ShehanDinuka
commented
1 month ago Hi Team,
This issue is reproducible in IS 7.0.0 as well. From the console, only roles can be assigned, not groups, which should also be configurable. When a role is assigned from the console, it is saved without the "Internal" domain in the IDP outboundProvisioningRoles configuration. Due to the missing "Internal" domain, when the canUserBeProvisioned()[1] method checks if the user is allowed to be provisioned, it incorrectly determines that the user does not have the provisioning role because of the missing "Internal" domain prefix.
Using the following request should resolve the issue.
curl --location --request PUT 'https://localhost:9443/t/carbon.super/api/server/v1/identity-providers/<idp-id>/roles' \
--header 'Accept: application/json' \
--header 'Referer;' \
--header 'Authorization: Basic YWRtaW46YWRtaW4=' \
--header 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36' \
--header 'Content-Type: application/json' \
--data '{
"mappings": [],
"outboundProvisioningRoles": [
"Internal/test1"
]
}'
sadilchamishka
Describe the issue: Configure role-based outbound provisioning and simulate the flow by assigning outbound provisioning role to a user in the management console. It works.
But assigning the role via console does not trigger provisioning.
The same happens for assigning a group via the console app.
How to reproduce: Config role-based outbound provisioning.
Assign the provisioning role to a user via mgt console, it works.
Assign as a role to a user via console app, it does not trigger provisioning.
Assign as a group to a user via console app, it does not trigger provisioning.
Expected behavior: When a role or group assigned to the user, that user should be provisioned if the assigned role/group is the provisioning role.