12.3 Configuring Rapid Setup Aggregation Settings

Configuring Rapid Setup Aggregation Settings

Objective 5.3 asks you to configure Rapid Setup aggregation settings. Rapid Setup (section 5.4) separates technical onboarding from business onboarding. Technical onboarding (connection parameters, schema, test connection, authoritative flag) is done first in Application Definition. Business onboarding covers how accounts should be interpreted and what happens as people join, move, and leave. The Aggregation section of Applications > Rapid Setup is where a business-savvy administrator tells IdentityIQ how to interpret an application's accounts.

The documentation stresses that Rapid Setup does not add new aggregation functions. It offers a guided way to set options that otherwise need rules or application-definition settings. Sample rules for Rapid Setup are in WEB-INF/config/rapidsetup/rsexamplerules.xml.

Prerequisites

• The application exists with its connection parameters and schema, a successful test connection, and a decision on whether it is authoritative.
• Lifecycle Manager is licensed and activated, because Rapid Setup comes with LCM.
• Helpful extras: populations, birthright roles, provisioning policies, and email templates prepared in advance.

The Aggregation Settings

1. Create Entitlements That Cannot Be Requested

When enabled, entitlements created by aggregation for this application are not requestable, either from the Entitlement Catalog or in access requests. Use it for applications whose access should come only from roles or birthright processes, never from self-service.

2. Disable Account / Lock Account

Some applications have no native concept of disabled or locked accounts, such as a flat file with a STATUS column. For these, Rapid Setup shows Disable Account and Lock Account filters:

• The filters appear only for applications that do not natively support disable or lock.
• If a filter matches an account during aggregation, IdentityIQ marks the account disabled or locked.
• These filters take precedence over aggregation customization rules defined elsewhere. The documentation notes that a Customization rule is the other way to mark accounts disabled or locked.

Example: Disable Account when STATUS Equals T, so terminated rows in an HR extract appear as disabled accounts in IdentityIQ.

3. Account and Manager Correlation

• Account correlation: choose an application attribute that uniquely identifies the account, an operator (usually Equals), and the identity attribute it matches. Example: EMP_NO equals employeeId.
• Manager correlation: choose the application attribute that identifies the manager and the identity attribute to match. This is usually the same identity attribute used for account correlation, for example MGR_EMP_NO equals employeeId.
• Limits: Rapid Setup supports only one account correlation method and one manager correlation method per application, with no multiple correlation rules. If correlation is already defined in the application definition, Rapid Setup shows it by default so you can edit it or replace it.

4. Service Account and RPA Account Correlation

Filters identify service and RPA (bot) accounts from application attributes:

Only one Service filter and one RPA filter are allowed per application. Correctly typed identities matter later. Certifications can target bots, and access reviews for Service or RPA/Bot identities go to the certifier configured for them. The Leaver process can reassign identities the leaver administered.

How Aggregation Settings Connect to Joiner Processing

The joiner options on the same page depend on good aggregation settings:

• Automatically Start Joiner Processing for Newly Created Identities starts joiner processing during aggregation when a new identity is created. That only happens reliably if authoritative correlation is right.
• It is not available for non-authoritative accounts when the global joiner configuration excludes uncorrelated identities.
• Perform Account-Only provisioning creates accounts on this application for joiners who match the identity selection (Everyone, Filter, Script, IdentitySelector Rule, or Population).

Rapid Setup vs. Full Application Definition

Worked Example: Onboarding a Payroll Application With Rapid Setup

An administrator has created a JDBC application, Payroll, with a working connection and schema (EMP_NO, STATUS, MGR_EMP_NO, SVC_FLAG). On Applications > Rapid Setup, they set:

1. Create Entitlements That Cannot Be Requested: on, because payroll roles come only from birthright processing.
2. Disable Account filter: STATUS Equals I, so inactive payroll records appear as disabled accounts.
3. Account correlation: EMP_NO equals the identity attribute employeeId. Manager correlation: MGR_EMP_NO equals employeeId.
4. Service Account filter: SVC_FLAG Equals Y, so these accounts' identities get the Type Service Account.
5. Joiner: Perform Account-Only provisioning for the Payroll Staff population.

After a sandbox aggregation, the administrator checks that no payroll entitlement is requestable, that inactive rows show as disabled, and that service accounts are no longer uncorrelated.

Troubleshooting

Turn on debug logging for sailpoint.rapidsetup and sailpoint.workflow.RapidSetupLibrary in log4j2.properties (section 14.1). Then rerun aggregation and check the task result and the affected accounts' flags and identity links.