How to invoke an External JAR/JAVA Code in IGI

How to invoke an External JAR/JAVA Code in IGI

The Up and Coming Access Governance tool from IBM called IGI/ISIG is one of the most interesting tools that i got a chance to work on. The Tool still has a room for improvement but it is becoming a strong contender for other access governance tools like sailpoint,savyint and aveksa.

As the tool is still in a development phase there is not much documentation available online.
This option was something we implemented for a client but the functionality was a pure trial and error. Thankfully it worked, Even before IBM came back with a solution :-) .No Disrespect but the reply from IBM regarding a service request on IGI is very slow...

So, the First thing we need to understand is that all the rules(basically workflows) in IGI is written in JAVA. Yep, umight be thinking java....y so retro can they design a better gui model like a workflow in ISIM or sailpoint....sadly, we have to make it work as it is.

Actually for most of the IAM'ers who understand JAVA it will be very benefecial as most of the custom extensions in most IAM products are generally written in JAVA.

Basically what we have to do is to deploy our java code as a JAR file and deploy it on the appliance using the below steps:
1. Login to IGI VA Admin Console.
2. Browse to Configure>>Custom File Management>>lib.
3. Click the button upload and select the JAR file that u want to upload.
4.  After Upload make sure to restart the IGI server and not the complete appliance only the server, if in case u have a cluster make sure to synchronize the servers using cluster management and then restart the cluster machine IGI server as well.

Now your JAR has been successfully uploaded and u can call ur JAR and the custom java Code that u want to call from it.

For my Example i used a ojdbc.jar and wrote a java code in the rule to write to a Oracle table and for connection to DB i used a property file which was deployed using the same way as my JAR file.

Before u write the code make sure to import your classes in the import option provided in the rules, if not it will fail
below is the code that i have used in my environment.

when
    eval( true )
then
Connection con = null;
Properties prop = new Properties();
InputStream input = null;
input = new FileInputStream("/opt/isig/IDEASPlatformEnvCustom/lib/db.properties");
prop.load(input);
Class.forName("oracle.jdbc.driver.OracleDriver");  
String hostname=prop.getProperty("dbhostname")+"";
String port=prop.getProperty("dbport")+"";
String service=prop.getProperty("dbservice")+"";
String dbuser=prop.getProperty("dbuser")+"";
String dbpwd=prop.getProperty("dbpwd")+"";
String dbtable=prop.getProperty("dbtable")+"";
String sqlurl="jdbc:oracle:thin:@"+hostname+":"+port+":"+service;
    con=DriverManager.getConnection(sqlurl,dbuser,dbpwd);  
      
    //step3 create the statement object  
    Statement stmt=con.createStatement();  
      
    //step4 execute query  
    ResultSet rs=stmt.executeQuery("SELECT * FROM "+dbtable+" ");  
   System.out.println(rs);
    while(rs.next())  {
    System.out.println(rs.getString(1)+"    "+rs.getString(2));   
UserBean thisUser = UtilAction.findUserByCode(sql, rs.getString(2));
//You can write your code here on what to do with the data u get from the table.
}
   con.close(); 

Basically IGI gives u the option on customizing the Rules just like any other tool 

Adding Multiple Access Owners for a Permission and set a IGI Certification Campaign for them

For the Past few months i had the chance to get my hands on the IBM IGI Product, So far the product seemed good but it is still a little backward considering other governance tools like aveksa and sailpoint.
Its got the potential but it purely depends on the developers at IBM on which way it is to go...but from my past experience with crossideas i have to say its grown alot... really alot...

Ok so moving to the topic...
In IGI the default visible options in GUI allows only one accessowner to be added to a permission(basically a group or access in AD or Linux etc).

But sometimes like other tools we might need to configure multiple owners for a permission, by default the option of configuring multiple owners are generally not enabled.
To enable it we will have to twerk the tool a little...

Follow the below steps for it....

1. Login to IGI. Go to Access Governance Core > Configure > Admin Roles. Check if 2 IT Roles with the name “UserReviewer” and “EntitlementReviewer” for application “AccessCertifier” are already present. These two roles should be present by default unless they are forcibilly removed..
2. if the roles are not there then do not panic just create it for application accesscertifier.
3. Now create a Business Role with the name “Entitlement Owner”.
4. Browse to the Organizational Units Tab click on Actions tab and click on Add and select the top most OU and click on OK button.(This part is option if u are using any rule to push this information then u will certainly need to do this if u are doing it manually then u can avoid it)
5. Select the option Hierarchy and make sure enabled is Yes and click on OK button.
6. Select the Entitlement Owner Business Role and in the Management Tab add the two roles UserReviewer and EntitlementReviewer ITRoles using the Action button.
7. Now click on user tab and search for the users to whom u want to add the owner for...now on selecting the user it will show all the permissions, basically u can select the permission and add them for which the selected person will be the owner of...

So if u want to automate this can u do it.....yes we can ....basically u will have to write a rule to do this..

To use a access owner certification go to the reviewers tab u have to select the option entitlement under entity...
Basically it will initiate a campaign for all the entitlements selected under this campaign and set their reviewers as the ones set as their owners.

Now the question is what happens to the default owners that are set on the permission directly rather than the admin role...well they will also be considered as the access owner for that entitlement and they will also get a review for that entitlement...