How to Call Task from TaskManager?

 import java.util.HashMap;

import java.util.Map;

import sailpoint.api.SailPointContext;

import sailpoint.api.TaskManager;

import sailpoint.object.Attributes;

import sailpoint.object.TaskDefinition;

import sailpoint.object.TaskResult;

import sailpoint.tools.GeneralException;

public class CallTask {

static SailPointContext context = null;

public static void main(String[] args) {

String taskName = "Test Rule";

Map map = new HashMap();

map.put("UserID", "000123");

Attributes attributes = new Attributes();

attributes.setMap(map);

try {

TaskManager taskManager = new TaskManager(context);

TaskDefinition taskDefinition = taskManager.getTaskDefinition(taskName);

TaskResult runWithResult = taskManager.runWithResult(taskDefinition, attributes);

runWithResult.getId();

} catch (GeneralException e) {

System.out.println("GeneralException: " + e.getMessage());

}

}

}

Custom Tasks

High Level Steps of developing Custom Tasks :-

1. Create TaskDefinition.xml file then import into IIQ

Note : Define a task definition with input and return arguments

2. Develop a Java code and place it in following path :

C:\Program Files\Apache Software Foundation\Tomcat 9.0\webapps\idenityiq\WEB-INF\classes\sailpoint

public class Demo extends AbstractTaskExecutor {

      public void execute(SailPointContext sailpointContext, TaskSchedule taskSchedule, TaskResult taskResult, Attributes args) throws Exception {

            String output = "output";

            String appName = (String) args.get("application");

            result.setAttribute(output, "This is Prasad Reddy" + appName);

      }

      public boolean terminate() {

            return false;

      }

NOTE : Create custom directory in above path then place the java file in custom directory.

3. Restart the application server (Apach Tomcat Server)

OOTB Tasks Purpose

The task types are:

# Account Aggregation — scan all applications, discover users and entitlements on those applications, and then correlate those users and entitlements with roles.

#Account Group Aggregation — scans applications and aggregates account groups and application object types. These are then used for group certification (either permissions or membership) or for displaying group information in identity certifications.

# Activity Aggregation — scan all applications, discover activity on the applications, and then correlate that activity with identity cubes. This enables you to track and monitor all activity for possible policy violations.

# Alert Aggregation — scan applications and aggregates alerts from a set of Alert Collectors. These are then used to generate alert actions.

# Alert Processor — process the aggregated alerts against the alert definitions and launch the appropriate action.

#Application Builder — create multiple IdentityIQ applications or update the attribute map of an existing IdentityIQ application.

# ArcSight Data Export — export data for HP ArcSight Database Connector to an external database table.

# Data Export — generate a de-normalized data report to export to an external database table.

# Effective Access Indexing — generate an index of any indirect access that was granted through another object. For example a nested group, an unstructured target, or another role.

# Encrypted Data Synchronization Task —re-encrypt data with user-generated encryption key.

# Entitlement Role Generator — scans the entitlements in the system and automatically generates a simple role and appropriates a profile for each one that it finds.

# FIM Application Creator — automatically discover and create FIM Management Agent Applications.

# IQService Public Key Exchange — change the public keys that are used for IQService communications

# ITIM Application Creator — inspect the IBM Tivoli Identity Manager (ITIM) and retrieve information about the ITIM services (applications). This task auto-generates an application for each service defined in ITIM. 

# Identity IQ Cloud Gateway Synchronization — Synchronize the specified objects to the Cloud Gateway.

# Identity Refresh — scan all applications, including the IdentityIQ application, to ensure that all identity information is up-to-date and accurate. Refresh identity scans are also used to detect and report on policy violations and trigger event certifications.

# Identity Request Maintenance — scan for completed Lifecycle Manager access requests.

# Missing Managed Entitlements Scan — scan the selected application to create entitlement objects for items added after the application was last aggregated

# Novell Application Creator — inspect the Novell IDM application and retrieve information about all connected applications.

# OIM Application Creator — inspect the OIM application and retrieve information about all connected applications.

# Policy Scan — runs policies against identity cubes and update identity score cards with any policy violations discovered.

# Propagate Role Changes — refreshes identities who have an assigned role whose associated entitlements have changed.

# Refresh Logical Accounts — is used to refresh composite accounts for all identities that could, potentially, have a composite account on the composite applications selected.

# Role Index Refresh — updates all role information and creates the indexes needed to perform role searches. You must run this task before performing any role searching.

#  Run Rule — runs the specified rule with name/value pairs.

# Sequential Task Launcher — launches the specified tasks in the order defined. This enables you to launch tasks that must be run sequentially in the proper order without having to schedule each separately based on estimated run times.

# "System Maintenance" — tasks designed to run in the background.

# Target Aggregation — scan selected applications for activity targets. 

Custom Tasks

 # Custom Tasks can be a powerful way to extend Sailpoint's functionality to perform certain actions that can't be achieved using default tasks or OOTB configurations.

# Custom tasks speeds up the process if the code is written accurately.

Steps to build custom task    :

1. Create a task definition

2. Create java class to define the method for custom task

3. Deploy the custom task and execute it

1. Create a task definition    

e.g :

Below information is Task Definition :

The task definition with required parameters (I/P and O/P) needs to be created first, which is required for the custom class java method which executes in background.

Login to Debug page, navigate to Object browser    --->    select  Task definition    ---> select appropriate task

<?xml version='1.0' encoding='UTF-8'?>

<!DOCTYPE TaskDefinition PUBLIC "sailpoint.dtd" "sailpoint.dtd">

<TaskDefinition executor="sailpoint.task.MultiAggregation" name="CustomMultiAggregation" 

progressInterval="5000" progressMode="String" template="true" resultAction="Delete" type="Generic">

  <Description>Task template for application group scanning</Description>

  <Signature>

    <Inputs>

      <Argument name="application" required="true" type="Application">

        <Prompt>Search Application</Prompt>

      </Argument>      

    </Inputs>

    <Returns>

      <Argument name="output" type="String">

        <Prompt>Result</Prompt>

      </Argument>

    </Returns>

  </Signature>

</TaskDefinition>

Task Definition Object    -    Explanation    :

# TaskDefinition executor ="sailpoint.custom.MutliAggregation" this defines the name of the class which will be execute the task>

# template="true"    -    template="true" is set to get the TaskDefinition listed in “New Task” List

# <Argument name="application" required="true" type="Application"> this defines the I/P parameter of the task. the custom java code MultiAggregation will take I/P parameters as "application" variable. The type="Application" will create a drop down for application. similarly you can have a type text for simple text I/P.

# <Prompt>Search Application</Prompt>  this defines the text which will be displayed in UI to the user.

# <Returns> <Argument name = "output" type="String"> this defines the output parameter, in the custom java code all output result will be passed to this output string.

2. Create java class to define the method for custom task

import sailpoint.api.SailPointContext;

import sailpoint.object.Attributes;

import sailpoint.object.TaskResult;

import sailpoint.object.TaskSchedule;

import sailpoint.AbstractTaskResult;

public class MultiAggregation extends AbstractTaskExecutor {

    public void execute (SailPointContext context, TaskSchedule tsch, TaskResult result, Attributes args) throws Exception {

            String output = "output";

            String appname = (String) args.get(application);

             result.setAttribute(output,"Custom task executed : " + appname);

             }

public boolean terminate(){

           return false;

    }

}

Execute :    

Terminate    : go to Task Results

While task is running we can terminate

NOTE :

AbstractTaskExecutor    -    class will override two methods i.e., execute () and terminate()

SailPointContext    -    starting point contains (identities, accounts and applications etc.,)

TaskSchedule    -    we can schedule task in code itself

TaskResult    -    we will set output in Sailpoint

Attributes    -    contain I/P parameters (HashMap in Scheduler (OIM))

3. Deploy the custom task

# To deploy the custom task, the TaskDefinition file needs to be imported into IIQ. This can be done in two ways.

1. Login to IIQ.

    Navigate to Global settings    --->    Import from file    --->    choose xml file    --->    click on import

2. From within IIQ console. use the import command    :    import ReportTask.xml

    IIQ console path    :    C:\Program Files\Apache Software Foundation\Tomcat 9.0\webapps\idenityiq\WEB-INF\bin\

# After importing the TaskDefinition, the java class file has to be placed in the appropriate location.

# The java class file needs to be placed in the classes.sailpoint.custom directory on the IIQ server.

   Finally the application server needs to be restarted (bounce the server) and the custom task is ready to execute

            

Refresh Identity Cube task :

The Refresh Task is critical to finalizing data on the Identity Cubes.

e.g :

# all entitlements are promoted from the Account Data to the Identity Cubes by the Refresh Task. 

# policy violations and risk scores are calculated by the Refresh Task.

Navigate to Setup     --->     Task     --->     Refresh Identity Cube 

From the following list, draw lines through the options that are not one of the defaults :

a. Refresh identity attributes (get to know more about : click on ? )

b. Refresh the identity risk scorecards

c. Check active policies

d. Process events

e. Refresh assigned, detected roles and promote additional entitlements

f. Refresh manager status

# Refresh identity attributes    :    

    Update identity attributes with any changes made to the attributes used to define identities.

# Refresh the identity risk scorecards    :    

    Update identity Risk scores with any information discovered by the scan performed by this task

# Check active policies    :    

    Scan for active policies and apply those policies to the identities included in the task

# Process events    :    

    Enable event certifications and lifecycle events.

    Use the snapshots created during the aggregation to approximate the previous state of the identities at the beginning of the refresh. This copied identity is compared to the updated identity to determine of event certifications or life cycle  events are lunched.

# Refresh assigned, detected roles and promote additional entitlements    :    

    Update any assigned or detected role assignments that have changes since the last time this task was run. Any additional entitlements found in the refresh will be promoted during the task.

# Refresh manager status    :

    Update all identity cubes in which  the manager status has changed. e.g : if a user was promoted to mange in their department, their identity cube would be updated by this task.

Explore the Refresh Identity Task    :

We will perform a Refresh on only identities who have an account on the Financials Application. 

We could configure a filter, a population, or a group to achieve our goal. 

We will use a filter string. (You will learn more about groups and populations in the next...) 

# We will use Advanced Analytics to provide the filter syntax.

    a. Navigate to Intelligence  Advanced Analytics. On the Identity Search tab, click

    Advanced Search

        

    b. Add a filter where Application is equal to Financials, and then click the link

    view/edit filter source.

        

    c. This is the filter syntax we will copy and paste into the filter constraint for the

    Refresh Identity Cube Task. Copy the filter string.

            

    d. Notice the term, “links”. In IdentityIQ, link is synonymous with account. The term

    link is typically used internally to the product, and the term account is typically used

    in the user interface. 

    e. Run the search. How many identities were returned? _________________

# Navigate to Setup ---> Tasks and under New Task use the arrow at the bottom to scroll.

   Choose Identity Refresh to create a new, blank Identity Refresh task.

             

# Name your task Refresh Financials Identities

# Paste the filter string into the input box titled Optional filter string to constrain the identities       refreshed.

            

# Select the default Identity Cube Refresh task options that you identified previously:

a. Refresh identity attributes

b. Refresh manager status

c. Refresh assigned, detected roles and promote additional entitlements

d. Refresh the identity risk scorecards

e. Check active policies

# Scroll to the bottom and click Save and Execute.

# Navigate to Setup ---> Tasks --> Task Results tab and confirm that the number of identities examined matches the number of identities from the search.