Cloud Rule and Connector Rule Templates and Snippets

import java.util.Random;

// Purpose : generate a unique login name (<=8 chars) from first and last name.
// Owner   : <team>      Version: 1.0      Attached to: <directory source> create policy

int MAX_ATTEMPTS = 2000;
int counter = 1;
int attempts = 0;
String CHARS = "abcdefghijklmnopqrstuvwxyz";

public String clean(String s) {
    if (s == null || s.trim().isEmpty()) s = "def";
    s = s.replaceAll("[^a-zA-Z]", "").toLowerCase();
    // pad short names so the pattern below always has three characters
    Random r = new Random();
    StringBuilder b = new StringBuilder(s);
    while (b.length() < 3) b.append(CHARS.charAt(r.nextInt(CHARS.length())));
    return b.toString();
}

public String build(String fn, String ln, int n) {
    String first = fn.substring(0, Math.min(3, fn.length()));
    String last  = ln.substring(Math.max(0, ln.length() - 3));
    String num   = (n < 10) ? "0" + n : String.valueOf(n);
    String out   = first + last + num;
    // trim to the limit, shortening the name part and keeping the counter
    if (out.length() > 8) out = (first + last).substring(0, 8 - num.length()) + num;
    return out;
}

public boolean unique(String candidate) {
    return !idn.accountExistsByDisplayName(application.getName(), candidate);
}

String fn = clean(identity.getAttribute("firstname"));
String ln = clean(identity.getAttribute("lastname"));
String candidate;
do {
    candidate = build(fn, ln, counter++);
    attempts++;
} while (!unique(candidate) && attempts < MAX_ATTEMPTS);

if (attempts >= MAX_ATTEMPTS) {
    throw new RuntimeException("Could not generate a unique login name after " + MAX_ATTEMPTS + " attempts");
}
log.debug("Generated login name " + candidate);
return candidate;

import java.time.*;
import java.time.format.DateTimeFormatter;

// Purpose : compute the instant a person becomes inactive, at 22:00 local on the end date.
String DEFAULT_ZONE = "<IANA zone, for example Europe/London>";

String endDate = identity.getAttribute("endDate");     // yyyy-MM-dd or ISO instant
String tz      = identity.getAttribute("timezone");

if (endDate == null || endDate.trim().isEmpty()) return null;   // no end date: no value

ZoneId zone;
try {
    zone = ZoneId.of(tz);
} catch (Exception e) {                                  // null or invalid zone
    zone = ZoneId.of(DEFAULT_ZONE);
}

LocalDate day;
try {
    day = endDate.contains("T")
        ? ZonedDateTime.parse(endDate, DateTimeFormatter.ISO_ZONED_DATE_TIME).toLocalDate()
        : LocalDate.parse(endDate, DateTimeFormatter.ISO_LOCAL_DATE);
} catch (Exception e) {
    log.warn("Unparseable end date: " + endDate);
    return null;
}

ZonedDateTime cutoff = day.atTime(22, 0).atZone(zone);
return cutoff.toInstant().toString();                    // store as UTC

Map out = new HashMap();

String login = account.getStringAttribute("sAMAccountName");
String value;
if (login == null || login.trim().isEmpty()) {
    value = "NO_MATCH_BLANK";          // a value that cannot match, rather than null
} else if (login.indexOf('_') == 1 && login.indexOf('_') == login.lastIndexOf('_')) {
    value = login.substring(2);        // "a_jsmith" -> "jsmith"
} else {
    value = login;
}

out.put("identityAttributeName", "<identity attribute>");
out.put("identityAttributeValue", value);
return out;

import sailpoint.object.ProvisioningPlan;
import sailpoint.object.ProvisioningPlan.AccountRequest;
import sailpoint.object.ProvisioningPlan.AttributeRequest;

String P = "BeforeProv <name> - ";
if (plan == null || plan.getAccountRequests() == null) return;

for (AccountRequest ar : plan.getAccountRequests()) {
    ProvisioningPlan.ObjectOperation op = ar.getOp();

    // Example: turn a disable into a modify that moves the account
    if (ProvisioningPlan.ObjectOperation.Disable.equals(op)) {
        log.debug(P + "rewriting Disable for " + ar.getNativeIdentity());
        ar.setOp(ProvisioningPlan.ObjectOperation.Modify);
        ar.add(new AttributeRequest("<attribute>", ProvisioningPlan.Operation.Set, "<value>"));
        continue;
    }

    // Example: never touch a protected account
    String ni = ar.getNativeIdentity();
    if (ni != null && ni.startsWith("<protected prefix>")) {
        throw new RuntimeException(P + "refusing to change protected account " + ni);
    }
}

import java.util.*;
import sailpoint.object.ProvisioningPlan;
import sailpoint.object.Schema;

private List asList(Object o) {
    if (o instanceof Collection) return new ArrayList((Collection) o);
    return new ArrayList(Collections.singletonList(o));
}

String P = "AddRemoveToSet - ";
if (plan == null || plan.getAccountRequests() == null) return;
Schema schema = application.getSchema("account");
if (schema == null) { log.warn(P + "no account schema"); return; }

for (ProvisioningPlan.AccountRequest ar : plan.getAccountRequests()) {
    if (ProvisioningPlan.ObjectOperation.Create.equals(ar.getOp())) continue;
    if (ProvisioningPlan.ObjectOperation.Delete.equals(ar.getOp())) continue;
    if (ar.getAttributeRequests() == null) continue;

    for (ProvisioningPlan.AttributeRequest a : ar.getAttributeRequests()) {
        if (a.getName() == null || a.getValue() == null || a.getOp() == null) continue;
        boolean add = ProvisioningPlan.Operation.Add.equals(a.getOp());
        boolean rem = ProvisioningPlan.Operation.Remove.equals(a.getOp());
        if (!add && !rem) continue;
        if (!schema.isMultiValued(a.getName())) continue;

        String ni = ar.getNativeIdentity() != null ? ar.getNativeIdentity() : plan.getNativeIdentity();
        String app = ar.getApplicationName() != null ? ar.getApplicationName() : application.getName();
        if (ni == null) { log.error(P + "no native identity"); continue; }

        Object acct = idn.getAccountByNativeIdentity(app, ni);
        if (acct == null) { log.error(P + "account not found " + ni); continue; }
        Object current = idn.getRawAccountAttribute(acct, a.getName());
        if (current == null) continue;

        List values = asList(current);
        List change = asList(a.getValue());
        if (add) values.addAll(change); else values.removeAll(change);
        a.setValue(values);
        a.setOp(ProvisioningPlan.Operation.Set);
    }
}

import java.util.*;
import connector.common.JsonUtil;
import sailpoint.object.ProvisioningPlan.AccountRequest;
import sailpoint.object.ProvisioningPlan.AttributeRequest;
import sailpoint.connector.webservices.WebServicesClient;
import sailpoint.tools.Util;

String P = "<Source> BeforeAddEnt - ";

// 1. Read what the plan carries
String nativeId = null;
String value = null;
for (AccountRequest ar : (List<AccountRequest>) provisioningPlan.getAccountRequests()) {
    nativeId = ar.getNativeIdentity();
    AttributeRequest req = ar.getAttributeRequest("<entitlement attribute>");
    if (req != null && req.getValue() != null) value = req.getValue().toString();
}
if (Util.isNullOrEmpty(nativeId) || Util.isNullOrEmpty(value)) {
    throw new RuntimeException(P + "native identity or entitlement value missing");
}

// 2. Optional live lookup through the connector's client (needs a token the source already holds)
// WebServicesClient client = new WebServicesClient();
// Map args = new HashMap(); args.put("url", lookupUrl); client.configure(args);
// String json = client.executeGet(lookupUrl, headers, Arrays.asList("2**"));
// if (Util.isNullOrEmpty(json)) throw new RuntimeException(P + "lookup returned nothing");

// 3. Build the body. Escape values; prefer a map and JSON serialiser to string concatenation.
Map payload = new LinkedHashMap();
payload.put("userId", nativeId);
payload.put("entitlementId", value);
// payload.put("startDate", startDate);

Map body = new HashMap();
body.put("jsonBody", JsonUtil.toJson(payload));   // confirm the serialiser name for your release
requestEndPoint.setBody(body);

log.info(P + "built body for " + nativeId);
return requestEndPoint;

String P = "<Source> BeforeRemove - ";

// 1. Parse the identifiers packed into the entitlement value: "<name> ((<rowId>::<roleId>))"
String ent = <entitlement value from the attribute request>;
int a = ent.lastIndexOf("((");
int b = ent.lastIndexOf("))");
if (a < 0 || b < a) throw new RuntimeException(P + "entitlement value has no identifier segment: " + ent);
String[] ids = ent.substring(a + 2, b).split("::");
if (ids.length != 2) throw new RuntimeException(P + "identifier segment malformed: " + ent);
String rowId = ids[0];
String roleId = ids[1];

// 2. Read the live grants for this user
// String live = client.executePost(getUserUrl, headers, body, Arrays.asList("2**"));

// 3. Decide
//    - the row keeps other roles      -> call "remove role from row"
//    - removing would empty the row   -> call "delete row"
//    - the user would have no access  -> call "disable user"

// 4. Return the end point configured for the chosen call.
return requestEndPoint;

import java.util.*;
import connector.common.JsonUtil;
import sailpoint.tools.GeneralException;

String P = "<Source> AfterAccountAgg - ";
try {
    List<Map> users = JsonUtil.parseJson(rawResponseObject);
    List out = new ArrayList();

    for (Map u : users) {
        Object status = u.get("<status field>");

        // Compare tolerantly and set the flag in both directions.
        boolean inactive = status != null && "inactive".equalsIgnoreCase(status.toString().trim());
        u.put("IIQDisabled", inactive);

        // Allowlist: keep only the fields the schema defines.
        Map clean = new HashMap();
        for (String k : new String[] { "<id>", "<name>", "<email>", "<group list>" }) {
            if (u.containsKey(k)) clean.put(k, u.get(k));
        }
        clean.put("IIQDisabled", inactive);
        out.add(clean);
    }

    log.info(P + "accounts returned: " + out.size());   // a population monitor in the log
    Map result = new HashMap();
    result.put("data", out);
    return result;

} catch (Exception e) {
    throw new GeneralException(P + "error processing response: " + e.getMessage(), e);
}

Map role = new HashMap();
role.put("Id", "<stable id>");
role.put("Name", "<Application> Access");
List data = new ArrayList();
data.add(role);
Map out = new HashMap();
out.put("data", data);
return out;

import sailpoint.connector.*;
import java.util.Map;

Map map = JDBCConnector.buildMapFromResultSet(result, schema);

if (map != null) {
    Object st = map.get("<status column>");
    // both directions, tolerant comparison, and a deliberate default for unknown values
    boolean disabled = (st == null) ? false : !"active".equalsIgnoreCase(st.toString().trim());
    map.put("IIQDisabled", disabled);
}
return map;

import java.sql.*;
import java.util.*;
import sailpoint.object.ProvisioningPlan;
import sailpoint.object.ProvisioningPlan.AccountRequest;
import sailpoint.object.ProvisioningPlan.AttributeRequest;
import sailpoint.object.ProvisioningResult;
import connector.common.JsonUtil;

String P = "<Source> JDBCProvision - ";

public Object attr(AccountRequest ar, String name) {
    AttributeRequest r = (ar == null) ? null : ar.getAttributeRequest(name);
    return (r == null) ? null : r.getValue();
}

// Read and consume the metadata that the request workflow put in the comments
public Map readMeta(AccountRequest ar, String attrName) {
    AttributeRequest r = ar.getAttributeRequest(attrName);
    if (r == null || r.getComments() == null) throw new RuntimeException(P + "request carries no metadata");
    Map m = JsonUtil.toMap(r.getComments());
    r.setComments(null);
    if (m == null) throw new RuntimeException(P + "METADATA IS NULL");
    return m;
}

public boolean exists(Connection c, String user, String role, String entity) throws SQLException {
    try (PreparedStatement s = c.prepareStatement(
            "SELECT COUNT(*) FROM <assignment table> WHERE UserName = ? AND RoleName = ? AND Entity = ?")) {
        s.setString(1, user); s.setString(2, role); s.setString(3, entity);
        try (ResultSet rs = s.executeQuery()) { rs.next(); return rs.getInt(1) > 0; }
    }
}

ProvisioningResult result = new ProvisioningResult();

if (plan != null && plan.getAccountRequests() != null) {
    for (AccountRequest ar : (List<AccountRequest>) plan.getAccountRequests()) {
        try {
            String user = ar.getNativeIdentity();
            if (user == null || user.trim().isEmpty() || "none".equals(user)) {
                throw new RuntimeException(P + "no native identity");
            }

            if (AccountRequest.Operation.Create.equals(ar.getOperation())) {
                Map meta = readMeta(ar, "<entitlement attribute>");
                connection.setAutoCommit(false);
                try {
                    // INSERT account ... ; INSERT assignment ...   (parameterised statements only)
                    connection.commit();
                    result.setStatus(ProvisioningResult.STATUS_COMMITTED);
                } catch (SQLException e) {
                    connection.rollback();
                    throw e;
                } finally {
                    connection.setAutoCommit(true);
                }

            } else if (AccountRequest.Operation.Modify.equals(ar.getOperation())) {
                // for each AttributeRequest: Add -> insert (check exists() first), Remove -> delete
                result.setStatus(ProvisioningResult.STATUS_COMMITTED);

            } else if (AccountRequest.Operation.Disable.equals(ar.getOperation())) {
                // UPDATE account SET status = <disabled> WHERE user = ?
                result.setStatus(ProvisioningResult.STATUS_COMMITTED);

            } else if (AccountRequest.Operation.Enable.equals(ar.getOperation())) {
                // UPDATE account SET status = <enabled> WHERE user = ?
                result.setStatus(ProvisioningResult.STATUS_COMMITTED);

            } else {
                throw new RuntimeException(P + "unsupported operation " + ar.getOperation());
            }
        } catch (Exception e) {
            log.error(P + "failed: " + e.getMessage());
            result.setStatus(ProvisioningResult.STATUS_FAILED);
            result.addError(e);
        }
    }
}
return result;

import sailpoint.thunderbolt.service.ConnectorService;

return ConnectorService.applyStandardFlatFileCustomizations(context, application, connector, object);

boolean DEBUG_WEBHOOK = false;        // keep false in production

public void debugSend(String message) {
    if (!DEBUG_WEBHOOK) return;
    try {
        java.net.HttpURLConnection c = (java.net.HttpURLConnection) new java.net.URL("<listener url>").openConnection();
        c.setConnectTimeout(2000);
        c.setReadTimeout(2000);
        c.setRequestMethod("POST");
        c.setDoOutput(true);
        c.getOutputStream().write(message.getBytes("UTF-8"));
        c.getResponseCode();
    } catch (Exception e) {
        log.warn("debug webhook failed: " + e.getMessage());   // swallow
    }
}