Add Entitlement for SCIM2 Application does not work

pasha · August 1, 2022, 12:53pm

Hi All

I am trying to create an entitlement for my SCIM2 applicaton. But I am not seeing anything happening. My Before Provisioning rule is not being called. The only thing I see is ManagedAttributes are added. But no provisioning/creation of the groups.

Below is the plan I see from my “Entitlement Update” trace. Could this be the reason for no provisioning?

Below is the full project and plan.

<?xml version=‘1.0’ encoding=‘UTF-8’?>
<!DOCTYPE ProvisioningProject PUBLIC “sailpoint.dtd” “sailpoint.dtd”>
<ProvisioningProject>
<Attributes>
<Map>
<entry key=“requester” value=“pasha”/>
<entry key=“source” value=“GroupManagement”/>
</Map>
</Attributes>
<MasterPlan>
<ProvisioningPlan>
<Attributes>
<Map>
<entry key=“requester” value=“pasha”/>
<entry key=“source” value=“GroupManagement”/>
</Map>
</Attributes>
<ObjectRequest application=“Invicti” nativeIdentity=“PashaTest1” op=“Create” type=“group”>
<Attributes>
<Map>
<entry key=“noProvisioning”>
<value>
<Boolean>true</Boolean>
</value>
</entry>
</Map>
</Attributes>
<AttributeRequest name=“sysAttribute” op=“Set” value=“groups”/>
<AttributeRequest name=“sysDisplayName” op=“Set” value=“PashaTest1”/>
<AttributeRequest name=“sysDescriptions” op=“Set”>
<Value>
<Map>
<entry key=“en_US”/>
</Map>
</Value>
</AttributeRequest>
<AttributeRequest name=“sysOwner” op=“Set” value=“”/>
<AttributeRequest name=“sysScope” op=“Set”/>
<AttributeRequest name=“sysRequestable” op=“Set”>
<Value>
<Boolean></Boolean>
</Value>
</AttributeRequest>
<AttributeRequest name=“sysManagedAttributeType” op=“Set” value=“group”/>
<AttributeRequest name=“sysClassifications” op=“Set”/>
<AttributeRequest name=“managerRequired” op=“Set”>
<Value>
<Boolean>true</Boolean>
</Value>
</AttributeRequest>
<AttributeRequest name=“ownerRequired” op=“Set”>
<Value>
<Boolean></Boolean>
</Value>
</AttributeRequest>
<AttributeRequest name=“commentsRequired” op=“Set”>
<Value>
<Boolean></Boolean>
</Value>
</AttributeRequest>
<AttributeRequest name=“secondaryowner” op=“Set”/>
</ObjectRequest>
<Requesters>
<Reference class=“sailpoint.object.Identity” id=“8a86cac8689ffee201689ffff051022c” name=“pasha”/>
</Requesters>
</ProvisioningPlan>
</MasterPlan>
<ProvisioningPlan trackingId=“e9cd1b8cedf8436b8e1199515f2492c2”>
<Attributes>
<Map>
<entry key=“requester” value=“pasha”/>
<entry key=“source” value=“GroupManagement”/>
</Map>
</Attributes>
<ObjectRequest application=“Invicti” nativeIdentity=“PashaTest1” op=“Create” type=“group”>
<Attributes>
<Map>
<entry key=“noProvisioning”>
<value>
<Boolean>true</Boolean>
</value>
</entry>
</Map>
</Attributes>
<AttributeRequest name=“sysAttribute” op=“Set” value=“groups”/>
<AttributeRequest name=“sysDisplayName” op=“Set” value=“PashaTest1”/>
<AttributeRequest name=“sysDescriptions” op=“Set”>
<Value>
<Map>
<entry key=“en_US”/>
</Map>
</Value>
</AttributeRequest>
<AttributeRequest name=“sysOwner” op=“Set” value=“”/>
<AttributeRequest name=“sysRequestable” op=“Set”>
<Value>
<Boolean></Boolean>
</Value>
</AttributeRequest>
<AttributeRequest name=“sysManagedAttributeType” op=“Set” value=“group”/>
<AttributeRequest name=“sysClassifications” op=“Set”/>
<AttributeRequest name=“managerRequired” op=“Set”>
<Value>
<Boolean>true</Boolean>
</Value>
</AttributeRequest>
<AttributeRequest name=“ownerRequired” op=“Set”>
<Value>
<Boolean></Boolean>
</Value>
</AttributeRequest>
<AttributeRequest name=“commentsRequired” op=“Set”>
<Value>
<Boolean></Boolean>
</Value>
</AttributeRequest>
</ObjectRequest>
<Requesters>
<Reference class=“sailpoint.object.Identity” id=“8a86cac8689ffee201689ffff051022c” name=“pasha”/>
</Requesters>
</ProvisioningPlan>
</ProvisioningProject>

</Attributes>

paulo_urcid · August 2, 2022, 8:17pm

Make sure you have the checkbox enabled for “Enable Account Group Management” in Gear Icon > Lifecycle Manager > Configure tab. Also make sure your SCIM Application has the appropriate Group “Create” Provisioning Policy

pasha · August 2, 2022, 11:09pm

Hi @paulo_urcid I have that configuration set. Do you have an example of what the create group provisioning policy for SCIM2 should look like?

I put featuresString=“PROVISIONING” in my group schema and now I see I can add displayName which is the only thing needed to create a group. But am getting the below error. Any hint is greatly appreciated.

pasha · August 3, 2022, 12:25am

Wow. Believe it or not, it is working. All I had to do was:

1- Put featuresString=“PROVISIONING” in the group schema for the application.

2- And put a dummy group schema customization rule. I swear it’s just a dummy rule to print out object.toXmlI();

I take it. It is working

Thanks.

Pasha

rmitukulla07 · January 30, 2024, 12:59pm

Dear @pasha

we have the same requirement to create groups in the Zscaler application which is the SCIM2.0 connector application. Could you please provide help on this to create groups in the target application?

thanks in advance.

pasha · January 30, 2024, 1:26pm

Hi @rmitukulla07 Is zscalar a “Non-compliant Server” ? You can check/uncheck that in your scim settings.

Don’t know what else to add. I added featureset and gave a customization rule for groups.