IdentityNow Automatic Provisioning

Lifecycle & Governance
1

Hello,

I am struggling to configure automatic provisioning in IdentityNow, and I would appreciate very much if you could help. As a side note, I am new to IdentityNow product, but I have previous IAM experience with other solutions.

I have the following scenario:

I have an authoritative source configured, SAP SF.

I have AD target system configured.

Aggregation works for both of them.

Now, I want to configure automatic provisioning of AD accounts whenever a new identity is created in IdentityNow following auth source import.

I have configured the Create Account in the AD source.

I also have an Identity profile for my auth source.

How do I set up automatic provisioning? I checked the documentation, but it is not clear how to set it up…

I am expecting to have the option to create a rule or policy, based on a trigger (e.g., identity is created and Identity Profile=ABC and status(lifecyclestate)=active and attributeX=ABC, then create AD account).

However, I do not see any options to create such rules or policies. I have admin access, and I am not sure if my permissions are restricted, or this is a license issue…

Note: For my testing, I do not want to provision accounts for all the identities coming from my auth source, but rather just for a specific one or two, based on an attribute of my choice (if attribute = ABC, then trigger provisioning).

Any advice would be appreciated.

Thank you.

Miha

2

Hi  @mihaela_andrei  You are on the right track. The Create Account should be configured if you plan to use the Identity Security Cloud (IdentityNow) provisioning engine to request the creation of a new account on those 2 sources.

The configuration settings of Authoritative source / HR source system’s Identity Profile > Provisioning page can be used to trigger automated provisioning. There you configure the various Lifecycle states and what should occur when people enter those states and remain in them: which accounts to enable or disable and which access profiles to assign automatically within each state.

Enabling Roles with Membership criteria will also create an auto-provision experience.

This admin help gives a good overview of the configurations. Within it, you can also see all of the provisioning topics outlined with explicit steps to configure each of the elements:

  1. Identity Profile > Provisioning page with Lifecycle States
  2. Access Profiles
  3. Roles

:Setting Up Lifecycle States - SailPoint Identity Services

3

Hello,

Thank you for the answer.

We configured the lifecycle states as per the documentation, however, following aggregation from the authoritative source, automatic AD account provisioning is not getting triggered.

If we manually go the identity, and click on Process Identity, we can see in the Events the AD account is provisioned.

But otherwise, the provisioning is not getting triggered.

Any ideas why?

Thank you,

Miha

4

Hi Miha, Excellent! The fact that “Process Identity” does provision the new AD account manually is great progress! This may take some more troubleshooting on your part, all of the configuration pieces. Without seeing everything in your configuration, it might be difficult to suggest 1 exact root cause.

The failure for this to occur automatically could occur for a variety of reasons, for example:

  1. Are the lifecycle states enabled in the identity profile (the top checkbox)?
  2. Does the Create Account page have the correct uid requirements, with the correct ou designations? I see this in configurations sometimes, when the uid, dn, or other attributes do not have the correct patterns, for example in the “Create Unique Account ID” generator. GO back and check out the Create Account to ensure all the attributes look correct.
  3. If you are provisioning access automatically with the lifecycle state, are all of the corresponding access profiles enabled?
  4. What exactly do you have configured in the lifecycle state for accounts and access?
    1. “Maintain status” (Settings for accounts) does not make any account changes
    2. Are there any access profiles to grant? Did the test users get access profiles from another lifecycle state?
  5. Was the AD source available at the time of the provisioning? Did you see any errors with the VA attempting to connect to AD at the time of the automatic provisioning request?
  6. Were you testing with a completely new user or an existing user (without AD account)? Based on your initial description, I assume you are testing with a brand new identity, but it’s just a question to ask, to make sure -
    1. I recommend to test a New identity = a newly aggregated user to the HR system, without an existing AD account. Does automatic AD account creation happen then?
  7. From your configuration, how did you achieve this?:
    “I do not want to provision accounts for all the identities coming from my auth source, but rather just for a specific one or two, based on an attribute of my choice (if attribute = ABC, then trigger provisioning)”
    1. How are you controlling provisioning with an attribute? Do you have a lifecycle state transform also configured (this is common)?

That’s all I can think of at this time to help guide you to finding the exact root cause.

5

Hello,

Thank you for your answer.

We configured all the settings for Lifecycle state in the identity profile. We managed to perform provisioning by automatically assigning a role (through workflows) containing accesses in our Target System - the account is also provisioned.

Thank you.