Access History - Attribute filtering

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

After some effort, I’ve found out how to exclude attributes from the Access History change detection. It is done by editing the YAMLConfig - AccessHistoryTransformConfig object and setting a transform script for accounts. eg:

    account:
      includeHash: true
      hashProperty: smartHash
      objectClassName: sailpoint.object.Link
      imagePropertyConfigDescriptors:
        - property: id
        - property: application
        - property: nativeIdentity
        - property: uuid
        - property: iiqLocked
        - property: iiqDisabled
        - property: displayName
        - property: displayableName
        - property: attributes
          type: none
          propertyTransformerConfigDescriptors:
            - type: sailpoint.dataextract.conversion.LinkApplicationAccountSchemaTransformer
              args:
                excludedKeys: displayName,IIQLocked,IIQDisabled
                objectConfigTypes: system,standard,unclear
          transformScripts:
            - |
              Map atts = property.getValueMap();
              atts.remove("last_login_time");
              atts.remove("last_login");
              atts.remove("LASTLOGIN");
              atts.remove("LAST_LOGOUT_DATETIME");
              atts.remove("lastDirSyncTime");
              return property;
        - property: extendedAttributes
          type: none
          propertyTransformerConfigDescriptors:
            - type: sailpoint.dataextract.conversion.AttributesWithExclusions
              args:
                objectConfigTypes: extended
        - property: attributes
          newName: extendedAttributesNamed
          type: none
          propertyTransformerConfigDescriptors:
            - type: sailpoint.dataextract.conversion.AttributesWithExclusions
              args:
                objectConfigTypes: named
        - property: componentIds
        - property: identity
          type: object
          objectName: identityRef
        - property: instance
        - property: lastRefresh
          hashExclude: true
        - property: lastTargetAggregation
          hashExclude: true
        - property: manuallyCorrelated

In the transform script, you need to remove each of the account attributes that change frequently but are not important to track.

Note that after setting the transform script, the next account change may result in a new capture record as a filtered attribute value is being changed to null. Subsequent changes to a filtered attribute value should not result in a new capture.

2

Thanks @paul_hilchey for sharing this. It is really useful.

3

Marking as solution to keep Codey happy.

4

On a related noted, I will mention that the Dispatch Access History task can use a lot of memory. A symptom of insufficient memory is the task taking a long time to complete. You can throw more memory at your jvm, or you can tune the task definition:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE TaskDefinition PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<TaskDefinition name="Dispatch Access History" resultAction="Delete" subType="task_item_type_system" type="System">
  <Attributes>
    <Map>
      <entry key="configuration" value="AccessHistoryExtractConfig"/>
      <entry key="enableNamedTimestamp" value="true"/>
      <entry key="maxExtractPartitions" value="500"/>
      <entry key="maxObjectsPerExtractPartition" value="5000"/>
      <entry key="partitions" value="5"/>
      <entry key="taskCompletionEmailNotify" value="Disabled"/>
      <entry key="taskCompletionEmailRecipients"/>
      <entry key="taskCompletionEmailTemplate"/>
    </Map>
  </Attributes>
  <Description>Transforms IdentityIQ objects to create a JSON message, and dispatches it to the access history service.</Description>
  <Parent>
    <Reference class="sailpoint.object.TaskDefinition" name="Access History"/>
  </Parent>
</TaskDefinition>

This reduces the partition size to 5,000 objects, from the default 50,000, with a corresponding reduction in memory usage.