsTobeAddedToViolation.addAll(PIIEntitlementsToBeAddedToViolation) ; approvalObject.setArgument("ViolatingEntitlements",entitlementsTobeAddedToViolation ); context.saveObject(approvalObject); context.commitTransaction(); logger.debug("OBJECT persisted"); }else{ context.removeObject(approvalObject); context.commitTransaction(); logger.debug("OBJECT DELETED"); } logger.debug("End of workflow Step"); </Source> </Script> <Transition to="End"/> </Step> <Step icon="Stop" name="End" posX="160" posY="126"/> <Step icon="Start" name="Start" posX="28" posY="10"> <Transition to="Logs"/> </Step> </Workflow>
