Account Correlation from API/Delimited File

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Is there a way to define an account correlation config via API or CSV?

I dont see any API to generate an Account Correlation Config, but I was told, by my contact at Accenture, that by default, the ‘e-mail’ property is used to match if a config is not defined

Scenario:
Authoritative source attributes.
id, name, givenName, familyName, email, displayName, idNowDescription

Source account schema has the defaults
id, name, givenName, familyName, e-mail, location, manager, groups

What happens when the Auth Source doesnt have ‘e-mail’ as in this case?
Can an account be correlated without a config if the schema matches the Auth Source?
Can the account auto correlate without a config if the attributes match?

2

Your auth source does have an email attribute, it’s just not named “e-mail” with the dash. That’s not a problem. You just need to manually map the email attribute on the identity to the email attribute on the account.

image
image3518×964 254 KB

3

@colin_mckibben

Sorry to seem so needy, I could probably reverse engineer a lot of this if we had our IDN instance, but we’re still waiting.

What we’re trying to accomplish is to be able to create a source and upload accounts from our system to sailpoint without the need to use the sailpoint GUI.

Is there a private api or something I can use to create the correlation config to make that mapping?

4

@colin_mckibben

From reading this

IdentityNow also contains default correlation logic which is applied any time an account fails to correlate based on the source’s correlation configuration. This default logic associates accounts to identities if the account’s displayName (the attribute marked as the Account Name in the account schema) matches the name attribute of the identity. This is not configurable.

So, if I set the displayName in the CSV to the name attr from the identity it should correlate?

5

@colin_mckibben

in the account schema, I dont see a “displayName” property, is this referring to the “displayAttribute”: “name”?

This is the default account schema I get when creating a source

  {
    "nativeObjectType": "User",
    "identityAttribute": "id",
    "displayAttribute": "name",
    "hierarchyAttribute": null,
    "includePermissions": false,
    "features": [],
    "configuration": {},
    "attributes": [
      {
        "name": "id",
        "type": "STRING",
        "schema": null,
        "description": "The unique ID for the account",
        "isMulti": false,
        "isEntitlement": false,
        "isGroup": false
      },
      {
        "name": "name",
        "type": "STRING",
        "schema": null,
        "description": "The name of the account - typical username etc",
        "isMulti": false,
        "isEntitlement": false,
        "isGroup": false
      },
      {
        "name": "givenName",
        "type": "STRING",
        "schema": null,
        "description": "The first or given name of the user associated with the account",
        "isMulti": false,
        "isEntitlement": false,
        "isGroup": false
      },
      {
        "name": "familyName",
        "type": "STRING",
        "schema": null,
        "description": "The last, family name, or surname of the user associated with the account",
        "isMulti": false,
        "isEntitlement": false,
        "isGroup": false
      },
      {
        "name": "e-mail",
        "type": "STRING",
        "schema": null,
        "description": "The primary e-mail address of the user associated with the account",
        "isMulti": false,
        "isEntitlement": false,
        "isGroup": false
      },
      {
        "name": "location",
        "type": "STRING",
        "schema": null,
        "description": "The location associated with this account",
        "isMulti": false,
        "isEntitlement": false,
        "isGroup": false
      },
      {
        "name": "manager",
        "type": "STRING",
        "schema": null,
        "description": "Reference to the manager of this particular account",
        "isMulti": false,
        "isEntitlement": false,
        "isGroup": false
      },
      {
        "name": "groups",
        "type": "STRING",
        "schema": {
          "type": "CONNECTOR_SCHEMA",
          "id": "8d4e510b3aa74984bd50b8c0a11f695c",
          "name": "group"
        },
        "description": "The groups, roles etc. that reference account group objects",
        "isMulti": true,
        "isEntitlement": true,
        "isGroup": true
      }
    ],
    "id": "c68be333c72c48dc8d13715b25801a19",
    "name": "account",
    "created": "2023-03-27T02:37:11.868Z",
    "modified": null
  },