How to record admin user id/name in newly provisioned user account?

Setup
, , , ,
1

Hi there,

We got the requirement that admin user (tenant admin) / the user admin who logged in with the authority to create new alpha user, while creating it we need to record who created this particular account (CREATED BY) and store that value.
Currently I am working on achieving it through event hooks but I don’t know how to access the user detail who created it.
Need help in this. Thanks in advance!

2

This information can be sourced from the Audit logs, where it is recorded for you. Why duplicate the effort or waste cycles persisting this data in the persistent data store?

3

hi @grpensa,

First of all thank you for ur response!
I understand that but the requirement is we need to push back this information to remote Identity as a value in attribute. That’s the reason we need to achieve this.

Thanks in advance!

4

Can anyone provide me solution for this. Thanks in advance!

5

Suriya,

Thank you for the update. Yes, the identity ReST API would of course have access to the identity in question. The repository api can be used to publish the additional information into a persistence store, and either the claims script or )(my preference) the policy engine can source these properties and include them as claims within your tokens.
Don’t forget to extend the schema of the DS to accommodate your new attribute, prior to this.

Let us know how you get on.
Guy.

6

Hi @grpensa ,
Thank you so much for ur response. But if I get any sample script to implement this requirement it would do a great help since I am new to this implementation.
Thanks in advance.

7

Hi Suriya

If you are writing an event hook, you should try to log the following and see if you can capture “CREATED BY” from either the context or the request.

nodeLogger.warn(“Context …” + context);
nodeLogger.warn(“Request …” + request);

1 Like
8

Hi @ajaykumar_suri ,
I am not familiar with this, so your suggesting to get it from context/request right.
For e.g.,
object.created_by = session.username; something like this?

Thank you so much for your response!

9

Hi Suriya,

As explained by @ajaykumar_suri, the way is to inspect the context from the onCreate/onUpdate event hooks (just log it). The context includes a security context, which might well have the information you need,

FYI → Request context chain :: IDM 7.4.0 and Script triggers defined in the managed object configuration :: IDM 7.4.0

Regards
Patrick

1 Like
10

hi @patrick_diligent ,

I am working on this but if I get any sample steps or scripts that would do a great help.

Thank you for your response.

11

Hi @Suriya,
As an example, in the User managed object schema definition, in the Script tab, select the OnCreate event and add the following inline script:

object.frUnindexedString4= "Created by: "+context.parent.parent.parent.parent.authenticationId;

it will add “Created by:” + userID in the frUnindexedString4 attribute.
I hope it helps,
regards,
Steph.

1 Like
12

Note that authentcationID is a numberID you may add a search idm to get the actual userName of the admin user. See below an example for P1AIC.

var user = openidm.read('managed/teammember/'+context.parent.parent.parent.parent.authenticationId);
object.frUnindexedString4= "Created by: "+user.userName;
1 Like
13

Hi @stephane.orluc ,

Thank you so much for your response. Through this I can able to capture the authenticationid of admin who creates account in Identity cloud platform UI.
But when I try to capture it in end user page of admin… for e.g., user who has internal role as idm-admin have permission to create the account. It is not able to capture authid through the code ur provided.

14 
var user = openidm.read('managed/teammember/'+context.parent.parent.parent.parent.authenticationId);
if (user) {
  object.frUnindexedString4= "Created by: "+user.userName;
} else {
  user = openidm.read('managed/alpha_user/'+context.parent.parent.parent.parent.parent.authenticationId);
  object.frUnindexedString4= "Created by: "+user.userName;
}
2 Likes
15

Hi Suriya,

It seems that @stephane.orluc has resolved your original query regarding, How to record admin user id/name in newly provisioned user account?. I’m glad we could help with that!
Please let us know if the example provided also resolves your inquiry re: trying to capture it in the end-user page of admin UI.

Thank you,

Sheila

16

Thank you for you solution @stephane.orluc ! It fixed my requirements.

1 Like
17

A safe implementation is to implement a recursive function that inspect the parent class , going up again until the security context is found, then print the authenticationId.

e.g

getSecutityContext(context) {
   parent = context.parent;
   while(parent !== null && parent.class !== "org.forgerock.services.context.SecurityContext") {
       parent = parent.parent;
   }
   return parent
}

var authId = null;
var securityContext = getSecurityContext(context);
if (parent !== null) {
    authId = securityContext.authenticationId;
}
4 Likes
18

thanks @patrick_diligent I love this recursive implem :ok_hand: !

1 Like