Mapping Entitlements from a different endpoint during create account

[Ben]

Hi All,

Requirement - Map an entitlement from a one endpoint (Okta) when an account is created in target application to enable SSO.

Situation - I've onboarded an application that exposes a SCIM endpoint but does not expose any entitlements. I arbitrarily mapped a specific account attribute (user type) as an entitlement, thinking I could then use this with entitlement mapping to map across to the Okta application to enable SSO to the application post account creation.

Issue - Create Account JSON does not do any entitlement mapping for accounts (from my understanding) and the entitlements will only map to the account using the import account and import access scheduled jobs, which will be scheduled.

Is there a way to map entitlements across endpoints as part of the create account process?

[rushikeshvartak]

No you can't map entitlements as part of create account json

[Ben]

Hi @rushikeshvartak,

As I said, i know this can't be done as part of the create account json.

I'm just wondering if there is a way to achieve this as part of the overall create account process. We have a large number of apps where we would need to create an account in the target application and also provide access to the application via our IDP (different endpoint entitlement) at the same time.

[NM · Accepted solution]

Hi @Ben, if you want to assign a group at the time of account creation ftom a particular endpoint for SSO.. you can use entitlement with new account functionality.

[Ben]

Thanks, @NM. This is exactly what I was looking for!

[rushikeshvartak]

There is known issue that if request gets rejected entitlement will be still assigned 

[NM]

@rushikeshvartak , is it in newer or older verison .. haven't encountered it

[rushikeshvartak]

I have seen in older versions

[rushikeshvartak]

Use Enterprise roles