Azure Account Status

[sbomma]

I am able to successfully pull in Azure accounts using a REST ADC (Graph API) in IGL 7.2 P02 into IGL

I am trying to find if an account is enabled and none of the below attributes work:

accountEnabled

blockSignIn

I get an error when I add the above in the Collector Mapping Parameters:

$.value

.accountEnabled

When I run a test - do not get any results: 

{$.value

.userPrincipalName=999, $.value

.displayName=999, $.value

.mail=999, $.value

.accountEnabled=0}

When I use Postman to retrieve - I get the below for each account. Would like to understand how this translates in IGL

 "accountEnabled": true

[PradeepKadambar · Accepted solution]

Today to convert any data collected using the generic REST collectors, there are no options to transform the data.

In your specific case the value of status comes in as true or false while IGL expects it to be 0 or 1. It is possible to transform data using post processors which I do not condone.

What you really need is for IGL to support this feature and hence I suggest you up vote this idea. 

[JoseReyes]

It's been a couple of years since this thread was opened. Is there still no way to capture accountenabled status from Azure? Seems like it would be a common use case. 

[IanStaines]

This can be collected; you just cannot do anything with the collected value. 

The feature to allow for general attribute translation is tracked in this RSA Ideas page.

Generic REST collectors must support data formatting - RSA Community - 576486

Please ensure you up vote it. 

As noted here and in the RSA Ideas comments custom translation can be done in "Post Custom Processing".   This is overly complicated for this use case but at this time that is the only solution.  Post Custom Processing existed in older versions, but it required modification to the internal packages.  In 7.5.2 it is exposed in the product via a custom setting that can be enabled by RSA Professional Services.  Again, as noted by @PradeepKadambar we recommend you engage PS for this as it requires some programing knowledge. 

[JoseReyes]

Thanks @IanStaines. For now I will look into collecting the data outside of RSA and manipulating the value prior to RSA collection from another data source.

[IanStaines]

Note that this does not just affect collecting from Azure but collecting any data from any DataSource.  This is also not a limitation of only the Generic REST collector.  None of the collectors have this feature and so this is a deficiency in all collector types.   

It is incidental that some of the Database collector types allow you to manipulate the data using the SQL features of that jdbc driver.  So for example, with Database Collectors of type Oracle, you can use Oracle SQL statements to manipulate the data directly in the collector.  Again this is not leveraging a feature in RSA G&L product but leveraging a feature of the driver.  

The REST standard does allow for some very limited data manipulation (some substring options can be done) but this is generally not a feature of the REST protocol. 

Note that if you decide to collect the data outside of RSA, and you elect to store the data in an Oracle database, you could then use the Oracle Database Collectors JDBC SQL features to do the data manipulation.  Convoluted I know but that is all we have to offer at the moment.

[PradeepKadambar]

What API are you using ? The List Users (https://learn.microsoft.com/en-us/graph/api/user-list)  doesn't have the attribute accountEnabled

---

@JoseReyes wrote:

Thanks @IanStaines. For now I will look into collecting the data outside of RSA and manipulating the value prior to RSA collection from another data source.

---

[JoseReyes]

@PradeepKadambar 

https://graph.microsoft.com/v1.0/users is the API. accountEnabled returns as true or false values

  

[JoseReyes]

@IanStaines Another question for you regarding this generic rest collector. I was hoping to use bearer token authentication to Azure instead of OAuth to utilize app level permissions rather than delegated access which requires a user to sign in an generate a token. I opened a ticket with support and was told this was not supported. Just trying to understand why the generic rest collector cannot generate a standard bearer token with Azure, my powershell and postman have no issues doing this using the same values.

[PradeepKadambar]

Generic REST collector support both Token and Auth flow of OAuth2 for Azure. 

[IanStaines]

I did consult on the case and I did suggest that the Customer use Oauth.

They should have not said that bearer tokens are not supported.  Nothing is either "supported" or not "supported" with the Generic REST Collector especially with regards to a particular endpoint.   We do not make any statements of support for any specific endpoints.

The Generic REST Collector supports both Tokens and Oauth and you are free to use whichever method best works with your endpoint. 

I do know Oauth is demonstrated to work with Azure and we have examples on RSA Link.  I am not aware of any working examples using a bearer token; perhaps someone in the community will post their experience.