I’m setting up a Web Services application, which includes a type of entitlement called “skills”. Skills also have “levels”, and the level of your “skill” grants different permissions.
E.g. If a user has the skill “French” at level 1, they would be allowed to view tickets tagged with “French”, but unless they have level 2, they would not be able to respond to tickets. Or if they have skill “de-escalation training”, they might be matched to tickets based on how proficient they are in that skill. Users are expected to change in skill level frequently, and the levels are expected to range from 1-10.
It doesn’t seem like IIQ has a neat way to handle this sort of design in its Web Services connector. I had a few thoughts on how to do it, but each seemed to have its own drawbacks. Currently, the main goal I have is to be able to initialize skill levels correctly during initial assignment. I.e. when a new user starts, and requests the role “Kiln Service Agent”, they should have the skill “Kiln Engineering” given to them, alongside a default skill level of 5 plus all other permissions needed in the app. If someone had the role “Kiln Engineer”, they might start with “Kiln Engineering” at level 10. Managers can then tweak the levels as needed for their new starters, but you’d expect most people to keep to the default level assigned by their role.
Here are the main options I thought about:
1: Just treat each different skill + possible level as its own individual entitlement. This would technically work, but it would mean it was no longer simple for users to change their skill levels. As if we include the skill + level entitlement in a Bundle, then any change to the skill level made in the target application directly would get overwritten during Identity Refresh. It would also feel messy to have 10x the number of entitlements needed. Finally, it would cause clashes if a user ever held two roles with different default skill levels.
2: Assign all skills at level 1, and rely on manual provisioning/automated service ticket to fix users skill levels. Probably the simplest, but involves human intervention, and thus ideally avoided.
3: Utilise a custom object to map each role to what its expected starting skills are, and what their level should be. Then alter the provisioning plan to assign the skill its correct level. This is the one I personally want to do most, but I’m stymied by the fact that the provisioning plan for the application loses the context of what Sailpoint Bundles were assigned in that transaction, making it impossible to perform the lookup.
Are there any other approaches I’m potentially overlooking? And is there any guidance available for similar cases? Is option 3 possible, and if so, what might be required?
Any help to any part of this post greatly appreciated.