DUO Application On-boarding

# Login to SailPoint.

# Navigate to Applications ---> Application Definition

# Select the Application Type as DUO and provide the required details.

# Navigate to Settings, provide the Duo Connection Credentials and Integration Credentials.

# Navigate to Schema, configure Account and Group object.

# Navigate to correlation and configure the attribute-based account correlation.

Ex: username -->bprLogin 

# Test the connection and preview the accounts

# Save

Note: 

Difference between the DUO Connection Credentials & DUO Integration Credentials :

DUO Connection Credentials : To read the accounts

DUO Integration Credentials  : To integrate with DUo mobile application

 

How to check Log4j version in SailPoint using rule?

 <?xml version='1.0' encoding='UTF-8'?>

<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">

<Rule created="1640624033221" id="ff8080817dee757a017dfcd00dc503e0" language="beanshell" name="Log4j 2 version">

  <Signature>

    <Inputs>

      <Argument name="log">

        <Description>`

          The log object is associated with the SailPointContext.

        </Description>

      </Argument>

      <Argument name="context">

        <Description>

          A sailpoint.api.SailPointContext object that can be used to query the database if necessary.

        </Description>

      </Argument>

    </Inputs>

  </Signature>

  <Source>

  String version = org.apache.logging.log4j.util.PropertiesUtil.class.getPackage().getImplementationVersion();

    return version;

  </Source>

</Rule>

Classic Ports to know

# 22 = SSH (Secure Shell) - log  into a Linux instance

# 21 = FTP (File Transfer Protocol)

# 22 = SFTP (Secure File Transfer Protocol) upload files using SSH

# 80 = HTTP - access unsecured websites

# 443 = HTTPS - access secured websites

# 3389 = RDP (Remote Desktop Protocol) - log into a windows instance

How to set up JVM property for Log4j 2 in SailPoint?

# To fix the Log4j 2 vulnerability, we have to add -Dlog4j2.formatMsgLookups=true in catalina.sh and iiq file.

# Navigate to iiq path

cd /opt/apache/bin

# Update the JAVA options (vi iiq)

JAVA_OPTS="-Xms128m -Xmx256m -Dsun.lang.ClassLoader.allowArraySyntax=true -Djava.awt.headless=true -Dlog4j2.formatMsgLookups=true"

# Save & exit (:wq!)

# Navigate to catalina.sh path

 cd /opt/apache/webapps/idenityiq/WEB-INF/bin

# Update the JAVA options (vi catalina.sh)

rem Register custom URL handlers

rem Do this here so custom URL handles (specifically 'war:...') can be used in the security policy

set "JAVA_OPTS=%JAVA_OPTS% -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dlog4j2.formatMsgLookups=true"

# Save & exit (:wq!)

# Restart the server.

./shutdown.sh

./startup.sh

How to apply E-Fix in SailPoint?

# First copy the ZIP file to identityiq location.

# Check the ZIP file in identityiq whether it is copied or not.

# Extract the ZIP file.

# Update all jars

# Restart the server.

===============================################============================

# cp /home/sudo/idenityiq-8.1-8.1p3-IIQCB-4601.zip /opt/apache/webapps/identityiq

# cd /opt/apache/webapps/identityiq

# ls -ltr

# unzip idenityiq-8.1-8.1p3-IIQCB-4601.zip

# A (Shift+A)

# cd /opt/apache/bin

./shutdown.sh

./startup.sh

How to copy Jar/ZIP file from S3 bucket (AWS-EC2 instance) to Linux server?

# aws s3 cp s3://S3 Bucket Name/Jar File /home/Root User or Any user/

# aws s3 cp s3://iamdir-OIM-dev-vendorbinaries-s3/jd-gui-1.6.6.jar /home/sudo/

Adding extended attributes in Hibernate XML file

Ex:

1. Navigate to the following directory C:\Program Files\Apache Software Foundation\Tomcat 9.0\webapps\identityiq\WEB-INF\classes\sailpoint\object.

2. Add the following three lines in IdentityExtended.hbm.xml file

<property name="costCenter" type="string" length="450"                                           access="sailpoint.persistence.ExtendedPropertyAccessor" 

index="spt_identity_costCenter_ci"/>

<property name="empId" type="string" length="450"                                           access="sailpoint.persistence.ExtendedPropertyAccessor" 

index="spt_identity_empId_ci"/>

<property name="status" type="string" length="450"                                           access="sailpoint.persistence.ExtendedPropertyAccessor" 

index="spt_identity_status_ci"/>

How to find the number of workgroups and Identities in IIQ?

import sailpoint.object.Filter;

import sailpoint.object.QueryOptions;

QueryOptions qOptions = new QueryOptions();

qOptions.addFilter(Filter.eq("workgroup",false));

int numberOfIdentities = context.countObjects(Identity.class, qOptions);

QueryOptions qOptions = new QueryOptions();

qOptions.addFilter(Filter.eq("workgroup",true));

int numberOfWorkGroups = context.countObjects(Identity.class, qOptions);

String message = "No of identities : "+numberOfIdentities+" No of workgroups : "+numberOfWorkGroups;

log.debug("message : "+message);

Custom logger classes in IIQ?

 logger.WFLog.name=sailpoint.WorkflowTrace

logger.WFLog.level=trace

 logger.RoleLifecycler.name=sailpoint.api.RoleLifecycler

logger.RoleLifecycler.level=trace

 logger.Workflower.name=sailpoint.api.Workflower

logger.Workflower.level=trace

IIQ Console commands

# ./iiq console -j 

# Display the list of console commands:     help (or) ?

# Exit the from IIQ console:   quit

# Delete all identities except spadmin from the IIQ console: 

delete identity *  

delete identity XYZ

# Export a  single object from the IIQ console using the checkout command:

checkout workflow "Provisioning Approval Subprocess" workflow.xml -clean

# Run the task from the IIQ console using the run command: run "Mighty Run Rule Task"

# Export an object from the IIQ console:

export -clean /usr/binrootsh/Desktop/apps.xml application

# Display the "Test" rule object in XML: get rule TestRule

# list the object: list rule Test*

# To export a single object from the  IdentitytIq console to a file:    

checkout application "Time Tracking" /usr/binrootsh/Desktop/Clarity.xml -clean

# To export an object from the file to an  IdentitytIq console: 

import /usr/binrootsh/Desktop/timetracking.xml

# To run the rule from the IdentityIQ console, use the below command:

rule MightyPedia-Test /bpr/bprasad/LookupRuleArgs.xml

# The Version line lists the IdentityIQ version, patch version, and the build: about

 (./iiq console ---> about)

#  The connectorDebug command will iterate through all accounts for the application:    connectorDebug LDAP iterate 

#  The connectorDebug command will iterate through all groups for the application:    

connectorDebug LDAP iterate group 

# Rename the object

rename bundle "ABC" "XYZ"

rename > command, bundle > object, ABC > Old Role Name, XYZ > New Role Name

How to validate Entitlement in Entitlement Catalog?

 

import sailpoint.object.ManagedAttribute;

Boolean entitlementCheck(){

boolean existingEnt = false;

String appName = "SAP";

String entDN = "CN=abc, OU=Pedia, DC=com";

String cn = "Java";

String displayName = null;

Filter managedAttrFilter = Filter.eq("application.name", appName);

managedAttrFilter = Filter.and(managedAttrFilter, filter.eq("value", entDN));

ManagedAttribute managedAttribute = context.getUniueObject(ManagedAttribute.class, managedAttrFilter);

if(managedAttribute != null){

displayName = managedAttribute.getDisplayName();

if(displayName.equals(cn))

existingEnt= true;

}

return existingEnt;

}