IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  How to automatically add users in group using registration flow designer

    Posted Fri March 28, 2025 07:38 AM

    Hi team,

    I'm working on IBM Security Verify and my goal is to automatically add a user to a group during the registration phase.
    I have created a flow designer to achieve this, but when I test its functionality, the user is created but is not assigned to any group.

    This is my flow designer:

    In this flow I have specified the group ID to which the user should be added
    The number 4 represents the identifier of the group attribute obtained via an API call.
    {
           "id": "4",
           "name": "groupIds",
           "description": "The list of groups that the user belongs to.",
           "scope": "global",
           "sourceType": "schema",
           "datatype": "string[]",
           "tags": [
               "sso",
               "prov"
           ],
           "credName": "groupIds",
           "schemaAttribute": {
               "name": "ibm-allGroups",
               "attributeName": "groups",
               "scimName": "groups",
               "customAttribute": false
           },
           "displayName": "Group IDs"
       }

    Does anyone knows how to help me?

    Thanks for your availability



    ------------------------------
    Carmine Salvatore
    ------------------------------


  • 2.  RE: How to automatically add users in group using registration flow designer

    Posted Mon March 31, 2025 04:01 AM
    Edited by Peter Volckaert Mon March 31, 2025 04:02 AM

    Hi Carmine,

    Looking at the flow, I noticed that you first update the user, and then create the user? That must be the other way around.

    Look at the tracing feature in the orchestration engine to help in troubleshooting: https://www.ibm.com/docs/en/security-verify?topic=attributes-multi-line-rule-executor

    However, some flows cannot be run stand-alone, and the tracing feature with debug and debugx is not relevant. In such cases you could consider to simply post a message to a service. See this below snippet where I used the service webhook.site. Be cautious about the security when using such public services.

    statements:
    - context: "webhookUrl := 'https://webhook.site/eb394110-af7b-4sd0-bd0d-b0fdsf9ae097'"
    - context: "textFormat := {'content-type' : 'text/plain'}"
    - context: >
        dummy1 := hc.Post(context.webhookUrl,context.textFormat, "Starting URL calc!")

    Kind regards - Peter

     

     

    

    

    




    
                                                
    
					
                                                    

        
                                                
				
    
                                                
    
                                                    
                                                
    
                                                
                                            
    
                                        
    

                                        
                                        

                                    
			
    

                                    
                                
    

                                
                                
    
                                
    
                            
		
    • 
                
                    
  • 
			                                
                                
                                
    
                                    
    
                                        
    
                                            
                                            3.  
                                            RE: How to automatically add users in group using registration flow designer
                                            
                                            
                                            
                                        
    
                                    
    
                                    
    
                                        
    
				
                                                
    
                                                    
    
					
        
        
        
        
        
        
        
            
        
    
				
    
                                                
    
                                            
			
    
                                    
    
                                
    
                                
                                

                                
    
                                    
    
                                        
                                    
    

                                    
    
				

                                        
    
                                            
    
                                                
    
                                                    
    
                                                        Posted Mon March 31, 2025 11:31 AM
                                                        
                                                    
    
                                                
    
                                            
    
                                            
    
                                                

                                                
                                            
    
                                        
    

                                        
    
                                            
    
                                                
    Hey Carmine,
           I agree with Peter in his response below. You would need to create the user first and then you would need to update the group membership.

    Here's a code snippet for reference:

    **
    - context: endPoint := "https://<YourTenantHostname>/v2.0/Groups/<Your group ID goes here>"
    

    - context: >
    

        payload := jsonToString({
    

            "Operations": [{
    

            "op": "add",
    

            "path": "members",
    

            "value": [{
    

                "type": "user",
    

                "value": The User ID of your user goes here.
    

            }]
    

        }],
    

        "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"]
    

        })
    

    - context: response := hc.Patch(context.endPoint,{"Authorization":'Your token goes here',"Content-Type":"application/scim+json"},context.payload)
    

    **

    I'm just sharing a happy path snippet here. Would leave enhancing this logic to handle errors / -ve scenarios / response code parsing etc.

    Of course, again as Peter shared below, you can leverage debug statements to get further details on your function block execution.

    Let me know if that helps.


    ------------------------------
    Ramakrishna Gorthi
    IBM
    Pune
    ------------------------------

    
                                                
    
					
                                                    

        
                                                
				
    
                                                
    
                                                    
                                                
    
                                                
                                            
    
                                        
    

                                        
                                        

                                    
			
    

                                    
                                
    

                                
                                
    
                                
    
                            
		
    • 
                
                    
  • 
			                                
                                
                                
    
                                    
    
                                        
    
                                            
                                            4.  
                                            RE: How to automatically add users in group using registration flow designer
                                            
                                            
                                            
                                        
    
                                    
    
                                    
    
                                        
    
				
                                                
    
                                                    
    
					
        
        
        
        
        
        
        
            
        
    
				
    
                                                
    
                                            
			
    
                                    
    
                                
    
                                
                                

                                
    
                                    
    
                                        
                                    
    

                                    
    
				

                                        
    
                                            
    
                                                
    
                                                    
    
                                                        Posted Thu April 17, 2025 10:16 AM
                                                        
                                                    
    
                                                
    
                                            
    
                                            
    
                                                

                                                
                                            
    
                                        
    

                                        
    
                                            
    
                                                
    Hi Ramakrishna and thanks for your support!
    I followed your suggestion and I can add the user to a group.
    Now I want to try and modify my function so that the authorization token is not static but is generated by the system.
    do you know how to do it?
    Best regards


    ------------------------------
    Carmine Salvatore
    ------------------------------

    
                                                
    
					
                                                    

        
                                                
				
    
                                                
    
                                                    
                                                        
                                                        Original Message
                                                
    
                                                
                                            
    
                                        
    

                                        
                                        

                                    
			
    

                                    
                                
    

                                
                                
    
                                
    
                            
		
    • 
                
                    
  • 
			                                
                                
                                
    
                                    
    
                                        
    
                                            
                                            5.  
                                            RE: How to automatically add users in group using registration flow designer
                                            
                                            
                                            
                                        
    
                                    
    
                                    
    
                                        
    
				
                                                
    
                                                    
    
					
        
        
        
        
        
        
        
            
        
    
				
    
                                                
    
                                            
			
    
                                    
    
                                
    
                                
                                

                                
    
                                    
    
                                        
                                    
    

                                    
    
				

                                        
    
                                            
    
                                                
    
                                                    
    
                                                        Posted Tue April 22, 2025 09:00 AM
                                                        
                                                    
    
                                                
    
                                            
    
                                            
    
                                                

                                                
                                            
    
                                        
    

                                        
    
                                            
    
                                                
    Hey Carmine,
            This is probably what you are looking for: https://www.ibm.com/docs/en/security-verify?topic=attributes-attribute-rule-functions#r_attr_functions__title__18

    Thanks and Regards,
    

    ~Rama.


    ------------------------------
    Ramakrishna Gorthi
    IBM
    Pune
    ------------------------------

    
                                                
    
					
                                                    

        
                                                
				
    
                                                
    
                                                    
                                                        
                                                        Original Message
                                                
    
                                                
                                            
    
                                        
    

                                        
                                        

                                    
			
    

                                    
                                
    

                                
                                
    
                                
    
                            
		
    • 
                
        

    






            

        

    




	



    

         
    
Related Content