Process - Standard service tasks in Identity Manager
This article includes updates for Smart ID 23.10.5.
Process: Assert Uniqueness Task
Description
Use this task to run a search configuration and trigger an ErrorBoundaryEvent with error code "uniquenessTestFailed" if a uniqueness criteria is not met. The event might cause a different process flow.
Configuration
To use this task, configure the following delegate expression in your service task:
${assertUniquenessParameterizedTask}
The following parameters can be configured in Identity Manager Admin:
Parameter | Mandatory | Value | Description |
|---|---|---|---|
searchConfigName |
| Defines the search configuration that should be used to count objects. During process execution the user must have the permission to execute the search configuration. It is possible to use a search configuration that searches over multiple levels. | |
minCount | - |
| The minimum number of objects that should be found. If the search finds less than minCount objects, the action will trigger an ErrorBoundaryEvent with error code "uniquenessTestFailed". Although neither minCount nor maxCount are mandatory, at least one of them must be specified. |
maxCount | - |
| The maximum number of objects that should be found. If the search finds more than maxCount objects, the action will trigger an ErrorBoundaryEvent with error code "uniquenessTestFailed". Although neither minCount nor maxCount are mandatory, at least one of them must be specified. |
resultVariableName | - | resultCount (used if nothing is specified) | Specifies where the number of found objects will be stored in the data map. The value is stored whether the condition is met or not. If no resultVariableName is specified, 'resultCount' is used as a default name. |
<Datapool_Field> | - |
| For configuring search fields, add a parameter for each search field. The name of the parameter should be the full name of the datapool field. The value has to contain the filter condition and value, separated by a colon symbol. For example:
If the underlying data source of the search configuration does not allow to query just the number of result objects, only as less objects as possible are fetched, but enough to find violations of minCount or maxCount. If the number of found objects equals to the upper limit, that was searched for, it is not possible to decide whether there are more objects. In such cases a hint is logged in debug mode: "The search has been restricted to 2 object(s) for performance reasons, but there might exist more objects". For more information, see <Datapool_Field> under Process: Execute Search Task. |
Process: Build ZIP file with binary data from search result
Description
Use this task to load pack binary data objects into a ZIP file. A CoreObjectDescriptor is needed (loaded in a service task before) to have a list with core objects which contain the binary data fields. Different binaries belonging to one core object can be packed together into one ZIP file (for example photo and signature). Reference-fields can also be added into zip, if they represent a binaryData (like softtoken).
Configuration
To use this task, configure the following delegate expression in your service task:
${buildZipFileFromBinariesParameterizedTask}
The following parameters can be configured in Identity Manager Admin:
Parameter | Mandatory | Value | Description |
|---|---|---|---|
resultVariableNameZipFile |
| Fieldname in the datamap where the builded zipFile is written to. | |
resultVariableNameZipName | - |
| Fieldname in the datamap where the name of the zipFile is written to. |
zipfileName |
| Example value:
| How the zipFile shall be named. fileExtension like '.zip' is needed. |
coreObjectDescriptorList |
| coreObjectDescriptor which contains a list of CoreObjects with binaryData | |
<name of the zipFile-Entry> | (minimum 1) | <name of binaryField to save into zipFIle> Example value:
|
|
Process: Copy Values of LoggedIn User to Process Map
Description
Use this task to copy information about the currently logged in user to the process data map. Since the parameters are optional, only those parameters where a value is provided are copied to the process data map.
Configuration
To use this task, configure the following delegate expression in your service task:
${copyValuesOfLoggedInUserToProcessMapParameterizedTask}
The following parameters can be configured in Identity Manager Admin:
Parameter | Mandatory | Value | Description |
|---|---|---|---|
userNameOutputField | - | userinfoUsername | The output field of the datamap which will contain the user name. |
userFullNameOutputField | - | userinfoUserFullName | The output field of the datamap which will contain the user's full name. |
userIdOutputField | - | userinfoUserid | The output field of the datamap which will contain the user id. |
userIpAdressOutputField | - | userinfoIpAddress | The output field of the datamap which will contain the user's IP address. |
userAuthProfileTypeOutputField | - | userinfoAuthprofileType | The output field of the datamap which will contain the users AuthProfileType (Enum is passed). |
userExplorerInstanceIdOutputField | - | userinfoExplorerInstanceId | The output field of the datamap which will contain the user's explorer instance ID if logged in through explorer. |
userUsspInstanceIdOutputField | - | userinfoUsspInstanceId | The output field of the datamap which will contain the user's Smart ID Self-Service instance ID if logged in through Smart ID Self-Service. |
userRolesOutputField | - | userinfoUserRoles | The output field of the datamap which will contain the user's assigned roles as a list. This is not meant to be used for the GUI and may result in issues. Use this, for example, in gateways like this:
|
userSamlTokenIDOutputField | - | userinfoSamlTokenID | The output field of the datamap which will contain the user's SAML Token ID. |
userSamlIssueInstantOutputField | - | userinfoSamlIssueInstant | The output field of the datamap which will contain the user's SAML IssueInstant. |
userLocaleOutputField | - | userinfoLocale | The output field of the datamap which will contain the user's selected Locale. |
Process: Delete Secret Field
Description
Use this task to delete a secret field from secret field store and clear the reference to it.
Configuration
To use this task, configure the following delegate expression in your service task:
${deleteSecretField}
The following parameters can be configured in Identity Manager Admin:
Parameter | Mandatory | Value | Description |
|---|---|---|---|
referenceField |
| The field to be deleted in secret field store. |
Process: Execute script
Description
Use this task to execute a script and put the result variables to the process map.
Configuration
To use this task, configure the following delegate expression in your service task:
${executeScriptTask}
The following parameters can be configured in Identity Manager Admin:
Parameter | Mandatory | Value | Description |
|---|---|---|---|
scriptName |
| The name of the script. |
Process: Execute Search Task
Description
Use this task to run a search configuration and put the result to the map as core object descriptor list or as the complete object.
Searches in external datapools, such as LDAP, SCIM or JDBC, need to be based on a CoreTemplate.
If the number of search results is equal to or more than maxCount this is logged in the Tomcat log file.
A process variable executeSearchResultCount will hold the number of the found entities.
Configuration
To use this task, configure the following delegate expression in your service task:
${executeSearchParameterizedTask}
The following parameters can be configured in Identity Manager Admin:
Parameter | Mandatory | Value | Description |
|---|---|---|---|
searchConfigName | - |
| Defines the search configuration that should be used to count objects. During process execution the user must have the permission to execute the search configuration. It is possible to use a search configuration that searches over multiple levels. Note: The binary data fields will not be loaded into the process map unless the search configuration has at least one binary data field in the result columns. |
maxCount |
| The maximum number of objects that should be found. | |
resultVariableName | - |
| Specifies the name of a variable of the data map, where the CoreObjectDescriptorList of the found objects is stored. |
copyValuesOfFirstResult | - | Valid values:
| This parameter decides whether the first found object is put completely to the map (true) or if the CoreObjectDescriptorList is put to the map (false). If set to true, resultVariableName will be ignored. maxCount will be ignored too and set to 1. |
fullResultListField | - | <variableName> | Variable in which the full search result will be stored inside the process map. Will be ignored if it is empty. |
TargetPrefix | - | <Prefix> Example: Manager_ | If the found objects fields should be added to the process map with a special prefix. It replaces the <Datapool_>, which is otherwise at this position. With this function, conflicting entries can be avoided. Example: Instead of "Person_Email" the data map will get an additional entry: "Manager_Email". |
sortColumn | - | <ColumnName> Example: FirstName | This parameter is the column name of the dataset, which is taken to order the search result. |
sortOrder | - | Valid values:
| Combo box to select if the search result is ordered ascending or descending. Default is ascending. |
<Datapool_Field> | - | <CONDITION>:<value> Examples:
Valid CONDITIONS:
|
You can also use the conjunctions AND and OR. For example: |
searchUniqueId | - | <value> Example: ${<Datapool>_Id} | It is the Unique ID (<Datapool>_Id) used to store records in the underlying database. The value can be a literal or a JUEL expression. This filter always uses equals to identify the record. In case of a related search, this is used to identify the Source Object. |
resultUniqueId | - | <value> Example: ${<Datapool>_Id} | It is the Unique ID (<Datapool>_Id) used to store records in the underlying database. The value can be a literal or a JUEL expression. This filter always uses equals to identify the record. In case of a related search, this is used to identify the Result Object. |
Process: Find Next Possible States
This action works only in context with batch orders.
Description
Use this task to find the next possible/valid states to a given core object state. If the multiple selected core objects (in a batch order) do have different states (for example active, inactive), an ErrorBoundaryEvent will be triggered.
Configuration
To use this task, configure the following delegate expression in your service task:
${findNextPossibleStates}
The following parameters can be configured in Identity Manager Admin:
Parameter | Mandatory | Value | Description |
|---|---|---|---|
dataPoolName |
| The datapool name of the underlying batch order. | |
resturnField |
| The name of the variable containing all the possible states (which were found). |
The task can be defined as follows:
<bean id="findNextPossibleStatesAction" class="de.vps.act.processexecution.state.FindNextPossibleStatesAction"> <property name="coreTemplateProvider" ref="coreTemplateProvider"/> <property name="stateGraphDefinitionManager" ref="stateGraphDefinitionManager"/> <property name="coreObjectDAO" ref="coreObjectDAO"/> </bean> <bean id="findNextPossibleStates" parent="parameterizedTask"> <property name="action" ref="findNextPossibleStatesAction" /> </bean>
Process: Load Entity
Description
Use this task to load an entity into the process map.
Given a datapool, a field, the field's value and optionally a core template, the matching entity will be loaded. If more than one entity matches, no entities will be added to the process map. A process variable loadEntityResultCount will hold the number of the found entities. Any value other than 1 can be considered an error.
Configuration
To use this task, configure the following delegate expression in your service task:
${loadEntityParameterizedTask}
The following parameters can be configured in Identity Manager Admin:
Parameter | Mandatory | Value | Description |
|---|---|---|---|
EntityDataPool | Person | The name of the entity's datapool. | |
EntityAttribute | The attribute of the entity that must match a certain value. | ||
EntityAttributeValue | ${Person_Email} or ${user.Person_Email} | The value that EntityAttribute must match. Most of the time, an expression will be used here. Also special expressions like ${user.*} are possible, to use values from the authenticated User or from system.properties (${sysprop.*} | |
EntityCoreObject |
|
| The core template of the entity. This limits the search to objects of this core template. |
EntityCoreObjectIdField |
| coreObjectId | The field in which the CoreObjectId is added in the process map. |
EntityCoreObjectDescField |
| coreObjectDescriptor | The field in which the CoreObjectDescriptor is added in the process map. |
EntityRolesField |
| roles | The field in which the roles of the object is added in the process map. |
ExclusiveLoadFields |
| FirstName,LastName,Email | If not the complete dataset should be loaded, only the ones defined here are loaded/added in the process map. |
TargetPrefix |
| Manager_ | If the found objects fields should be added to the process map with a special prefix. It replaces the <Datapool_>, which is otherwise at this position. With this function, conflicting entries can be avoided. Example: Instead of "Person_Email" the data map will get an additional entry: "Manager_Email". |
Process: Load Entity on Certificate Attribute
Description
This task expects a certificate in the process map and loads an entity from the DB, based on a value of the certificate. You configure what kind of entity (Person, Server etc) and which certificate field should match which field of the entity. A case insensitive search is performed. If exactly one entity is found, it will be added to the process map. If more that one entity is found, no entities will be added to the process map. A process variable loadCertificateMatchingEntityResultCount will hold the number of the found entities. Any value other than 1 can be considered an error.
This task can be used to establish an objectRelation between the certificate and an entity.
Configuration
To use this task, configure the following delegate expression in your service task:
${loadCertificateMatchingEntityParameterizedTask}
The following parameters can be configured in Identity Manager Admin:
Note: Values are case sensitive.
Copyright 2024 Technology Nexus Secured Business Solutions AB. All rights reserved.
Contact Nexus | https://www.nexusgroup.com | Disclaimer | Terms & Conditions