Provisioning Role Creation via TEWS: Sample SOAP Requests

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

This article provides sample SOAP requests for creating Provisioning Roles using the Task Execution Web Service (TEWS) in Identity Manager. These examples cover both scenarios: creating a role with an existing account template and creating a role without an account template (often referred to as a "birthright" role).

Environment

Identity Manager

Resolution

Before executing these requests, ensure you are using a SOAP client (such as SOAP UI) and have the correct credentials and endpoint values for your specific environment.

1. Create a Provisioning Role (Without Account Template) Use the following SOAP request to create a birthright role for global users:

   <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsdl="http://www.ca.com/iam/tews/wsdl1">  <soapenv:Header/>  <soapenv:Body>    <wsdl:CreateProvisioningRole>      <wsdl:Credentials>        <wsdl:AdminPassword>YOUR_PASSWORD</wsdl:AdminPassword>        <wsdl:AdminUserName>imadmin</wsdl:AdminUserName>      </wsdl:Credentials>      <wsdl:ProvisioningRole>        <wsdl:Name>Role_Without_Template</wsdl:Name>        <wsdl:Description>Birthright role example</wsdl:Description>        <wsdl:IsBirthright>true</wsdl:IsBirthright>      </wsdl:ProvisioningRole>    </wsdl:CreateProvisioningRole>  </soapenv:Body></soapenv:Envelope>

2. Create a Provisioning Role (With Existing Account Template) Use the following SOAP request to create a provisioning role that includes an existing account template:

   <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsdl="http://www.ca.com/iam/tews/wsdl1">  <soapenv:Header/>  <soapenv:Body>    <wsdl:CreateProvisioningRole>      <wsdl:Credentials>        <wsdl:AdminPassword>YOUR_PASSWORD</wsdl:AdminPassword>        <wsdl:AdminUserName>uid=im_admin_id,ou=imcd,dc=ca,dc=com</wsdl:AdminUserName>      </wsdl:Credentials>      <wsdl:ProvisioningRole>        <wsdl:Name>MY_NEW_PROV_ROLE_NAME</wsdl:Name>        <wsdl:AccountTemplate>          <wsdl:Name>MY_EXISTING_TEMPLATE</wsdl:Name>          <wsdl:Namespace>Oracle Server</wsdl:Namespace>        </wsdl:AccountTemplate>      </wsdl:ProvisioningRole>    </wsdl:CreateProvisioningRole>  </soapenv:Body></soapenv:Envelope>

3. Verify the Transaction Upon successful execution, the SOAP response will include a transaction ID, which can be used to track the task status:

   <wsdl:CreateProvisioningRoleResponse>    <wsdl:TransactionID>fd5f53e2-8f98351f-b921810e-0e85d8</wsdl:TransactionID></wsdl:CreateProvisioningRoleResponse>