Customize Approval message through Build Approval Set

 To add custom messages in Approvals, we can add it through Build Approval Set variable in Workflow.

Requirement:

Add a rule in the Build Approval Set variable.

The message that is displayed is item.setValue(). 

Below Rule is added to the Build Approval Set. 

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Rule created="" id="" language="beanshell" modified="" name="Plugin Build Identity ApprovalSet" type="Workflow">
  <Description>Build Identity ApprovalSet for request coming from vendor contract extension plugin</Description>
  <Signature returnType="Object"/>
  <Source>import sailpoint.object.ProvisioningPlan;
      import sailpoint.object.ProvisioningPlan.AttributeRequest;
      import sailpoint.object.ProvisioningPlan.AccountRequest;
      import sailpoint.object.ApprovalSet;
      import sailpoint.object.ApprovalItem;
      import sailpoint.object.Attributes;
      import sailpoint.tools.Util;
  import java.util.Date;
  import java.text.SimpleDateFormat;
      
      serilog=org.apache.commons.logging.LogFactory.getLog("sailpoint.services.rules.workflow.PluginBuildIdentityApprovalSet");
  serilog.debug("--------------------------------------------------");
      serilog.debug(plan.toXml());
      ApprovalSet set = new ApprovalSet();
if ( plan != null ) {
          List accountRequests = plan.getAccountRequests();
          for ( AccountRequest request : accountRequests ) {
              ApprovalItem item = new ApprovalItem();
              item.setApplication(request.getApplication());
              item.setInstance(request.getInstance());
              item.setNativeIdentity(request.getNativeIdentity());
              item.setOperation(request.getOperation().toString());
              List attrRequestFlat = flattenAttributeRequests(request.getAttributeRequests());
           
 
            if( pluginAction.equalsIgnoreCase("vendor-contract-extension")) {
          
              String contractExtensionComments = "Request to extend the vendor contract for "+ identityDisplayName + " from "+ currentEndDate + " to " + extensionDate; 
              item.setValue(contractExtensionComments);
            
            } else if( pluginAction.equalsIgnoreCase("vendor-disable")) {
              
              SimpleDateFormat simpleDateFormat = new SimpleDateFormat("yyyy-MM-dd");
    String date = simpleDateFormat.format(terminationDate);
              String disableComments = "Request to disable the vendor "+ identityDisplayName + " with Termination Date set to " + date; 
              item.setValue(disableComments);
            
            }else if( attrRequestFlat != null ) {
                  item.setValue(attrRequestFlat);
              } 
              Attributes attributes = getAttributeRequestArguments(request.getAttributeRequests());
              item.setAttributes(attributes);
              
              // for these requests comments come in on the plan
              String comments = plan.getComments();
              if ( Util.getString(comments) != null ) {
                  item.setRequesterComments(comments);
              }
              set.add(item);
          }
          // while we are here lets annotate the plan with previousValues
          if ( flow.equals("IdentityEditRequest") ) {
              AccountRequest iiqRequest = plan.getAccountRequest("IIQ");    
              if ( iiqRequest != null ) {
                  List attributeRequests = iiqRequest.getAttributeRequests();
                  if ( Util.size(attributeRequests) > 0 ) {
                      Identity id = context.getObject(Identity.class, identityName);
                      if ( id != null )  {
                          for ( AttributeRequest req : attributeRequests ) {
                              String name = req.getName();
                              if ( name != null ) {
                                  // We have to be carefull here, if we see manager display
                                  // the displayName
                                  Object prevValue = id.getAttribute(name);
                                  if ( prevValue != null ) {
                                      if (name.equals("manager") ) {
                                          String displayName = getIdentityProperty((String)prevValue, "displayName");
                                          if ( displayName != null ) {
                                              prevValue = displayName;
                                          }
                                      }
                                      else if (prevValue instanceof Identity) {
                                          prevValue = (String)prevValue.getDisplayableName();
                                      }
                                      else  if(prevValue instanceof List) {
                                          /* Thanks to type erasure there is no way for us to write something like
                                           * prevValue instanceof List&amp;lt;Identity> so break it into steps.  Check if
                                           * prevValue is a List.  If it has any elements get the first one. If that
                                           * is an instance of Identity then assume the rest of the elements are too
                                           * and then build a List of displayable names, because that is what we do
                                           * with Identitys. */
                                          List prevValueList = (List) prevValue;
                                          if(prevValueList.size() > 0) {
                                              if(prevValueList.get(0) instanceof Identity) {
                                                  List identityIds = new ArrayList(prevValueList.size());
                                                  for (Object value : prevValueList) {
                                                      Identity identity = (Identity) value;
                                                      identityIds.add(identity.getDisplayableName());
                                                  }
                                                  prevValue = identityIds;
                                              }
                                          }
                                      }
                                      req.put(ProvisioningPlan.ARG_PREVIOUS_VALUE, prevValue);
                                  }
                              }
                          }
                      }
                  }
              }
          }
      }
      return set;</Source>
</Rule>

SailPoint approval scheme for different events

 We can use a script in approvalScheme variable in workflow and return different values based on our requirement. 

<Variable input="true" name="approvalScheme">
    <Description>
      A String that specifies how approvals should be generated for
      this workflow there are three built-in modes
      none - disabled approvals
      manager - The user's current manager will get approvals
      newManager - The newly assigned manager will get approvals when
      manager transfers occur. Otherwise the user's manager
      current manager will be the approver.
    </Description>
    <Script>
      <Source>
        import org.apache.log4j.Logger;
        import org.apache.log4j.Level;
        private static Logger logger = Logger.getLogger("sailpoint.services.transfer");
        logger.setLevel(Level.DEBUG);
        if("Vendor Manager Transfer".equalsIgnoreCase(eventType) || "Vendor Enable".equalsIgnoreCase(eventType))
        {
if(managerStatus)
{
logger.error("managerStatus"+managerStatus);
return "newManager";
}
else {
logger.error("else block of mgrtransfer::"+managerStatus);
return "manager"+","+"newManager";
}
        }
        else if("Vendor Create".equalsIgnoreCase(eventType))
        {
logger.debug("Create Vendor::"+eventType);
return "manager";
        }
        else if("DeletePRVAccount".equalsIgnoreCase(eventType))
        {
logger.debug("Create Vendor::"+eventType);
return "manager";
        }
        else if("Create Privilaged Account".equalsIgnoreCase(eventType))
        {
logger.debug("Create Vendor::"+eventType);
return "manager";
        }
        else
        {
logger.error("else block::"+managerStatus);
return "manager"+","+"newManager";
        }
      </Source>
    </Script>
  </Variable> 

Code to update provisioning plan to remove the "Remove entitlement requests" from the provisioning plan

 Requirement: The function takes three inputs ProvisioningPlan, application name and the list entitlements that shouldn't be removed from the user. (This funtion can be used as a part of Mover workflow where a set of entitlements must not be removed from the user after provisioning due to mover event).

public ProvisioningPlan removeADGroupRemoveRequest(ProvisioningPlan plan, String appName, List<String> groups) {

log.debug("Entered removeADGroupRemoveRequest");

// Define a new ProvisioningPlan

ProvisioningPlan newplan = new ProvisioningPlan();

List<AccountRequest> newAccountRequests = null; 

sailpoint.object.ProvisioningPlan.AccountRequest.Operation operation = null;

// Get the account requests

List<AccountRequest> accountRequests = plan.getAccountRequests();

if (accountRequests.size()>=0) {

// Iterate for every accountRequest

for (AccountRequest accountRequest : accountRequests) {

operation = accountRequest.getOperation();

String applicationName = accountRequest.getApplicationName();

//check if the application name of the accountRequest is same as the incoming appName

if(applicationName.equalsIgnoreCase(appName)) {

log.debug("Operation for Account Request: "+operation);

if(operation.equals(AccountRequest.Operation.Modify)) {

// Get attribute requests from the accountRequest

List<AttributeRequest> attributeRequests = accountRequest.getAttributeRequests();

if(attributeRequests.size()>0) {

for(AttributeRequest attributeRequest : attributeRequests) {

String name = attributeRequest.getName();

Object value = attributeRequest.getValue();

ProvisioningPlan.Operation oper = attributeRequest.getOp();

if(name!=null)

{

if(name.equalsIgnoreCase("memberOf")) {

if(attributeRequest.getOperation().equals(ProvisioningPlan.Operation.Remove)) {

log.debug("Remove entitlement operation entered");

String entValue = (String)value;

if(groups.contains(entValue)){

// remove the attribute request from account request

accountRequest.remove(attributeRequest);

}

}

}

}

}

}

}

}

//adding all the accountRequests to the newAccountRequests list

newAccountRequests.add(accountRequest);

}

  }

//add the newAccountRequests to the newplan and return newplan

newplan.setAccountRequests(newAccountRequests);

return newplan;

}

Comment below if you find this post helpful.

Quicklink to display the list of users who are expiring in next 14 days

 Requirement: Develop a Quicklink, once we click on it, return the list of users who are expiring in next 14 days.

1. Create a quicklink category. Import the below file into Sailpoint to create quicklink category. 

https://drive.google.com/file/d/1JzGYxpY_4BDZn2MZyKbRy22MNwt-hHN3/view?usp=sharing

2. Create a workflow quick link. Import the below file into Sailpoint to create quicklink.

https://drive.google.com/file/d/15_2GVWHXmHQcUQ44FYoeGGPKVUuJcBqm/view?usp=sharing

3.  Create a workflow and add a form in it. Add a field in the form and add a rule for the field which returns the users who are expiring in next 14 days.

Import the below workflow into Sailpoint.

https://drive.google.com/file/d/13fdQcrH2HAiS44anmA0sLXB2Z-DZ5uX4/view?usp=sharing 

Note: The rule is written with keeping below points in mind:

1. The user expiry is known from the Application attribute 'lastLogOn' of "HR System - Employees" application

2. The date format of 'lastLogOn' is in LDAP millisecond.

3. Convert the LDAP millisecond date to normal date and them compare it with current date. If the difference is <= 14 days, return the Identity Name.

Import the below Rule into Sailpoint.

https://drive.google.com/file/d/1DBZbhQVYw0Yt69Mrwejjuo6MsFY6p5aq/view?usp=sharing

Comment below if you find this post helpful.

Email Template to send success message for Joiner

 Sample Email template to send success message for Joiner. Download here:

https://drive.google.com/file/d/1Rgp3Pid_rWKRp9RxOsV8vysX6VX3ULtC/view?usp=sharing

Update the logo by convert the image to base64 encoded https://www.base64encode.org/ and replace in the email template.

Comment below if you find this post helpful.

Defining Multi-level approval process

 Defining approvals in a generic way based on a custom object. The custom object contains the type of provisioning request, application details and the approvers details. 
The approval assignment rule is written to trigger the approvals based on the approvers in the custom object. 

Requirement:

If the user request for Entitlement to be added, for Active Directory the approvals has to go 3 approvers in serial manner. 
1. Manager
2. Security Admin (Work group)
3. IT Team (Work group)

For Oracle ERP application, the approval has to go only to manager (single approver). And approvals are not required for removal of Entitlements.
For Account Request and Role Request, the approval has to go to manager.

Process:

Step 1: Import the below custom object into SailPoint. The custom object file contains the Provisioning request type, application details and the corresponding approvers.

https://drive.google.com/file/d/1bSNQLHcGacz3h01hEplsntHwZZaZL3zE/view?usp=sharing

Step 2: Import the Approval assignment rule into SailPoint. The Approval assignment rule contains the actual logic to trigger the approvals with the details from the custom object.

https://drive.google.com/file/d/1jgyNH62v6oM5FgFdY8EF3cXG91wWjonN/view?usp=sharing

Step 3: Edit the LCM Provisioning Workflow and provide the name of imported assignment rule in argument approvalAssignmentRule for the sub processes Split provisioning and Approve and Provision.

step 4: Make sure approval mode = serial and approvalScheme = Identity.

Request for Entitlements and the approvals are triggered as defined in the custom object mappings.

Comment below if you find this post helpful.

Trigger a Life cycle event for Active Directory users who did not login for last 90 days

 Requirement is to trigger an event for Active Directory users who are terminated and did not login for past 90 days.

Go to setup --> Lifecycle Events --> Add New Lifecycle Event.  
Enter the Name, Desription. Select Event type as Rule. 

Use the below code for the Rule:
if(newIdentity!=null){
return true;
}else{
return false;
}

Or you can import the below IdentityTrigger Rule and use it.

https://drive.google.com/file/d/1gb2rEPLFa-UVYg2wOjlan3nE3bPwTKlN/view?usp=sharing

Select Included Identities as Rule. Use the below code for the Rule:

import sailpoint.object.Identity;
import sailpoint.api.IdentityService;
import sailpoint.object.Link;
import sailpoint.object.Attributes;
import sailpoint.object.Application;
import java.util.Calendar;
import java.util.Date;
import java.text.SimpleDateFormat;
log.error("Identity Selector Rule Triggered : " + identity.getName());
// get the application link for Active Directory
IdentityService identityService = new IdentityService(context);
Application app = context.getObjectByName(Application.class, "HR System - Employees");
List links = identityService.getLinks(identity, app);
if(!links.isEmpty()){
Link link = links.get(0);
if(link!=null){
String applicationName = link.getApplicationName();
log.error("Application Name: " + applicationName);
Attributes attributes = link.getAttributes();
if(attributes!=null){

String lastLogOn = attributes.getString("lastLogOn");
String userAccountControl = attributes.getString("userAccountControl");
if(lastLogOn != null &amp;&amp; userAccountControl != null) {
// convert from millisecond to date format
Date currentDate=new Date();
        Long diffForDateAndTime = 11644473600000L;
        Long adDate = Long.parseLong(lastLogOn);
        Long epochTime = (adDate / 10000) - diffForDateAndTime;
        Date lastLogOnDate = new Date (epochTime);
        log.error("lastLogOnDate: " + lastLogOnDate);
        
        //calucalate the diff b/w today to lastLogOn date
        int diffInDays = (int) ((currentDate.getTime() - lastLogOnDate.getTime()) / (1000*60*60*24));
        log.error("diffInDays: " + diffInDays);
        //Event generation condition
        if(diffInDays>90 &amp;&amp; userAccountControl.equalsIgnoreCase("514")){
        // log.error("**************   Returning True *******************");
                                    return true;
                                             }
}
}
}
}
return false;

Or you can import the below IdentitySelector Rule and use it.

https://drive.google.com/file/d/1z-Sfva6ef-TTvFxFhA8T9A3_zJ41lAZq/view?usp=sharing

Run the refresh identity cube task with Process Events enabled. You can see the events are generated for the users that are inactive and not login into AD for last 90 days.

Currently only the events are triggered, but no action is performed. Add a Business process to delete the users.