Identity Governance and Intelligence REST APIs Doc (IGI 5.2.4)

Features

Under Construction. What’s New:

Prerequisites

Before to proceed you must be familiar with the following technologies:

You must also have an understanding of the Identity Governance and Intelligence solution.

Restrictions

The SCIM Framework realized provides limitations on original SCIM features that include filtering, paging, patch operations and bulk.
In particular, SCIM query filter expressions with or logic operator or parenthesis or brackets are not supported.
At this stage supported operators are the following:

Moreover, in filter string each attribute must be preceded by the urn (e.g. urn:ietf:params:scim:schemas:core:2.0:User:name.givenName co \"James\").
Additionally, in SCIM search request the paging mechanism adopted is different from the SCIM specification. The paging mechanism actuated is page based, where the startPage field of SCIM search request indicates the page target and the count field specifies the number of element in that page.
Additionally, in the SCIM search request attributes selection by means attributes and excludedAttributes attributes is not implemented yet.

PATCH operations are not implemented yet, are instead available replace operations.

BULK operations are not implemented yet.

Some SCIM standard attributes are not mapped in IGI data model. You can find this information looking at the Resource Schema.

Extension

In addition to SCIM standards, it was added a new Attribute Data Types called RESOURCE . This data type includes some information as the resourceSchema to describe the URN of that resource, and extensionSchema to describe an eventually extension URN.
The following is an example obtained calling Resource Schema API:


{
	"name": "rolesToAdd",
	"type": "RESOURCE",
	"mutability": "READ_WRITE",
	"returned": "DEFAULT",
	"uniqueness": "NONE",
	"multiValued": true,
	"description": "List of entitlements to add.",
	"required": false,
	"caseExact": true,
	"resourceSchema": "urn:ietf:params:scim:schemas:core:2.0:Entitlement",
	"extensionSchema": "urn:ibm:params:scim:schemas:extension:bean:arm:2.0:Entitlement"
}
		
This means that rolesToAdd is a resource described by "urn:ietf:params:scim:schemas:core:2.0:Entitlement" schema with "urn:ibm:params:scim:schemas:extension:bean:arm:2.0:Entitlement" extension.

Authorization

When calling the SCIM API, you'll need to use an API Token generated calling Login API method.
You must pass the token in "Authorization" header: e.g. Authorization : Bearer WwgdmVyc2lvbj0iMS4wIiBlbmNv

How to read this document

Every API is described by the following sections:

ARM Workflow

REST API for Access Request implments only User Entitlement assignment workflow. In order to operate this workflow, the following step must be executed:

Generate Request

  1. Login
  2. Find GEN type workflow
  3. Find users by workflow
  4. Find entitlement for the selected user (to update or remove entitlements)
  5. Find role to add for selected user (to add entitlements)
  6. Generate request with the entitlements to add and/or to remove for the selected user as beneficiary

Authorize (or Execute) Generated Request

  1. Login as an approver account
  2. Find AUTH type workflow
  3. Find requests to work
  4. Find detail for the selected request
  5. Authorize (or eventually Execute) the selected request