IPS transformation assignGroup and multiple groups assignment

[arturka]

Hi All

We are trying to assign groups to users via transformation. It works if no conditions are used. But  if we have more than one condition, only one group is assigned. SCIM 2.0 is used.

We have following gorups

on IAS

On Onprem 

Z_ABAP_GROUP_DEV,

Z_ABAP_GROUP_TST

User has both groups assigned on ABAP system. 

On source system transformation we have 

{
"targetPath": "$.groups[0].value",
"condition": "$.ACTIVITYGROUPS[?(@.AGR_NAME == 'Z_ABAP_GROUP_TST)] EMPTY false",
"constant": "xxxxxxxx-xxxxxx-xxxx-b94c-62bb6623cc84",
"preserveArrayWithSingleElement": true
},
{
"targetPath": "$.groups[1].value",
"condition": "$.ACTIVITYGROUPS[?(@.AGR_NAME == 'Z_ABAP_GROUP_DEV')] EMPTY false",
"constant": "xxxxxxx-xxxxx-xxxx-9074-ed731f26b374",
"preserveArrayWithSingleElement": true
}

And this works.

Payload is send to the Target transformation, both groups included

on Target side we have 

{
"condition": "$.groups[?(@.value == 'xxxxxxxx-xxxxxx-xxxx-b94c-62bb6623cc84')] EMPTY false",
"constant": [
{
"id": "xxxxxxxx-xxxxxx-xxx-b94c-62bb6623cc84"
}
],
"targetVariable": "assignGroup"
},
{
"condition": "$.groups[?(@.value == 'xxxxxxx-xxxxx-xxxx-9074-ed731f26b374')] EMPTY false",
"constant": [
{
"id": "xxxxxxx-xxxxx-xxxx-9074-ed731f26b374"
}
],
"targetVariable": "assignGroup"
}
 

In result only one group (with id xxxxx-xxxx-xxxx-9074-ed731f26b374 - second form transformation - TST)  is assigned to the user 

If user has only one OnPrem group assigned (...DEV with id xxxxxxxx-xxxxxx-xxx-b94c-62bb6623cc84 first in transformation) this group is assigned properly. 

Any idea how to fix this ? (Ticket to SAP raised) 

Following code if first "targetVariable": "assignGroup" is removed doesn't works as well 

{
"condition": "$.groups[?(@.value == 'xxxxxxxx-xxxxxx-xxxx-b94c-62bb6623cc84')] EMPTY false",
"constant": [
{
"id": "xxxxxxxx-xxxxxx-xxx-b94c-62bb6623cc84"
}
]
},
{
"condition": "$.groups[?(@.value == 'xxxxxxx-xxxxx-xxxx-9074-ed731f26b374')] EMPTY false",
"constant": [
{
"id": "xxxxxxx-xxxxx-xxxx-9074-ed731f26b374"
}
],
"targetVariable": "assignGroup"
}
 

Regards

Artur

[ThomasRauen]

Hi Artur, why do you need to check in the target tranformation again, if a group is "available"... you created a list of groups in your source-transformation for the user already... Maybe if you don't have the 2 blocks checking for each group individually but just have the standard:

{
        "sourcePath": "$.groups",
        "preserveArrayWithSingleElement": true,
        "optional": true,
        "targetPath": "$.corporateGroups"
},

it might work... or are there other groups in the source job as well that you don't necessarily want to be "provisioned"?

[arturka]

@ThomasRauen 

Thank you for answer. First check if only for group id assignment. Second check is only to be sure that $.groups isn't empty  to avoid an error. 

OnPrem users have few groups, not all need to be assigned to user in IAS. (eg, group Z_UPDATE_UUID is used only as a filter, for global ID sync between IAS and OnPrem systems for Sap Task Cockpit)

Groups are used in conditional authentication to some apps. 

Groups can't be created, deleted by replication from any source, only update is allowed. Groups can by only added or removed from user. 

Standard group mapping, rewrites groups and all assignments made manually or via replica from other systems are removed. I was trying to use skip 

    "group": {
        "skipOperations": [
            "create",
            "delete"
        ],
        "mappings": [
            {
                "sourceVariable": "entityIdTargetSystem",
                "targetPath": "$.id"
            },

But then I'm getting a message that groups can't be updated

As explained in 2708752 - Entities Aren't Updated in the Target System In Identity Provisioning Service  this isn't a bug but a feature. 

We have followed https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/enabling-group-assignment?... 

But there is some issue with group deletion 

if this code is used 

            {
                "condition": "$.groups[?(@.value == 'Z_TEST_DEV')] EMPTY true",
                "constant": [
                    {
                        "id": "xxxxx-xxxx-xxxxx-9aaf-877d9b25f806"
                    }
                ],
                "targetVariable": "unassignGroup"
            }

Error is generated (ticket to sap raised) 

These are the reasons we try to assign groups this way. Maybe I'm wrong, I'm still looking for a better solution:)

Thank you for your hint. 

A.

[ThomasRauen]

I see... In the documentation they put both constants in one "call"...

did you try enabling the *.support.patch.operation?

Cause maybe if he's doing a "PUT" it is always "overwriting" everything, Patch could avoid that...

[arturka]

Yes

[ThomasRauen]

Hmm... then I'm also running out of ideas... I guess for now it is only possible to have the "targetVariable": "assignGroups" for once and having it twice overwrites it... Last try could be to add a "preserveArrayWithSingleElement": true, to each block... maybe that avoids the overwriting...

[arturka]

Not helped.

Payload from source to target transformation 

And after target transformation 

[mondam01]

Having explored multiple options it seems this product limitation do not have a way around. I have raised a improvement request to SAP. Feel free to vote so developers can fix this. https://influence.sap.com/sap/ino/#/idea/337972

[ThomasRauen]

https://community.sap.com/t5/technology-blogs-by-sap/sap-cloud-identity-services-ips-how-to-assign-d...
Hm maybe we could also try to discuss the topic here as well to get SAP included in that topic