Hi,
I'd like to use web services to create a Change Request to create account and add approle to account.
However, Create action seems to require the Business Source to have an account template attached to it.
Can I invoke this webservice without an account template?
Then, can I invoke "add" action if the account doesn't exist yet in the system?
Cheers!
If you call the web service doing something like add entitlement X to user Y, if the business source that entitlement X is in is configured so entitlements require an account, the system will use the account template associated to create an account implicitly. Without the account template, we don’t know how to create the account.
Sean Miller | Senior Manager, Software Engineering | RSA
O: (519) 954 8162
RSA Identity Governance and Lifecycle Community: https://community.rsa.com/community/products/governance-and-lifecycle
Hi Sean,
We faced same problem and if we use 'Provisioning Command' in fulfillment workflow, it won't look for account to add entitlement even for first time to this user(account).
Definitely AFX Fulfillment Handler won't do as it needs account in the business source first, but 'Provisioning Command' don't have any clauses as such.
Regards,
Tushar.
Hi guys,
I think I should be a little more clear on the use case.
Say I have a business source with no account template, just some accounts and entitlements /approles that belong to those accounts.
Now, with webservice, I'd like to create a change request to create an account and add an entitlement/approle to that account. However, the account can be named anything. There is no template as such.
I've got 2 issues:
1. Create account requires account template (although not from afx? How does that work?)
2. The add approle to Account command requires the account to already exist AND I need to specify the account collector (which I may or may not know...)
Basically, we have some customization that allows us to place requests at the account level, but doesn't use CR items, and is heavily customized using Java code and can only ever create a remedy ticket for provisioning.
By using Web services and triggering a real create account and add approle to Account, then I can leverage OOTB capability and can do things like provisioning.
Why aren’t you just generating a create account change in the webservice request then? You don’t need an account template in this case. You can send a create account change and the add for the application role.
If you want the power of things like the account template however, you need to configure the business source as I suggested so accounts are generated implicitly.
Sean Miller | Senior Manager, Software Engineering | RSA
O: (519) 954 8162
RSA Identity Governance and Lifecycle Community: https://community.rsa.com/community/products/governance-and-lifecycle
Hi Sean,
Reason is WS responds with below error, indicating I NEED an account template:
Error 412: The change request could not be created. The account could not be created because the business source named 'Modini' does not have a valid account template. Query String=cmd=createChangeRequest&token=???
Can you assist here?
Cheers,
Steve.
Can you provide an example xml you are sending?
Sean Miller | Senior Manager, Software Engineering | RSA
O: (519) 954 8162
RSA Identity Governance and Lifecycle Community: https://community.rsa.com/community/products/governance-and-lifecycle
Yep:
Cheers,
Steve.
Hi Sean,
Not sure why it didn't post below...anyway here you go!
<Changes>
<AccountChange>
<Operation>Create</Operation>
<Account>test123</Account>
<BusinessSource>Modini</BusinessSource>
<User>d627111</User>
<AccountCollector>AGS_COMMON_ADC</AccountCollector>
</AccountChange>
</Changes>
Team,
Can you please update on solution for above conversation. We are too facing similar issues.
If you call the connector capability using 'Provisioning Command' node in workflows, you can achieve above use case.