How to set up JVM property for Log4j 2 in SailPoint?

# To fix the Log4j 2 vulnerability, we have to add -Dlog4j2.formatMsgLookups=true in catalina.sh and iiq file.

# Navigate to iiq path

cd /opt/apache/bin

# Update the JAVA options (vi iiq)

JAVA_OPTS="-Xms128m -Xmx256m -Dsun.lang.ClassLoader.allowArraySyntax=true -Djava.awt.headless=true -Dlog4j2.formatMsgLookups=true"

# Save & exit (:wq!)

# Navigate to catalina.sh path

 cd /opt/apache/webapps/idenityiq/WEB-INF/bin

# Update the JAVA options (vi catalina.sh)

rem Register custom URL handlers

rem Do this here so custom URL handles (specifically 'war:...') can be used in the security policy

set "JAVA_OPTS=%JAVA_OPTS% -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dlog4j2.formatMsgLookups=true"

# Save & exit (:wq!)

# Restart the server.

./shutdown.sh

./startup.sh

How to apply E-Fix in SailPoint?

# First copy the ZIP file to identityiq location.

# Check the ZIP file in identityiq whether it is copied or not.

# Extract the ZIP file.

# Update all jars

# Restart the server.

===============================################============================

# cp /home/sudo/idenityiq-8.1-8.1p3-IIQCB-4601.zip /opt/apache/webapps/identityiq

# cd /opt/apache/webapps/identityiq

# ls -ltr

# unzip idenityiq-8.1-8.1p3-IIQCB-4601.zip

# A (Shift+A)

# cd /opt/apache/bin

./shutdown.sh

./startup.sh

How to copy Jar/ZIP file from S3 bucket (AWS-EC2 instance) to Linux server?

# aws s3 cp s3://S3 Bucket Name/Jar File /home/Root User or Any user/

# aws s3 cp s3://iamdir-OIM-dev-vendorbinaries-s3/jd-gui-1.6.6.jar /home/sudo/

Adding extended attributes in Hibernate XML file

Ex:

1. Navigate to the following directory C:\Program Files\Apache Software Foundation\Tomcat 9.0\webapps\identityiq\WEB-INF\classes\sailpoint\object.

2. Add the following three lines in IdentityExtended.hbm.xml file

<property name="costCenter" type="string" length="450"                                           access="sailpoint.persistence.ExtendedPropertyAccessor" 

index="spt_identity_costCenter_ci"/>

<property name="empId" type="string" length="450"                                           access="sailpoint.persistence.ExtendedPropertyAccessor" 

index="spt_identity_empId_ci"/>

<property name="status" type="string" length="450"                                           access="sailpoint.persistence.ExtendedPropertyAccessor" 

index="spt_identity_status_ci"/>

How to find the number of workgroups and Identities in IIQ?

import sailpoint.object.Filter;

import sailpoint.object.QueryOptions;

QueryOptions qOptions = new QueryOptions();

qOptions.addFilter(Filter.eq("workgroup",false));

int numberOfIdentities = context.countObjects(Identity.class, qOptions);

QueryOptions qOptions = new QueryOptions();

qOptions.addFilter(Filter.eq("workgroup",true));

int numberOfWorkGroups = context.countObjects(Identity.class, qOptions);

String message = "No of identities : "+numberOfIdentities+" No of workgroups : "+numberOfWorkGroups;

log.debug("message : "+message);

Custom logger classes in IIQ?

 logger.WFLog.name=sailpoint.WorkflowTrace

logger.WFLog.level=trace

 logger.RoleLifecycler.name=sailpoint.api.RoleLifecycler

logger.RoleLifecycler.level=trace

 logger.Workflower.name=sailpoint.api.Workflower

logger.Workflower.level=trace

IIQ Console commands

# ./iiq console -j 

# Display the list of console commands:     help (or) ?

# Exit the from IIQ console:   quit

# Delete all identities except spadmin from the IIQ console: 

delete identity *  

delete identity XYZ

# Export a  single object from the IIQ console using the checkout command:

checkout workflow "Provisioning Approval Subprocess" workflow.xml -clean

# Run the task from the IIQ console using the run command: run "Mighty Run Rule Task"

# Export an object from the IIQ console:

export -clean /usr/binrootsh/Desktop/apps.xml application

# Display the "Test" rule object in XML: get rule TestRule

# list the object: list rule Test*

# To export a single object from the  IdentitytIq console to a file:    

checkout application "Time Tracking" /usr/binrootsh/Desktop/Clarity.xml -clean

# To export an object from the file to an  IdentitytIq console: 

import /usr/binrootsh/Desktop/timetracking.xml

# To run the rule from the IdentityIQ console, use the below command:

rule MightyPedia-Test /bpr/bprasad/LookupRuleArgs.xml

# The Version line lists the IdentityIQ version, patch version, and the build: about

 (./iiq console ---> about)

#  The connectorDebug command will iterate through all accounts for the application:    connectorDebug LDAP iterate 

#  The connectorDebug command will iterate through all groups for the application:    

connectorDebug LDAP iterate group 

# Rename the object

rename bundle "ABC" "XYZ"

rename > command, bundle > object, ABC > Old Role Name, XYZ > New Role Name

How to validate Entitlement in Entitlement Catalog?

 

import sailpoint.object.ManagedAttribute;

Boolean entitlementCheck(){

boolean existingEnt = false;

String appName = "SAP";

String entDN = "CN=abc, OU=Pedia, DC=com";

String cn = "Java";

String displayName = null;

Filter managedAttrFilter = Filter.eq("application.name", appName);

managedAttrFilter = Filter.and(managedAttrFilter, filter.eq("value", entDN));

ManagedAttribute managedAttribute = context.getUniueObject(ManagedAttribute.class, managedAttrFilter);

if(managedAttribute != null){

displayName = managedAttribute.getDisplayName();

if(displayName.equals(cn))

existingEnt= true;

}

return existingEnt;

}

How to build a Provisioning plan from Snapshot?

import org.apache.commons.logging.Log;

import org.apache.commons.logging.LogFactory;

import sailpoint.object.Filter;

import sailpoint.object.Identity;

import sailpoint.object.IdentitySnapshot;

import sailpoint.object.LinkSnapshot;

import sailpoint.object.ProvisioningPlan;

import sailpoint.object.ProvisioningPlan.AccountRequest;

import sailpoint.object.QueryOptions;

import sailpoint.tools.GeneralException;

 public List&lt;LinkSnapshot> getIdSnapshot(String identityName) throws GeneralException {

log.debug("Enter into the method : getIdSnapshot");

boolean checkSnapshot = false;

List&lt;LinkSnapshot> linkSnap = new ArrayList&lt;LinkSnapshot>();

QueryOptions qop = new QueryOptions();

qop.addFilter(Filter.eq("identityName", identityName));

qop.setOrderBy("created");

qop.setOrderAscending(false);

Iterator&lt;IdentitySnapshot> it = context.search(IdentitySnapshot.class, qop);

checkSnapshot = it.hasNext();

if (checkSnapshot) {

IdentitySnapshot eachIdentitySnapshot = (IdentitySnapshot) it.next();

linkSnap = eachIdentitySnapshot.getLinks();

}

log.debug("Exiting from the method : getIdSnapshot");

return linkSnap;

}

public ProvisioningPlan buildPlanFromSnapshot(String identityName) throws GeneralException {

log.debug("Enter into the method : buildFromSnapshot");

ProvisioningPlan plan = new ProvisioningPlan();

Identity identity = context.getObjectByName(Identity.class, identityName);

if (plan != null) {

plan.setIdentity(identity);

}

List&lt;LinkSnapshot> linkSnap = new ArrayList&lt;LinkSnapshot>();

linkSnap = getIdSnapshot(identityName);

for (LinkSnapshot ls : linkSnap) {

if (ls.getAttributes().get("IIQDisabled") == null

|| ls.getAttributes().get("IIQDisabled").toString().equals("false")) {

AccountRequest accountRequest = new AccountRequest();

accountRequest.setApplication(ls.getApplicationName());

accountRequest.setInstance(ls.getInstance());

accountRequest.setNativeIdentity(ls.getNativeIdentity());

accountRequest.setOperation(AccountRequest.Operation.Create);

plan.add(accountRequest);

}

}

log.debug("Link plan : " + plan.toXml());

log.debug("Exiting from the method : buildPlanFromSnapshot");

return plan;

}

LCM Provisioning

 Reference: Lifecycle Manager Workflows - Compass (sailpoint.com)

Workflow: LCM Provisioning

# Identity Request Initialize

                Identity Request Violation Review

                Do Provisioning Forms

        Manage Ticket

                Provision with retries

# Provisioning Approval Subprocess       

# Approve and Provision Subprocess

                Provisioning Approval Subprocess

                Manage Ticket

                        Provision with retries

                Identity Request Provision

                        Do Provisioning Forms

                        Provision with retries

                        Check Status of queued items

                Manage Ticket

                        Provision with retries

# Identity Request Notify

# Identity Request Finalize

                Manage Ticket

                        Provision with retries

How to remove Workgroups for the user?

import java.util.ArrayList;

import java.util.List;

import sailpoint.object.Identity;

import sailpoint.api.SailPointContext; 

import sailpoint.tools.GeneralException;

public void removeWorkGroupsAssignment(String name) throws GeneralException{

String methodName = "removeWprkGroupAssignment";

log.debug("Entering into the method : "+methodName);

Identity identityObj = context.getObject(Identity.class, name);

List&lt;Identity idWorkGroups = new ArrayList&lt;Identity>();

idWorkGroups = identityObj.getWorkgroups();

for(Identity workGoup : idWorkGroups){

identityObj.remove(workGoup);

context.saveObject(identityObj);

context.commitTansaction();

}

log.debug("Exiting from the method : "+methodName);

}