What is a one sentence summary of your feature request?
Include the validity dates (start and end) of role assignments (Navigation Rules) directly in the JSON flow of the PowerShell provisioning orders.
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
As part of integrating a target system (Oracle EBS) via the PowerShellProv connector, our customer requires that we be able to define a custom end-of-validity date (EXPIRATION_DATE) when a specific role is assigned to a user.
Currently, when a role is assigned in Usercube, the Fulfillment script receives a JSON object containing the array $order.Changes.Roles_add (or Roles_remove). However, this object only includes the scalar properties of the target role itself (e.g., Id, NAME, DISPLAY_NAME, STATUS). What’s missing is the “association” “metadata”: specifically, the start date and end date of that role assignment as they may have been set in Usercube (via a request with an expiration date, or via a SingleRole).
The ideal solution would be to enrich the objects contained in Roles_add and Roles_remove in the JSON payload with properties such as NavigationStartDate and NavigationEndDate. This would allow the PowerShell script to capture these dates and map them dynamically when calling the target system’s API via POST, thereby fully complying with the security policy (scheduled de-provisioning).
How do you currently solve the challenges you have by not having this feature?
For the moment, we are forced to work around the issue in a rigid (hardcoded) way in our Fulfillment script. When an Added or Modified event occurs on roles, the script systematically sets the script execution date (Date of today) as the start date, and returns an empty string or null for the end date.
As a result, it is technically impossible for us to apply and propagate a custom role expiration to the target system.