Innovative IT Solutions for Your Business

---

The Spoofing plugin contains multiple task templates that can be used to improve the quality of SailPoint installs, testing, and troubleshooting. The tasks are:

• Account Extract
• Aggregate Extracted Data
• Search Account Data
• Search Identity Data
• Compare Account Data
• Identity Extract
• Target Aggregation

 This plugin is compatible with any IdentityIQ system that can accept plugins and has the Plugin database active.

Components of this plugin use direct database queries instead of API calls. This speeds up the tasks significantly. Currently this supports MySQL, SQL Server, and Oracle databases. For Postgress please contact the author for collaboration.

Plugins can be installed four ways:

1. Install from Gear Icon -> Plugins -> New
2. Install from Console with plugin install **filename**
3. Copy plugin to the SSB web/WEB-INF/plugins/ssb/install folder and deploy
4. Copy plugin to the WEB-INF/plugins/ssb/install folder of your environment and restart tomcat

• Account Extract: allows user to extract one or more application account records.
• Account Extract: can specify individual fields to extract.
• Aggregate Extracted Records: allows a user to spoof an application, using an edited account extract record, and present that record to the application, as though it were read by the application.
• Identity Extract: allows user to extract one or more identity records.
• Identity Extract: can specify individual fields to extract.
• For Account and Identity extract, many of the fields are stored in XML.  The fields are optionally extracted using a SQL query to improve performance.
• Search Account Data: allows user to search for identities who have a certain application account value, reporting a count of identities, and optionally a list of those identities.
• Search Identity Data: allows user to search for identities who have a certain identity attribute value, reporting a count of identities, and optionally a list of those identities.
• Histogram: for searches, can optionally prepare histograms of account or identity values.
• Compare Account Data: allows user to compare two similar applications for differences, presenting differences in a spreadsheet.
• Target aggregation: allows user to perform a target aggregation on an application.

 The Account Extract task pulls data from an application and writes it to a CSV file. 

• Application: Application to extract data from.
• Parameter List: Specify for a reduced list of fields.
• Print Schema Params: Select for print of fields.
• Select Identities: Select for individual identities.
• Select all accounts: Check for all accounts.
• Only active identities: Check to limit to active.
• Only correlated identities: Check to limit to correlated.
• Folder path: Folder path for output file.
• Filename: Output filename.

•  Folder path can include $date$ which gets converted to yyyyMMdd format.
• If the folder path does not exist, it will be created.
• If you do not want to print all of the fields in the file, first run the task on a single user, checking the Print Schema Parameters box. Then copy the text from the Task Result into the Parameter List text field, and remove any fields not wanted.
• The Only Active Identities option means that the link should be analyzed to see if the identity is active, and to exclude it from the output if not.
• The Only Correlated Identities option does the same except it excludes accounts that have generated uncorrelated identities.

 The Aggregate Extracted Data task spoofs an application, taking a CSV file (from the Extract Account Data task) and presenting it to the application as though it was brought in via its own getObject method. 

• Application: Application to spoof.
• Folder path: Folder path for input file.
• Filename: Input filename.
• Disable Optimization: Update the link even if the data did not change.

• If the filename does not have a file extension, CSV will be assumed.
• The customization rule will be executed on the ResourceObject.  It is **bad practice** to specify both a global customization rule and an account customization rule on an application.  The account rule will be chosen over the global if this occurs.

The search account data function is an alternative to using the API for searching data inside an application's links.  It has the capability to search uncorrelated identities, inactive identities.  It has the option (default) to use database calls for the searches. The search requires XML based SQL calls since the data are saved in XML.

• Application: Application to search.
• Search Field: Field to search on.
• Search Value: Value to search for.
• Ignore Case: Ignore case in search.
• Compare Field: A second field to compare against the search field.
• Ignore Nulls: Ignore nulls in the compare, both records must have a value to be able to compare.
• New Attribute: Set all records of this attribute to a value.
• New Value: Value to set all records of this attribute.
• Multiple Specs: Search using logic or a filter.
• Only Active Identities: Exclude accounts belonging to inactive identities.
• Only Correlated Identities: Exclude accounts belonging to uncorrelated identities.
• Generate Histogram: Generate a histogram of the values of Search Field.
• Histogram Sort: Method for sorting histogram data.
• Generate Identity List: Output list of matched identities.
• Listing Modulo: To limit output list, set modulo.
• Generate Identity Filter: Generates a filter string that can be used in the Identity Refresh task.

• Currently the plugin has a setting for using SQL queries.  There is legacy code to use API calls instead, but those are so slow they have been abandoned and cannot be sure to still work properly.   We are testing to find errors but the API code is very slow.
• Multiple Specs can be used with the SQL turned off (on the plugin configuration page) to use a filter instead of SQL.  The filter is applied to the identity class.  Preface your filter with filter:
• The Generate Identity List setting produces a list of every matched user with their identity name and display name
• - The Listing Modulo value is used to reduce the size of the matched list, to show only every N'th value
• - The Generate Identity Filter option produces in the output, a name.in filter for use in the Identity Refresh task of the listed users.
• Below are some use cases

• A histogram is a listing of all values seen in a data element along with the count of the number of times it occurs.  The Generate Histogram function works whenever a search is taken.
• A Histogram Sort value can be specified as: asc, desc, or value:
• asc means sort by increasing count.
• desc means sort by decreasing count
• value means sort alphabetically by the value.

Search all accounts for companyName = IGM 

This is a simple use case, just a count of the number of users whose companyName field equals IGM

• Field Application is required. This will be the application searched.
• Field Search Field is required. For our example this will be companyName
• Field Search Value is required.  For our example this will be IGM
• Optional Ignore Case will ignore case in the search.
• Optional Only Active Identities will ignore inactive identities.
• Optional Only Correlated Identities will ignore uncorrelated identities.
• Optional Generate Histogram will ALSO generate a histogram of all companyName values.  See below for histogram details.

Compare two fields against each other, companyName vs orgName 

Fields must reside in the same application.  For cross application compares, use the compare feature.

• Field Application is required. This will be the application searched.
• Field Search Field is required. For our example this will be companyName
• Field Compare Field is required. For our example this will be orgName
• This will produce a result of the number of non-matched values.
• Optional Ignore Case will also ignore case in the compare.
• Optional Ignore Nulls will only compare if BOTH values are non-null

Set all values of an attribute to a certain value for certain users.  For example, for all users with companyName=IGM, then set companyDescription to Independent Garage Mechanics

This will take the results of the search and set a different attribute to a value.

• Field Application is required. This will be the application searched.
• Field Search Field is required. For our example this will be companyName
• Field Search Value is required.  For our example this will be IGM
• Field New Attribute is required.  For our example this will be companyDescription
• Field New Value is required.  For our example this is Independent Garage Mechanics
• All other options for Use Case 1 apply.

The main purpose of the Compare Account Data function is to compare Identity vs Account data or Account to Account data, producing a spreadsheet of differences.

• Applications to Compare: Applications to search/compare.
• Any of these: For multiple selections, consider any combination.
• Comparison Map: Custom object containing compares.
• Select identities: For individual identity compares.
• Select All: Select all identities.
• Only Active: Only compare accounts on active identities.
• Only Correlated: Only compare accounts on correlated identities.
• Filter: Apply filter to the identity search.
• Order by: Sort the output.
• Show all data: Show every comparison not just differences.
• Folder path: Folder path for the output.
• Folder name: Folder name for the output (will have .xlsx appended)
• Email output: Email destination for output file.

The compare map is the name of a Custom object.  The Custom object contains the following lead (you can call the Custom object by any name you wish):

<Custom name="Compare Map">

  <Attributes>

    <Map>

Inside the Map are a number of `<entry` elements which are structured as follows:

<entry name="IDA-FirstName">

 <value>

  <Map>

   <entry name="Workday Direct" value="FIRST_NAME"/>

   <entry name="Workday File" value="FIRSTNAME"/>

  </Map>

</entry>

The name of the entry must be unique and the columns in the spreadsheet are organized by this left to right.  The two entry names in the inner Map are the application name and attribute name.  This example is for comparing a Workday connector called Workday Direct versus a delimited file connector called Workday File

You can also compare a connector value to an identity value as follows:

<entry name="IDA-FirstName">

 <value>

  <Map>

   <entry name="Workday Direct" value="FIRST_NAME"/>

   <entry name="IdentityIQ" value="firstname"/>

  </Map>

</entry>

or include it as a third comparison:

<entry name="IDA-FirstName">

 <value>

  <Map>

   <entry name="Workday Direct" value="FIRST_NAME"/>

   <entry name="Workday File" value="FIRSTNAME"/>

   <entry name="IdentityIQ" value="firstname"/>

  </Map>

</entry>

The result is a spreadsheet showing the differences.

The Identity Extract task is a convenience task that pulls data from identities and writes it to a CSV file.  It is easier to use than a report.

• Select one or more Identities: Select for individual identities.
• Select all accounts: Check for all Identities.
• Only pull active identities: Check to limit to active.
• Only pull correlated identities: Check to limit to correlated.
• Only pull these Identity Types: Check to limit to a certain type or types.
• Attribute List: Specify for a reduced list of fields.
• Print Attributes: Select for print of fields.
• Select application links to filter on: Only pull identities with a link to this application.
• Filter: Custom filter.
• Excludes: List of attributes to leave out.
• Includes: List of additional attributes to include.
• OrderBy: Attribute to sort the output by.
• Folder path: Folder path for output file.
• Filename: Output filename.

• Folder path can include $date$ which gets converted to **yyyyMMdd** format.
• If the folder path does not exist, it will be created.
• If you do not want to print all of the fields in the file, first run the task on a single user, checking the **Print Attributes** box.  Then copy the text from the Task Result into the **Attribute List** text field, and remove any fields not wanted.
• The **Only Active Identities** option means that the link should be analyzed to see if the identity is active, and to exclude it from the output if not.
• The **Only Correlated Identities** option does the same except it excludes accounts that have generated uncorrelated identities.

The default list of attributes is all of them except:

- bundles

- bundleSummary

- assignedRoles

- assignedRoleSummary

- exceptions

- lastRefresh

- lastLogin

- capabilities

- scorecard.compositeScore

- managerStatus

- rights

- workgroups

- softwareVersion

- inactive

- password

See the tooltips for more info on includes and excludes.

Target Aggregation is a convenience task that allows the user to call getObject() on a user and then execute the Aggregation logic on that ResourceObject.  It calls the Aggregator's aggregate() method using the Application and ResourceObject.

• Select one application: Application to get data from.
• Specify Identity: Identity with EXISTING LINK.
• Specify account Native Identity: Account not yet linked to an identity.
• Disable optimization: Process the aggregation even if not changed.

• Do not use the Identity selector unless you are re-aggregating an existing account
• Use the native identity from the actual application
• Application must have the getObject() method available.  This is sometimes left out of custom developed JDBC and WebService applications.