Dangling Entitlement Report

 import java.util.ArrayList;

  import java.util.Iterator;

  import java.util.List;

  import java.util.regex.Matcher;

  import java.util.regex.Pattern;

  import org.apache.commons.logging.Log;

  import org.apache.commons.logging.LogFactory;

  import sailpoint.api.IdentityService;

  import sailpoint.api.SailPointContext;

  import sailpoint.object.Application;

  import sailpoint.object.EmailFileAttachment;

  import sailpoint.object.EmailOptions;

  import sailpoint.object.EmailTemplate;

  import sailpoint.object.Filter;

  import sailpoint.object.Identity;

  import sailpoint.object.IdentityEntitlement;

  import sailpoint.object.Link;

  import sailpoint.object.QueryOptions;

  import sailpoint.tools.GeneralException;

  import sailpoint.tools.Util;

  public static boolean isValidUser(String name) {

    String regex = "^-?\\d+$";

    Pattern pattern = Pattern.compile(regex);

    Matcher matcher = pattern.matcher(name);

    return matcher.matches();

  }

  boolean flag = false;

  String name = null;

  String entitlement = null;

  List adLinks = null;

  List ticket = null;

  Identity identity = null;

  Application adApp = null;

  IdentityService adIdentityService = null;

  Iterator iterator = null;

  try {

    adLinks = new ArrayList();

    ticket = new ArrayList();

    ticket.add("name,Entitlement");

    adApp = context.getObjectByName(Application.class, "AD");

    if (adApp == null) {

      logger.error("AD application not found");

      return "AD application not found";

    }

    Filter filter = Filter.and(Filter.eq("type", "Entitlement"), Filter.eq("aggregationState", "Connected"), Filter.eq("application", adApp));

    QueryOptions qo = new QueryOptions();

    qo.addFilter(filter);

    iterator = context.search(IdentityEntitlement.class, qo);

    while (iterator.hasNext()) {

      IdentityEntitlement ide = iterator.next();

      if ((ide.getSourceAssignableRoles() == null @or ide.getSourceAssignableRoles().isEmpty()) @and ide.getIdentity() != null @and ide.getIdentity().isCorrelated()) {

        identity = ide.getIdentity();

        name = identity.getName();

        flag = isValidUser(name);

        if (flag) {

          adIdentityService = new IdentityService(context);

          adLinks = adIdentityService.getLinks(identity, adApp);

          if (adLinks != null @and !adLinks.isEmpty()) {

            for (Link link : adLinks) {

              if (link.getAttribute("serviceAccount") == null) {

                

                entitlement = ide.getValue().toString();

                ticket.add("\n" + name + "," + entitlement);

              }

            }

          }

        }

      }

    }

    EmailOptions emOptions = new EmailOptions();

    EmailTemplate snowTemplate = context.getObjectByName(EmailTemplate.class, "AD-Dang-ENT-TicketEmail");

    if (ticket != null @and !ticket.isEmpty()) {

      String tickerDetails = ticket.toString().replace("[","").replace("]","");

      byte[] ticketDetailsDataByte = tickerDetails.getBytes();

      EmailFileAttachment ticFileAttachment = new EmailFileAttachment("AD-Dangling-ENTS.csv", EmailFileAttachment.MimeType.MIME_CSV, ticketDetailsDataByte);

      emOptions.addAttachment(ticFileAttachment);

      emOptions.setVariable("createIncident", "##CREATEINCIDENT##");

      emOptions.setVariable("assignmentGroup", "Pedia-Enterprice");

      emOptions.setTo("admin@example.com");

      context.sendEmailNotification(snowTemplate, emOptions);

    }

  } catch (GeneralException e) {

    logger.error("GeneralException : "+e.getMessage());

  }

  finally {

    if (iterator != null) {

      Util.flushIterator(iterator);

    }

    if (adLinks != null) {

      adLinks.clear();

    }

    if (ticket != null) {

      ticket.clear();

    }

  }

Eclipse set up for IIQ

High Level Steps:-

1. Create a Java Project

2. Create a package

3. Add Apache Tomcat libraries & IdentityIQ libraries (Right click on project > Build Path > Add External Archives)

Reference:
https://www.eclipse.org/downloads/packages/release/2019-09/r

Exclude Organizational Roles in BRC or FRC

 import java.util.Iterator;

 import java.util.List;

 import sailpoint.object.Bundle;

 import sailpoint.object.Certifiable;

  log.debug("Entering into the Pedia - Containers _Exclusion Rule ...");

  if(items != null @and items.size() > 0){

    Iterator iter = items.iterator();

    while(iter.hasNext()){

      Certifiable item  = (Certifiable) iter.next();

      if(item instanceof Bundle){

        Bundle bundle = (Bundle) item;

        if(bundle != null @and !bundle.equals("")){

          if(bundle.getType() != null @and !bundle.getType().equals("")) {

            if(bundle.getType().equals("organizational")){

              iter.remove();

              itemsToExclude.add(item);

            }

          } else {

            iter.remove();

            itemsToExclude.add(item);

          }

        }

      }

    }

  }

  log.debug("End from Pedia - Containers _Exclusion Rule ...");

Clean IDs in XML

Steps:-

# Open Notepad++

# Ctrl+H

# Select the following options like highlighted in the screenshot.

Find What : created="[^"]*" 
Replace with : Empty

Find What : id="[^"]*" 
Replace with : Empty

Find What : significantModified="[^"]*" 
Replace with : Empty

Find What : modified="[^"]*" 
Replace with : Empty

(or)

Find What : created="\d+" |id="[a-zA-Z0-9]+" |significantModified="\d+" |modified="\d+"

Replace with : Empty

Find What : significant

Replace with : Empty

Ref: Cleaning XMLs via Regex - IdentityIQ (IIQ) / IIQ Community Knowledge Base - SailPoint Developer Community

test31

<Source>

import sailpoint.object.ProvisioningPlan;

  import sailpoint.object.ProvisioningPlan.AccountRequest;

  import sailpoint.object.ProvisioningPlan.AttributeRequest;

  import sailpoint.connector.webservices.EndPoint;

  import sailpoint.tools.Util;

  import sailpoint.util.Listl

 

  

  log.error("***currentbody***"+  requestEndPoint.getBody().get("jsonBody")); 

  log.error("***requestEndPoint *** "+  requestEndPoint );

  log.error("***provisioningPlan *** "+  provisioningPlan );

 

  if (provisioningPlan != null @and requestEndPoint != null) {

    String nativeIdentity = plan.getNativeIdentity();

    log.error("Native Identity: " + nativeIdentity);

   List accountRequests = plan.getAccountRequests();

     log.error("accountRequests: " + accountRequests);

   if(accountRequests != null @and accountRequests.size() > 0){

    for (AccountRequest accountRequest : accountRequests) {

      AccountRequest.Operation op = accountRequest.getOperation();

      log.error("Operation: " + op);

      log.error("Account Native Identity: " + accountRequest.getNativeIdentity());

  

List attrRequests = accountRequest.getAttributeRequests();

log.error("attrRequests: " + attrRequests);

if(attrRequests != null @and attrRequests.size() > 0){

      for (AttributeRequest attrRequest : attrRequests) {

  

        String attrName = attrRequest.getName();

        Object attrValue = attrRequest.getValue();

 

 

        if (attrValue instanceof String) {

          log.error("It's a String");

        } else if (attrValue instanceof Integer) {

          log.error("It's an Integer");

        }

 

 

        log.error("Attribute: " + attrName + " | Value: " + attrValue);

 

        // Add 'role_Id' attribute if operation is Modify

        if (op == AccountRequest.Operation.Modify) {

          AttributeRequest attrGrpRequest = new AttributeRequest("role_Id", ProvisioningPlan.Operation.Set, attrValue);

          accountRequest.add(attrGrpRequest);

          log.error("Added role_Id attribute with value: " + attrValue);

        }

  

        if (op == AccountRequest.Operation.Create) {

          AttributeRequest attrGrpRequest = new AttributeRequest("role_Id", ProvisioningPlan.Operation.Set, attrValue);

          accountRequest.add(attrGrpRequest);

          log.error("Added role_Id attribute with value: " + attrValue);

        }

}

      }

  }

    }

  }

 

  log.error("Provisioning rule completed.");

  //return endPoint;

  </Source>

User Level Access Matrix

Reference:

https://documentation.sailpoint.com/saas/help/common/users/user_level_matrix.html

Multifactor Authentication

Reference:
https://documentation.sailpoint.com/saas/help/common/strong_auth.html

CLI

Reference :
https://developer.sailpoint.com/docs/tools/cli/

ISC Connectors

Reference : 
https://community.sailpoint.com/t5/IdentityNow-Connectors/Identity-Security-Cloud-Connectors/ta-p/80019

Leading Practices

1.Locate VAs close to sources

2.Restarting the VA cluster is almost always the best first action to resolve problems with a VA

3.Use Static IP addresses to simplify networking setup and monitoring

4.To avoid a single point of failure in your environment, maintain a 1:1 VA-to-VM ratio

5.Create New VAs to Switch Deployment Locations and Platforms

6.Allow inbound communications over SSH (port 22) secure shell access for administrative purposes so you can access the VA from inside your network

7.Deploy a minimum of 2 VAs per cluster

8.Separate Sandbox and Production clusters

9.Allow unrestricted outbound traffic on ports 53 (DNS), 123 (NTP), and 443 (HTTPS). As an alternative, you can set up a proxy or single point of access. (Network proxy, firewalls, and caching products can interfere with VA communications)

10.Optional: for added security within your network, configure VAs to communicate with connected sources over Transport Layer Security (TLS)

Email Notifications

Reference:

https://documentation.sailpoint.com/saas/help/common/getting_notified_org_health.html