14.2 Configuring Fulfillment

Identity Governance includes fulfillment types for various service desk products to enable fulfillment integration with your incident management applications. When you connect to an application for fulfillment, you must configure the connector to map the data fields in the change item to the input fields of the application. In a typical service desk environment, all systems and applications that the service desk manages are input as configuration management items.

Identity Governance exposes the following data fields from each changeset item to the fulfillment target connectors:

The following shows a sample change item payload:

{
    "accountProvId": "d2a293ff-71c5-492f-9415-e08830b635b2",
    "changeItemId": 8300,
    "changeRequestType": "REMOVE_PERMISSION_ASSIGNMENT",
    "userName": "Abby Spencer",
    "accountName": "aspencer",
    "account": "CN=Abby Spencer,OU=Users,OU=MyServer,DC=mydc,DC=mycompany,DC=com",
    "appName": "Money Honey Financials",
    "reason": "REMOVE_PERMISSION_ASSIGNMENT remove permission Marketing Portal requested by Aaron Corry while certifying Money Honey Financials",
    "requesterName": "Andrew Astin",
    "permName": "Marketing Portal",
    "permProvAttr": "member",
    "permProvId": "e07db779-5c30-44d2-bc0c-6dfa30cfa6af"
}

Fulfillment types use preconfigured templates that map the Identity Governance change item data and application-specific static values into various attributes in the SOAP XML payload. The WSDL from your service catalog request management application indicates any value constraints for input fields. The fulfillment target service can populate all valid fields in the service desk interface, so if you want to extend the set of fields that the Identity Governance template populates or modify the default mappings of the template, contact your Micro Focus technical support representative for details.

The service parameters and other fulfillment target configuration fields vary, depending on the fulfillment type selected for a fulfillment target, and Identity Governance provides default values for many of the fields, but you can choose to customize field values.

For example, the “BMC Remedy Incident” fulfillment type uses the HPD_IncidentInterface_Create SOAP service Helpdesk_Submit_Service method for creating incidents in the Remedy application. For example, http://your-service-host/arsys/WSDL/public/your_server/HPD_IncidentInterface_Create_WS. In addition, Fulfillment Item configuration mapping displays the fields listed in the table below.

Mapping Identity Governance change item data to target application data fields is similar to configuring data source collectors. This includes support for static value mapping and per-field data transformation. Regardless of the fulfillment type you select, you must place quotes around the static values used for fulfillment type configuration.

Since the implementation of any particular service desk application varies widely for each customer, it may be useful to manually create sample incidents using the application user interfaces to validate the desired inputs for each fulfillment target.

The Identity Governance fulfillment target configuration allows you to customize your incidents for these various systems. When you create a service desk fulfillment target in Identity Governance, you provide the connection information and credentials for the target system, as well as a default configuration specifying the fields you want Identity Governance to populate in your incidents. After you assign a target fulfillment system to an application, you can then customize that default configuration to appropriately map the application configuration item, assignment group, severity, and other fields for that specific application.

When you configure a fulfillment target using Active Directory/eDirectory LDAP, or CSV fulfillment types, keep in mind the following:

About Active Directory/eDirectory LDAP fulfillment

If a user is present in Identity Governance, but is not present in either Active Directory/eDirectory, you can configure the fulfillment target to create an account through the respective fulfillment targets.

To perform the this action, in Step 3 below, you must provide values for the first name, last name, title, and workforceID fields.

In addition, when you configure Fulfillment item configuration and mapping, click {...}, and then edit the transform script for Account name generation payload to connect to the correct Active Directory/eDirectory server for the user.

About CSV fulfillment

This fulfillment target creates a CSV file in the specified directory that contains the attributes you configured in the fulfillment target.

You can configure each application to use multiple fulfillment targets, or you can configure multiple applications to use multiple fulfillment targets. For example, you might have one system that processes all requests to add access and a different system that processes all requests to remove access.

If you need to configure multiple applications with the same fulfillment targets, you can use the bulk action to configure multiple fulfillment targets for multiple applications.

You can transform the incoming data from fulfillment targets to have Identity Governance display more meaningful information. For example, instead of displaying only the incident number from your fulfillment system, you could display additional text, such as “Incident number 123456 was created in ServiceNow” in Identity Governance.

The transforms are done through Nashorn-compatible Javascript in the Fulfillment Response mapping section of the fulfillment target configuration. Within the Javascript, you can access the incoming value by creating a variable name inputValue. After manipulating the incoming value, you can return the value to Identity Governance by assigning the value to a variable name outputValue.

The following example transforms the incoming value, which is a tracking number from the connected system to Incident number 123456 created in ServiceNow in the Identity Governance displays.

outputValue = 'Incident number ' + inputValue + ' created in ServiceNow'

For Identity Manager automated, Identity Manager workflow, and manual fulfillment targets, Identity Governance evaluates and fulfills the change items without the need for extensive configuration. When specifying one of the default methods of fulfillment, observe the following considerations:

For manual fulfillment targets, Identity Governance evaluates and fulfills the change items without the need for extensive configuration. When specifying manual fulfillment as the default method of fulfillment, observe the following considerations: