Labels
- AD (8)
- Aggregation (8)
- Audit Management (1)
- AWS (1)
- Certification (7)
- Compass_Useful_Links (1)
- Courses (1)
- Custom Reports (3)
- Custom Tasks (5)
- Database (OIM) (3)
- Database (Sailpoint) (2)
- E-Fix (3)
- Eclipse (2)
- EmailTemplate (1)
- Excel (7)
- Forgerock (1)
- Forms (4)
- GitHub (6)
- Group Management (3)
- IIQ Console Commands (1)
- IQ Service (1)
- ISC (22)
- ISC Application Management (3)
- ISC-LifeCycleState (1)
- ISC-Transforms (1)
- ISC-VSCode (1)
- Java (13)
- JML (1)
- Kanada (1)
- LCM (4)
- Linux (3)
- Loggers (3)
- MS Office (1)
- MySQL (8)
- Notifications (1)
- OIM (19)
- Password Management (2)
- Policy Violation (2)
- Provisioning (1)
- ProvisioningPlan (1)
- Quicklink (1)
- RBAC (4)
- References (1)
- Role Management (3)
- Rules_Scripts_APIs (33)
- Sailpoint (34)
- SailPoint - Certification (1)
- SailPoint - Glossary (2)
- Sailpoint API's (7)
- SailPoint Best Practices (1)
- Scripts (1)
- Softwares (1)
- SSB (2)
- UAT (1)
- UI (2)
- UI/Task Server Configuration (1)
- Upgradation (1)
- VM Ware (1)
- Web Service (9)
- Workflow (8)
- Workgroup (2)
- XML (1)
Wednesday, August 9, 2023
Username Generation
Logs
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
Log log = LogFactory.getLog("mighty.rule.TestLoggers");
log.info("Hi");
log.debug("Hello");
log.trace("Dear");
log.error("Something serious");
Note: Log naming convention is project.objectType.Unique Identifier
Sunday, August 6, 2023
Workflow Libraries
What is a workflow library?
- Workflow Libraries are sets of compiled Java methods accessible to workflows.
- Identity
- Role
- PolicyViolation
- LCM libraries
- getManager()
- activate, de-activate role assignment
- Refresh Identities
- Compiling Provisioning plan
- Build, Assimilate Provisioning Forms
- Auditing etc.,
- Create Identity Request, update Identity Request state
- Refresh Identity Request afterApproval and Provisioning etc.,
- Get Object(Approval) owner and name
- Get NewObject(Approval) owner and name
- Checks whether it's a self-Approval or not etc.,
- Get the remediateViolation: Remediate SOD violations by removing roles named in the remediations argument.
- Delete the current approval object associated with this workflow.
- Enable the role
- Disable the role
- buildOwnerApproval
- audit
- addLaunchMessage
- Commit
LCM Top-Level Workflows
The following workflows are default LCM workflows:
- LCM Provisioning
- LCM Manage Passwords
- LCM Create and Update
- LCM Registration
Friday, August 4, 2023
Sequence of Aggregation Rules
- Pre-Iterate Rule
- BuildMap Rule
- Managed Entitlement Customization Rule
- Customization rule
- Correlation rule
- Manager correlation rule
- Creation rule
- PostIterate Rule
Sunday, July 2, 2023
Developer Best Practices
Use independent libraries and workflows:
• Write code consistent with best practices
Use independent libraries and workflows:
The best way to avoid issues introduced into common code changes up to the extent possible, instead of introducing your changes directly into a common code source (such as BPK workflow library, BPK Rule library) try to create independent code libraries and sub-process and reference them in common code
Write code consistent with best practices
• Code quality is particularly important because there is a good chance to someone in the future will need to understand it without prior context. Here are some high-level guidelines:
• Follow standard Java conventions and standards
• Use proper indentation
• Comment your code thoroughly
A good rule of thumb is to give high-level comments on what each code block is doing and then comment on anything unusual that you do.
• Write code that is clear and easy to understand
Write your code in a way that is easy to follow logically and consistent with the way you are writing it.
• Keep code performance efficient
• Create or update existing documentation where appropriate
• The code should be reviewed by the team and keep the proper logs statements.
Developer Best Practices:
1. Use proper naming conversation for all variable declarations.
eg: 'Identity idnRequester' or 'int intIdentityCount'.
2. Any connection objects (e.g., database, File, server) must be closed in the final block.
try{
conn= DriverManager.getConnection("");
}
catch(SQLException ex){
handle the exception or throw as a general exception
}
finally{
try{
if(conn !=null){
conn.close();
}
}catch(){
}
}
3. while throwing the exception, wrap with GeneralException along with information causing an exception.
ex: catch(){
throw new GeneralException("occurred while loading the entitlement data",e);
}
4. Don't log for throwing the exception in the catch block, it results in duplicate logs in the log file for the same exception.
ex: catch(illegalArgumentException e){
//log.error(e); do not do this
throw new GeneralException("occurred while loading the entitlement data",e);
}
5. Always check for the Null object while accessing any object.
ex: Identity id= context.getObjectByName(Identity.class,"test");
if( null ==id){
log.error("no identity found);
return ;
}
6. Check for void if you are accessing out of boxes variables in any rules, workflows forms, etc.
7. Check for object instances if you need more clarification on the run time object.( instanceof List or instanceof String).
8. Try to avoid logic in workflow steps, call as a method from a rule.
9. Try to avoid saving complete objects in workflow parameters until it is really required.
10. Make sure while deploying the code in production the trace parameter is set to false.
11. Do not print complete objects as info or error. do it in debug.
12. Be a practice of using separate logger objects for each rule.
eg: Logger log= Logger.getLogger("");
13. Always use context.search with specific columns while loading data.
14. Avoid using IIQ objects as variable names.
15. Flush the iterator once it is done with the logic. This will release the cursor object related to the database.
ex: Util.flushIterator(itername);
16. Decache the loaded objects once done with the operation.
context.decache(obj name);
17. Default imports for bean shells. Do not add imports explicitly.
java.net.*;
java.lang.*;
java.util.*;
18. Do not print passwords in logs, put password generation in before the provisioning rule and try to implement encrypt mechanism.
19.Do not log any "sailpoint object data "(Ex.log.debug(plan.toXml()), log.debug(project.toXml()).
20. Do not log any authentication token at any level.
21. If you are referring to any rule in your new rule, refer to all the rules references of the parent rule as well.
Saturday, May 27, 2023
Compass Useful Links
Reference:-
Quartz Enterprise Job Scheduler (quartz-scheduler.org)
Rapid Setup:
Rapid Setup Migration Guide - Compass (sailpoint.com)
https://www.sailpoint.com/university/training-paths/identityiq/?
Global Manager Attribute Rule
if(identity != null @and identity.getManager() != null){
return identity.getManager();
} else{
return oldValue;
}
IAM, IGA & Identity Security
IAM sets up the employee's account so they can log in and access the application with their credentials. IGA makes sure that access requ...
Featured Articles
-
public static String extractSessionIDFromGetSessionId(String jsonObject) throws ParseException { String methodName = "extractSession...
-
Connector Rules # Pre-Iterate # BuildMap # JDBCBuildMap # SAPBuildMap # SAPHRManagerRule # PeopleSoftHRMSBuildMap # FilePar...
-
public ProvisioningPlan buildMoveADAccountsPlan(WorkflowContext wfc) throws GeneralException { Logger ruleLog = Logger.getL...
-
IIQ Installation Matrix : IdentityIQ Supported Platforms Matrix - Compass https://community.sailpoint.com/t5/IdentityIQ-Articles/IdentityIQ-...
-
// Fetch current date : Calender calender = Calender.getInstance(); Date currentDate = calender.getTime(); // Printing current date in ter...
-
RJ_KEY — auto generated key (the Job ID) RJ_NAME — name of the scheduled job RJ_JOB_STATUS — current status of the job RJ_EVENT_CNT — number...
-
Configuration steps for Log4j :- 1. Navigate to the below path : C:\Program Files\Apache Software Foundation\Tomcat 9.0\webapps\idenityiq\W...
-
1. Configure the Manager Quicklink population to allow account only requests. a. Navigate to ===> Global Settings ===> Quicklink Pop...
-
Ex: 1. Navigate to the following directory C:\Program Files\Apache Software Foundation\Tomcat 9.0\webapps\identityiq\WEB-INF\classes\sailpoi...
-
# ./ iiq console -j # Display the list of console commands: help (or) ? # Exit the from IIQ console : quit # Delete all identities...