Hi All,

I have a requirement where if any role change happening to person in ISIM should go through role owner approval process. Additionally, I have a requirement that the request sent to role owner should be shown with the different accounts will be provisioned because of new role.

In order to do this, I wanted to find out the entitlements in advance in workflow.

So Is there any way to identify the entitlements by using userDN and roleDN?

Thanks and Regards,
Prashant Narkhede

var personObj = person.get();var newRoles = personObj.getNewRoles();

But there's no built-in JavaScript method to determine what Entitlements those Roles would provide.  
You could find this out by passing each Role (returned by .getNewRoles()), to a custom extension using the com.ibm.itim.policy.analysis.ProvisioningPolicyAnalysis.getProvisioningPolicies() to get a list of Policies associated with each new Role.  Then call .getEntitlements() on each PPAProvisioningPolicy Object returned from the previous call.

Here's a quick example:

//assuming you're passing in the DN of the Role from your workflow, to this extension (as roleDN)RoleSearch rs = new RoleSearch();RoleEntity roleE = rs.lookup(new DistinguishedName(roleDN));Collection<PPAProvisioningPolicy> policies = ProvisioningPolicyAnalysis.getProvisioningPolicies(roleE, true);Iterator<PPAProvisioningPolicy> policiesIt = policies.iterator();		while (policiesIt.hasNext()){			Collection<PPAEntitlement> entitlements = policiesIt.next().getEntitlements();			Iterator<PPAEntitlement> entitlementsIt = entitlements.iterator();			while (entitlementsIt.hasNext()){				String name = entitlementsIt.next().getTargetName();				//.....add to Array of entitlement names you want to list and return to approver in workflow	}}

Hi All,

I have a requirement where if any role change happening to person in ISIM should go through role owner approval process. Additionally, I have a requirement that the request sent to role owner should be shown with the different accounts will be provisioned because of new role.

In order to do this, I wanted to find out the entitlements in advance in workflow.

So Is there any way to identify the entitlements by using userDN and roleDN?

Thanks and Regards,
Prashant Narkhede

var personObj = person.get();var newRoles = personObj.getNewRoles();

But there's no built-in JavaScript method to determine what Entitlements those Roles would provide.  
You could find this out by passing each Role (returned by .getNewRoles()), to a custom extension using the com.ibm.itim.policy.analysis.ProvisioningPolicyAnalysis.getProvisioningPolicies() to get a list of Policies associated with each new Role.  Then call .getEntitlements() on each PPAProvisioningPolicy Object returned from the previous call.

Here's a quick example:

//assuming you're passing in the DN of the Role from your workflow, to this extension (as roleDN)RoleSearch rs = new RoleSearch();RoleEntity roleE = rs.lookup(new DistinguishedName(roleDN));Collection<PPAProvisioningPolicy> policies = ProvisioningPolicyAnalysis.getProvisioningPolicies(roleE, true);Iterator<PPAProvisioningPolicy> policiesIt = policies.iterator();		while (policiesIt.hasNext()){			Collection<PPAEntitlement> entitlements = policiesIt.next().getEntitlements();			Iterator<PPAEntitlement> entitlementsIt = entitlements.iterator();			while (entitlementsIt.hasNext()){				String name = entitlementsIt.next().getTargetName();				//.....add to Array of entitlement names you want to list and return to approver in workflow	}}

Hi All,

I have a requirement where if any role change happening to person in ISIM should go through role owner approval process. Additionally, I have a requirement that the request sent to role owner should be shown with the different accounts will be provisioned because of new role.

In order to do this, I wanted to find out the entitlements in advance in workflow.

So Is there any way to identify the entitlements by using userDN and roleDN?

Thanks and Regards,
Prashant Narkhede

var personObj = person.get();var newRoles = personObj.getNewRoles();

But there's no built-in JavaScript method to determine what Entitlements those Roles would provide.  
You could find this out by passing each Role (returned by .getNewRoles()), to a custom extension using the com.ibm.itim.policy.analysis.ProvisioningPolicyAnalysis.getProvisioningPolicies() to get a list of Policies associated with each new Role.  Then call .getEntitlements() on each PPAProvisioningPolicy Object returned from the previous call.

Here's a quick example:

//assuming you're passing in the DN of the Role from your workflow, to this extension (as roleDN)RoleSearch rs = new RoleSearch();RoleEntity roleE = rs.lookup(new DistinguishedName(roleDN));Collection<PPAProvisioningPolicy> policies = ProvisioningPolicyAnalysis.getProvisioningPolicies(roleE, true);Iterator<PPAProvisioningPolicy> policiesIt = policies.iterator();		while (policiesIt.hasNext()){			Collection<PPAEntitlement> entitlements = policiesIt.next().getEntitlements();			Iterator<PPAEntitlement> entitlementsIt = entitlements.iterator();			while (entitlementsIt.hasNext()){				String name = entitlementsIt.next().getTargetName();				//.....add to Array of entitlement names you want to list and return to approver in workflow	}}

Hi All,

I have a requirement where if any role change happening to person in ISIM should go through role owner approval process. Additionally, I have a requirement that the request sent to role owner should be shown with the different accounts will be provisioned because of new role.

In order to do this, I wanted to find out the entitlements in advance in workflow.

So Is there any way to identify the entitlements by using userDN and roleDN?

Thanks and Regards,
Prashant Narkhede