Using entitlement attributes in AD connection

[HarishG]

Hi,

Can we use the entitlement attributes of a user in CreateAccountJSON for a AD connector?

for example:

User is assigned with an entitlement(costcenter1). While creating AD account for that user, can we get this value user.costcenter1.customproperty1 in JSON?

or any other approach to get the entitlement attribute values while creating AD account?

Thanks in advance.

Best regards,

Harish

[NM]

Hi @HarishG , Until account is created for the user for the application,  no entitlement is linked to it..if account is created it will act as a add,modify request.

[rushikeshvartak]

In Account Object you can't access entitlement custom properties 

[Darshanjain]

Hi @HarishG 

Please use the Dynamic attribute concept to populate cost center details and use it in the create account json.

Thanks

Darshan

[HarishG]

Hi @Darshanjain, @rushikeshvartak 

We tried to use the Dynamic attributes to get the CostCenter details and provision to AD.

It is working fine if we submit a request for AD account in ARS.

Any suggestions on how can we handle the AD accounts without requests(Birthright account creation)?

Thanks

Harish

[NM]

Hi @HarishG , as per my knowledge. birthright access takes default value of dynamic attribute.. so maybe you can add a default value.

[HarishG]

Hi @NM,

Thanks for the reply.

I have tried using that, it didn’t work because the query in DynamicAttribute contains ${requestee}, which will be generated only if the request is submitted.

is there any way to get the userkey using some task variable? ex: ${task.userkey}

[rushikeshvartak]

Dynamic variables in default value will not be exposed from rule. if plain query or static value is exposed in rules

https://forums.saviynt.com/t5/identity-governance/provisioning-access-based-on-dynamic-value-not-wor...