Fetch Roles based on Container Role Name

SELECT

    br.name         AS it_or_business_role_name,

    br.type           AS it_or_business_role_type,

    it.name          AS org_role_name,

    it.type            AS org_type

FROM identityiq.spt_bundle_children c

JOIN identityiq.spt_bundle it ON it.id = c.child

JOIN identityiq.spt_bundle br ON br.id = c.bundle

WHERE 

it.name = 'Pedia - IT - DPA Role';

=================================================================

import java.util.ArrayList;

import java.util.List;

import sailpoint.api.SailPointContext;

import sailpoint.object.Bundle;

import sailpoint.object.Filter;

import sailpoint.object.QueryOptions;

import sailpoint.tools.GeneralException; 

private static List getRolesBasedOnContainer(String container) {

List aList = null;

QueryOptions qo = null;

try {

aList = new ArrayList();

qo = new QueryOptions();

qo.add(Filter.eq("inheritance.name", container));

List<Bundle> objects = context.getObjects(Bundle.class, qo);

for (Bundle bundle : objects) {

aList.add(bundle.getName());

}

} catch (GeneralException e) {

System.out.println("GeneralException : " + e.getMessage());

}

return aList;

}

String container = "Pedia - IT - DPA Role";

List bundles = getRolesBasedOnContainer(container);

Bulk roles import from a CSV file..

Ref: Bulk import roles from a CSV file - Compass (sailpoint.com)

How to convert role from one role to another role?

//Conversion of role from one type to another type & making the roles into inheritance::: -

<?xml version='1.0' encoding='UTF-8'?>

<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">

<Rule language="beanshell"  name="Convert-Role">

  <Source>

  import sailpoint.object.Bundle;

  import sailpoint.object.Filter;

  import sailpoint.object.Identity;

  import sailpoint.object.QueryOptions;

  import sailpoint.tools.Util;

  import sailpoint.api.IncrementalObjectIterator;

  List  listofRoles = new ArrayList();

  Bundle container = context.getObjectByName(Bundle.class,"Legacy-Birthright-Roles");

  listofRoles.add(container);

  QueryOptions qo = new QueryOptions();

  qo.addFilter(Filter.eq("type", "IT"));

  //qo.addFilter(Filter.eq("name", "Contractor_BusinessRole"));

  IncrementalObjectIterator iterator = new IncrementalObjectIterator(context, Bundle.class,qo);

  while (iterator != null &amp;&amp; iterator.hasNext()) {

    Bundle bundle = iterator.next();

   // bundle.setType("birthright");

    bundle.setInheritance(listofRoles);

    context.saveObject(bundle);

    context.commitTransaction();

    context.decache();

  }

  Util.flushIterator(iterator);

  </Source>

</Rule>

Role Based Access Control (RBAC)

 Role    :

# Role defines a set of tasks that the user can perform

# Role is a collection of entitlements

Default Role Types:-

• Organizational Role
• Business Role
• IT Role
• Entitlement Role (Deprecated now)

Organizational Role:-

• An organizational Role is a container to hold the other types of roles
• Organizes roles in IIQ, easier to navigate different roles
• No functional importance other than giving a nesting structure to the other types of roles
• Other roles are inherited which makes the organizational role is a parent

Business Role:-

• Automatically assigned.
• Business  Roles are requested.
• It represents a job title or functions
• Business Roles are business-friendly role names i.e., Supervisor, Architect, Manager, Team Lead, Writer, Editor, Clerk, etc.,
• The business does not need to know the entitlements needed to get a Business Role
• Identities are associated with a Business Roles using "Assignment Logic" usually attributes or rules like department, job title, etc.,

IT Role:-

• IT Roles are not business-friendly names but IT department-friendly names
• It consists of entitlements from one or more applications (Defined groups of entitlements).
• Detected on identities.

Entitlement Role:-

• It represents a single entitlement on a single application
• It is deprecated in the new version of IIQ
• It is available only for backward compatibility but it's not recommended to create it now

How Roles are Associated to Identities:-

# Assigned Role i.e., Business Role

• Manually
• Assignment Rule

# Detected Role i.e., IT Role

• If all the entitlements of an IT Role are already assigned to an identity
• On refresh, IIQ will detect the IT Role the identity should have as it has already all the entitlements of that IT Role

# Assignment Rule    

• Associates identity with Business Role 
• Assignment logic can be written match list or filter or rule or script or population

# Required Roles    

• The IT Roles required for this Business Role

# Permitted Roles    

• The IT Roles which an identity can have but is not necessary to have
• Must be requested
• Not automatically provisioned

# Inherited Roles

• Select a parent role, this is just for view management and has no functional  importance

# Provisioning Policy

• Role Provision policy takes precedence (with regards to value, rules, and scripts of fields ) over Application provision policy
• By default, the fields of the Role provision policy form and Application provision policy form are merged to create a combined form for LCM provisioning
• To use only Role provisioning policy form, pass "noApplicationTemplates" = true as an argument in step calls compileProvisiongProject method

Configuration of RBAC:-

1. Login to IIQ and navigate to Setup then click on Roles

2. Navigate to New Role then click on Role (Type    ---> Organizational)

        

3. Provide the following details and click on submit (Type    --->    Organizational)

        

4. Navigate to New Role then click on Role (Type    --->     IT)

       

    

# Click on Modify Inheritance and select the TRAKK (Organizational Role) and click on Add then save

# Click on Add under Entitlements and select Application as PRISM and select groups under Add an Entitlement as Manager.

5. Navigate to New Role then click on Role (Type    --->     IT)

 

# Click on Modify Inheritance and select the TRAKK (Organizational Role)and click on Add then save

# Click on Add under Entitlements and select Application as PRISM and select groups under Add an Entitlement as Super.

  

6. Navigate to New Role then click on Role (Type    --->     Business )

# Select the Assignment Rule (Rule or Script or Match list or Filter or Population), Required Roles (IT Roles) and Inherited Roles (Organizational Role).

7. Navigate Setup and Tasks then search for Refresh Identity Cube then check the below options

• Processes assignment rule defined in the business role
• Detection defined through an IT Role profile

 

# Click on Save and Execute