Logs

import org.apache.commons.logging.Log;

import org.apache.commons.logging.LogFactory;

Log log = LogFactory.getLog("mighty.rule.TestLoggers");

log.info("Hi");

log.debug("Hello");

log.trace("Dear");

log.error("Something serious");

Note: Log naming convention is project.objectType.Unique Identifier

Bulk roles import from a CSV file..

Ref: Bulk import roles from a CSV file - Compass (sailpoint.com)

Workflow Libraries

  What is a workflow library?

• Workflow Libraries are sets of compiled Java methods accessible to workflows.

What are the workflow default libraries?

• Identity
• Role
• PolicyViolation
• LCM libraries

IdentityLibrary: This is used to

• getManager()
• activate, de-activate role assignment
• Refresh Identities
• Compiling Provisioning plan
• Build, Assimilate Provisioning Forms
• Auditing etc.,

IdentityRequestLibrary: This is used to

• Create Identity Request, update Identity Request state
• Refresh Identity Request afterApproval and Provisioning etc.,

ApprovalLibrary: This is used to

• Get Object(Approval) owner and name
• Get NewObject(Approval) owner and name
• Checks whether it's a self-Approval or not etc.,

Policy Violation Library: This is used to

• Get the remediateViolation: Remediate SOD violations by removing roles named in the remediations argument.
• Delete the current approval object associated with this workflow.

Role Library: This is used to invoke the methods

• Enable the role
• Disable the role
• buildOwnerApproval

LCM Library: All the methods are moved to a handler

• audit
• addLaunchMessage
• Commit

Sailpoint provided the following rule libraries:

Workflow Library: This is mostly used to get the properties of an identity

which are like displayName, email, managerName, managerEmail, and getting

value of a system configuration property.

LCM Workflow Library: This is used for assimilating WorkItem

ApprovalSet, performs auditing for actions like forward, comment on workItem

and for filtering ApprovalSet.

Approval Library: This is used for getting a list of Approval owners, Role

owner, manager from a provisioning plan, etc.,

LCM Top-Level Workflows

The following workflows are default LCM workflows:

1. LCM Provisioning
2. LCM Manage Passwords
3. LCM Create and Update
4. LCM Registration

 

Reference URL's

 IdentityIQ 8.3 Overview (sailpoint.com)

IdentityIQ Best Practices - Compass (sailpoint.com)

Sequence of Aggregation Rules

• Pre-Iterate Rule
• BuildMap Rule
• Managed Entitlement Customization Rule
• Customization rule
• Correlation rule
• Manager correlation rule
• Creation rule
• PostIterate Rule

Developer Best Practices

 Use independent libraries and workflows:

• Write code consistent with best practices

Use independent libraries and workflows:

The best way to avoid issues introduced into common code changes up to the extent possible, instead of introducing your changes directly into a common code source (such as BPK workflow library, BPK Rule library) try to create independent code libraries and sub-process and reference them in common code

Write code consistent with best practices

• Code quality is particularly important because there is a good chance to someone in the future will need to understand it without prior context. Here are some high-level guidelines:

• Follow standard Java conventions and standards

• Use proper indentation

• Comment your code thoroughly

A good rule of thumb is to give high-level comments on what each code block is doing and then comment on anything unusual that you do.

• Write code that is clear and easy to understand

Write your code in a way that is easy to follow logically and consistent with the way you are writing it.

• Keep code performance efficient

• Create or update existing documentation where appropriate

• The code should be reviewed by the team and keep the proper logs statements.

Developer Best Practices:

1. Use proper naming conversation for all variable declarations.

eg: 'Identity idnRequester' or 'int intIdentityCount'.

2. Any connection objects (e.g., database, File, server) must be closed in the final block.

try{

conn= DriverManager.getConnection("");

}

catch(SQLException ex){

handle the exception or throw as a general exception

}

finally{

try{

if(conn !=null){

conn.close();

}

}catch(){

}

}

3. while throwing the exception, wrap with GeneralException along with information causing an exception.

ex: catch(){

throw new GeneralException("occurred while loading the entitlement data",e);

}

4. Don't log for throwing the exception in the catch block, it results in duplicate logs in the log file for the same exception.

ex: catch(illegalArgumentException e){

//log.error(e); do not do this

throw new GeneralException("occurred while loading the entitlement data",e);

}

5. Always check for the Null object while accessing any object.

ex: Identity id= context.getObjectByName(Identity.class,"test");

if( null ==id){

log.error("no identity found);

return ;

}

6. Check for void if you are accessing out of boxes variables in any rules, workflows forms, etc.

7. Check for object instances if you need more clarification on the run time object.( instanceof List or instanceof String).

8. Try to avoid logic in workflow steps, call as a method from a rule.

9. Try to avoid saving complete objects in workflow parameters until it is really required.

10. Make sure while deploying the code in production the trace parameter is set to false.

11. Do not print complete objects as info or error. do it in debug.

12. Be a practice of using separate logger objects for each rule.

eg: Logger log= Logger.getLogger("");

13. Always use context.search with specific columns while loading data.

14. Avoid using IIQ objects as variable names.

15. Flush the iterator once it is done with the logic. This will release the cursor object related to the database.

ex: Util.flushIterator(itername);

16. Decache the loaded objects once done with the operation.

context.decache(obj name);

17. Default imports for bean shells. Do not add imports explicitly.

java.net.*;

java.lang.*;

java.util.*;

18. Do not print passwords in logs, put password generation in before the provisioning rule and try to implement encrypt mechanism.

19.Do not log any "sailpoint object data "(Ex.log.debug(plan.toXml()), log.debug(project.toXml()).

20. Do not log any authentication token at any level.

21. If you are referring to any rule in your new rule, refer to all the rules references of the parent rule as well.

Compass Useful Links

 Reference:-

Quartz Enterprise Job Scheduler (quartz-scheduler.org)

Rapid Setup:

Rapid Setup Migration Guide - Compass (sailpoint.com)

https://www.sailpoint.com/university/training-paths/identityiq/?

Global Manager Attribute Rule

 if(identity != null @and identity.getManager() != null){

return identity.getManager();

} else{

return oldValue;

}

LCM Provisioning

 Reference: 

Lifecycle Manager Workflows - Compass (sailpoint.com)

LCM Subprocess Workflows - Compass (sailpoint.com)

Identity Blog URL:-

# 

https://community.sailpoint.com/t5/IdentityIQ-Blog/bg-p/IIQ_blog

EFix URL:-

#

https://community.sailpoint.com/t5/IdentityIQ-Blog/IdentityIQ-log4j-Remote-Code-Execution-Vulnerability/ba-p/206681?elq=46e7bafd65ca4860965690f2a5d3da35&elqCampaignId=4118&elqTrackId=757e1b94243c4dbc97f78764f0daecff&elqaid=5155&elqat=1&utm_medium=email&utm_source=Eloqua

#

https://community.sailpoint.com/t5/IdentityIQ-Blog/Identity-Forwarding-Vulnerability/ba-p/226246

#

https://community.sailpoint.com/t5/IdentityIQ-Blog/IdentityIQ-JavaServer-Faces-File-Path-Traversal-Vulnerability/ba-p/227148