Overview

Using the Provisioning capabilities on Hire2Retire you can provision and deprovision users on any Provisioning software through HTTP REST Connector for various employee lifecycle changes. A REST Connector gives users the flexibility to integrate with any third-party application that supports REST API for provisioning.

Figure 1. Adding REST Connector

Figure 2. HTTP REST Connector on Hire2Retire

Define Role Definition

Provisioning Type

Define Role(s)

You can assign a Role to any user based on their AD attributes. You can define complex conditions using AND and OR logic. You can also use the Group memberships in AD to define Roles. For example:In Figure 2, user(s) with Security Groups "ReleaseProduct" will get provisioned. Only users who get a Role assigned based on the conditions, will be provissioned. If the user is unassigned from a role based on their updated profile in AD, and you have selected to deprovision using Hire2Retire, user will be deprovisioned from Access.

Figure 2. Provision users with following rule definitions

Process All users

All user(s) will be provisioned on Access.

Figure 3. Process all Employees

Provision User

GET Endpoint

You can provide a GET endpoint with employee idetifier mapped to it. This will be used for checking whether user exists or not in the provisioning application before provisioning or deprovisioning user.

Figure 7. Request Body key value pairs for HTTP REST Connector

Provisioning

Create or Update User

You can provide an endpoint for creating and updating user in the provisioning application. By default, the HTTP method selected is POST but you can change it accordingly. You can provide appropriate header and params in their respective section. While creating or updating user, you can directly provide entitlements in the body itself.

Figure 7. Request Body key value pairs for HTTP REST Connector

Update user

If the provisioning application you are using provides different endpoint for updating user, you can click 'Enable this if a separate API is needed to update user account in provisioning application' checkbox. Now you can enter a different HTTP method, endpoint, header and params for update operation.

Figure 7. Request Body key value pairs for HTTP REST Connector

Deprovisioning

You can provide an endpoint for deprovisioning user in the SCIM application. By default, the HTTP method selected is Patch but you can change it accordingly. you can provide appropriate header and params in their respective section.

Figure 7. Request Body key value pairs for HTTP REST Connector

Note - Currently we support update and deprovisiong operation through Employee Identifier (UPN ) only.

Request URL

You can provide endpoint url for performing provisioning and deprovisioning in your SCIM application. You can also select HTTP method for the endpoint url.

Request headers, params and body

You can add request parameters, headers and request body with HTTP REST Connector. There are tabs avaliable for each section.

Params You can specify query parameters to filter, sort, or specify criteria for the request. These parameters will be added to the request url.

Headers You can provide request headers like Content-Type, etc., in the request headers tab to communicate additional information beyond the URL and request method.

Body Request body gives you space to add the key value pairs in form data or raw JSON object directly. It will create user account on your provisioning application. You can select the attributes of the user that you want to populate. You can map values from the AD to populate these attributes. You can also use Hire2Retire's powerful data transformation capabilities using Excel Style functions.