Account Aggregation - Filter to get only enabled accounts

[SindhuVMurthy]

Hi Team,

We are integrating Web Service Connector and currently we want to aggregate only the Enabled accounts and we do not want to aggregate Disabled accounts. As we are using API’s here is there any filter for API URL through which I can achieve this?

Can you please help me with this information

[Carlatto (Carl Nelson)]

Take a look at this Compass page.

https://community.sailpoint.com/t5/IdentityNow-Wiki/IdentityNow-Account-Filtering-during-Account-Aggregation/ta-p/142873

[zachm117 (Zach Mullins)]

Using the documentation Carl provided, you would probably want to construct a filter on your AD source using either userAccountControl or ms-DS-User-Account-Disabled. userAccountControl is a bit tricky to build an LDAP filter for, here is a site that explains it a bit more: LDAP Filtering

That site includes an example of an LDAP filter that might fit your usecase.

(!(userAccountControl:1.2.840.113556.1.4.803:=2))

This will exclude all accounts that have the disabled flag set on their userAccountControl value.

[sai_krishna_L (sai krishna)]

hi @Carlatto /@zachm117,

We have followed the above documentation and tried the below JSON expressions.

[
  {
    "op": "replace",
    "path": "/connectorAttributes/filterString",
    "value": "(status == \"A\")"
  }
]

2. I have tried account.filterString
3. I have tried the various values like :
   “value”: “(status == "A")”
   “value”: “((active == true) && (status.containsIgnoreCase("A")))”
   “value”: “(active == true)”
   “value”: “active == false”
   They are not working as expected for Account aggregation.
   We are using this for Webservice connector as the expected results should be to read only the active:true and status:A in the account schema. Currently we are able to see the disabled accounts also after the aggregation.

Can you please help me here as I am not able to aggregate only the enabled accounts.

[The_IAMSheriff (Amar Sheriff)]

Hi There,

If I understand correctly, the value that matches the filterString is not aggregated and the property must be part of the account schema.
Perhaps the below JSON or similar could work: -

[
  {
    "op": "add",
    "path": "/connectorAttributes/filterString",
    "value": "(Inactive != false)"
  }
]

OR

[
  {
    "op": "add",
    "path": "/connectorAttributes/filterString",
    "value": "(status.containsIgnoreCase(\"disabled"))"
  }
]

Hope that helps

[sai_krishna_L (sai krishna)]

hi @The_IAMSheriff,

Please find the snippets, as the I am able to see 62 account in the Account aggregation tab.
But in the accounts tab I can see overall accounts.

PFA,

Let me know if there is anything to change in the configuration.