Attribute sync not triggered for manager attribute

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

8.3 p4

Share all details about your problem, including any error messages you may have received.

On our IdentityIQ instance, we have an OpenLDAP Direct application with provisioning configured. Account creation has been tested and work fine, all attributes are properly populated.

We also configured target mapping for multiple attributes, including the manager attribute.
To test attribute sync, I do the following:

  • Create an identity from quicklinks
  • Assign to the identity a role with an entitlement to the OpenLDAP application
  • Check that the account is created in OpenLDAP
  • Update the target attribute
  • Check the provioning operations in the access request record
  • Check the account in OpenLDAP

For simple attributes like strings such as firstname, email etc. I can see the operation in the access request record.

But for manager, the operation does not appear in the access request record. Refreshing identities does not trigger any provisioning update either.

Interstingly the manager attribute DOES show up in the plan and DOES get populated if I subsequently, in a later request, update another identity such as lastname.

See below the 3 cases I described above.

singleimage
singleimage4339×2474 973 KB

Please find below the target attribute configuration for the manager attribute. The configuration uses a rule that fetches the identity’s manager’s ID and returns the appropriate DN of that manager.

  <ObjectAttribute displayName="Manager" editMode="ReadOnly" groupFactory="true" name="manager" standard="true" type="sailpoint.object.Identity">
    <AttributeSource name="managerID">
      <ApplicationRef>
        <Reference class="sailpoint.object.Application" name="authoritativeSource"/>
      </ApplicationRef>
    </AttributeSource>
    <AttributeTargets>
      <AttributeTarget name="manager" provisionAllAccounts="true">
        <ApplicationRef>
          <Reference class="sailpoint.object.Application" name=OpenLDAP"/>
        </ApplicationRef>
        <RuleRef>
          <Reference class="sailpoint.object.Rule" name="tOpenLDAPManagerAttributeTarget"/>
        </RuleRef>
      </AttributeTarget>
    </AttributeTargets>
  </ObjectAttribute>

Where can I manage to have the manager attribute synchronized directly when it’s updated, and not only after another identity attribute gets subsequently updated?

We are using the standard LCM workflows shipped with IdentityIQ, left untouched.

2

I believe the problem you have here is with editMode of Manager attribute, as it’s “ReadOnly” provisioning engine is filtering it out so it’s not going straight forward to the identity. Try to change it to permanent and see if it starts working.

3

Hello Kamil,
Thanks for your reply.
I tried this change but unfortunately the result remains the same.

Besides, the attribute change actually does get populated to the iiq identity. The problem is that the account request updating the OpenLDAP account is not expended to the plan.

Let me add more details.
Below is the XML of the IdentityRequest that updates the manager identity attribute, but fails to populate it to the OpenLDAP account.

<IdentityRequest completionStatus="Success" created="1746004667183" endDate="1746004697890" executionStatus="Completed" id="0ab2006d96851512819685fceb2f0127" modified="1746004697891" name="0000000074" priority="Normal" requesterDisplayName="WOLF Arnaud" requesterId="0ab2006b94811a8581949f8f417b2d86" source="LCM" state="End" targetClass="Identity" targetDisplayName="TINTERNE0000 Testinterne" targetId="0ab2006b96851500819685e544c9005b" type="IdentityEditRequest" verified="1746004697890">
  <Attributes>
    <Map>
      <entry key="provisionedProject">
        <value>
          <ProvisioningProject identity="TINTERNE0000">
            <Attributes>
              <Map>
                <entry key="disableRetryRequest">
                  <value>
                    <Boolean>true</Boolean>
                  </value>
                </entry>
                <entry key="identityRequestId" value="0000000074"/>
                <entry key="optimisticProvisioning" value="false"/>
                <entry key="requester" value="spadmin"/>
                <entry key="source" value="LCM"/>
              </Map>
            </Attributes>
            <Filtered>
              <AccountRequest application="OpenLDAP" nativeIdentity="uid=TINTERNE0000,ou=people,o=corp" op="Modify">
                <AttributeRequest name="manager" op="Set" value="uid=TEST00002,ou=people,o=corp">
                  <Attributes>
                    <Map>
                      <entry key="reason">
                        <value>
                          <FilterReason>Exists</FilterReason>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                </AttributeRequest>
                <AttributeRequest name="cn" op="Set" value="TINTERNE0000 Testinterne">
                  <Attributes>
                    <Map>
                      <entry key="reason">
                        <value>
                          <FilterReason>Exists</FilterReason>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                </AttributeRequest>
                <AttributeRequest name="sn" op="Set" value="Testinterne blabla">
                  <Attributes>
                    <Map>
                      <entry key="reason">
                        <value>
                          <FilterReason>Exists</FilterReason>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                </AttributeRequest>
                <AttributeRequest name="objectClass" op="Add">
                  <Attributes>
                    <Map>
                      <entry key="reason">
                        <value>
                          <FilterReason>Exists</FilterReason>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                  <Value>
                    <List>
                      <String>top</String>
                      <String>inetOrgPerson</String>
                    </List>
                  </Value>
                </AttributeRequest>
                <AttributeRequest name="givenName" op="Set" value="TINTERNE0000">
                  <Attributes>
                    <Map>
                      <entry key="reason">
                        <value>
                          <FilterReason>Exists</FilterReason>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                </AttributeRequest>
                <AttributeRequest name="mail" op="Set" value="[email protected]">
                  <Attributes>
                    <Map>
                      <entry key="reason">
                        <value>
                          <FilterReason>Exists</FilterReason>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                </AttributeRequest>
                <AttributeRequest name="tPresent" op="Set">
                  <Attributes>
                    <Map>
                      <entry key="reason">
                        <value>
                          <FilterReason>Exists</FilterReason>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                  <Value>
                    <Boolean>true</Boolean>
                  </Value>
                </AttributeRequest>
              </AccountRequest>
            </Filtered>
            <MasterPlan>
              <ProvisioningPlan>
                <AccountRequest application="IIQ" nativeIdentity="TINTERNE0000" op="Modify">
                  <Attributes>
                    <Map>
                      <entry key="flow" value="IdentityEditRequest"/>
                      <entry key="id" value="7ee20400cbbd42f98649e1267a035eba"/>
                      <entry key="interface" value="LCM"/>
                      <entry key="operation" value="Modify"/>
                    </Map>
                  </Attributes>
                  <AttributeRequest name="manager" op="Set" value="TEST00000">
                    <Attributes>
                      <Map>
                        <entry key="previousValue" value="TESTUSER2"/>
                        <entry key="source">
                          <value>
                            <SourceType>UI</SourceType>
                          </value>
                        </entry>
                      </Map>
                    </Attributes>
                  </AttributeRequest>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="identityRequestId" value="0000000074"/>
                    <entry key="requester" value="spadmin"/>
                    <entry key="source" value="LCM"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </MasterPlan>
            <ProvisioningPlan targetIntegration="IIQ" trackingId="d86a875782db4bb7b8b4568472e7b16b">
              <AccountRequest application="IIQ" nativeIdentity="TINTERNE0000" op="Modify" targetIntegration="IIQ">
                <Attributes>
                  <Map>
                    <entry key="flow" value="IdentityEditRequest"/>
                    <entry key="id" value="7ee20400cbbd42f98649e1267a035eba"/>
                    <entry key="interface" value="LCM"/>
                    <entry key="operation" value="Modify"/>
                  </Map>
                </Attributes>
                <AttributeRequest name="manager" op="Set" value="TEST00000">
                  <Attributes>
                    <Map>
                      <entry key="previousValue" value="TESTUSER2"/>
                      <entry key="source">
                        <value>
                          <SourceType>UI</SourceType>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                </AttributeRequest>
              </AccountRequest>
              <Attributes>
                <Map>
                  <entry key="identityRequestId" value="0000000074"/>
                  <entry key="requester" value="spadmin"/>
                  <entry key="source" value="LCM"/>
                </Map>
              </Attributes>
            </ProvisioningPlan>
            <ProvisioningTarget assignmentId="bede4590efc1411bab0ef37cfd50c8b1" retain="true" role="Business_ROpenLDAP_Test">
              <AccountSelection applicationId="0ab2006d963d1dfa81963e2658c200d5" applicationName="OpenLDAP" selection="uid=TINTERNE0000,ou=people,o=corp">
                <AccountInfo displayName="TINTERNE0000 Testinterne" nativeIdentity="uid=TINTERNE0000,ou=people,o=corp"/>
              </AccountSelection>
            </ProvisioningTarget>
          </ProvisioningProject>
        </value>
      </entry>
      <entry key="taskResultId" value="0ab2006d96851512819685fcea400124"/>
    </Map>
  </Attributes>
  <RequestItems>
    <IdentityRequestItem application="IIQ" created="1746004667181" id="0ab2006d96851512819685fceb2d0126" modified="1746004697690" name="manager" nativeIdentity="TINTERNE0000" operation="Set" provisioningEngine="IIQ" provisioningState="Finished" value="TEST00000">
      <Attributes>
        <Map>
          <entry key="flow" value="IdentityEditRequest"/>
          <entry key="id" value="7ee20400cbbd42f98649e1267a035eba"/>
          <entry key="interface" value="LCM"/>
          <entry key="managedAttributeType" value="Entitlement"/>
          <entry key="operation" value="Modify"/>
          <entry key="provisioningPlan">
            <value>
              <ProvisioningPlan trackingId="c5da534ec2d54296afb774bc91918c31">
                <AccountRequest application="IIQ" nativeIdentity="TINTERNE0000" op="Modify">
                  <Attributes>
                    <Map>
                      <entry key="flow" value="IdentityEditRequest"/>
                      <entry key="id" value="7ee20400cbbd42f98649e1267a035eba"/>
                      <entry key="interface" value="LCM"/>
                      <entry key="operation" value="Modify"/>
                    </Map>
                  </Attributes>
                  <AttributeRequest name="manager" op="Set" trackingId="c5da534ec2d54296afb774bc91918c31" value="TEST00000">
                    <Attributes>
                      <Map>
                        <entry key="previousValue" value="TESTUSER2"/>
                        <entry key="source">
                          <value>
                            <SourceType>UI</SourceType>
                          </value>
                        </entry>
                      </Map>
                    </Attributes>
                  </AttributeRequest>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="source" value="LCM"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </value>
          </entry>
        </Map>
      </Attributes>
    </IdentityRequestItem>
  </RequestItems>
</IdentityRequest>

Below is the request for which the purpose was to update the lastname attribute, but ended up also adding in the provisioning plan the update of the manager attribute in OpenLDAP account. The intersting thing is that the expansion cause is “ProvisioningPolicy” instead of “AttributeSync” for that attribute. And I don’t know why.

<IdentityRequest completionStatus="Pending" created="1746014971465" endDate="1746015001134" executionStatus="Verifying" id="0ab2006c968514ff8196869a26490147" modified="1746015001135" name="0000000075" priority="Normal" requesterDisplayName="WOLF Arnaud" requesterId="0ab2006b94811a8581949f8f417b2d86" source="LCM" state="End" targetClass="Identity" targetDisplayName="TINTERNE0000 Testinterne" targetId="0ab2006b96851500819685e544c9005b" type="IdentityEditRequest">
  <Attributes>
    <Map>
      <entry key="provisionedProject">
        <value>
          <ProvisioningProject identity="TINTERNE0000">
            <Attributes>
              <Map>
                <entry key="disableRetryRequest">
                  <value>
                    <Boolean>true</Boolean>
                  </value>
                </entry>
                <entry key="identityRequestId" value="0000000075"/>
                <entry key="optimisticProvisioning" value="false"/>
                <entry key="requester" value="spadmin"/>
                <entry key="source" value="LCM"/>
              </Map>
            </Attributes>
            <Filtered>
              <AccountRequest application="OpenLDAP" nativeIdentity="uid=TINTERNE0000,ou=people,o=corp" op="Modify">
                <AttributeRequest name="cn" op="Set" value="TINTERNE0000 Testinterne">
                  <Attributes>
                    <Map>
                      <entry key="reason">
                        <value>
                          <FilterReason>Exists</FilterReason>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                </AttributeRequest>
                <AttributeRequest name="objectClass" op="Add">
                  <Attributes>
                    <Map>
                      <entry key="reason">
                        <value>
                          <FilterReason>Exists</FilterReason>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                  <Value>
                    <List>
                      <String>top</String>
                      <String>inetOrgPerson</String>
                      <String>organizationalPerson</String>
                      <String>person</String>
                    </List>
                  </Value>
                </AttributeRequest>
                <AttributeRequest name="givenName" op="Set" value="TINTERNE0000">
                  <Attributes>
                    <Map>
                      <entry key="reason">
                        <value>
                          <FilterReason>Exists</FilterReason>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                </AttributeRequest>
                <AttributeRequest name="mail" op="Set" value="[email protected]">
                  <Attributes>
                    <Map>
                      <entry key="reason">
                        <value>
                          <FilterReason>Exists</FilterReason>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                </AttributeRequest>
                <AttributeRequest name="tPresent" op="Set">
                  <Attributes>
                    <Map>
                      <entry key="reason">
                        <value>
                          <FilterReason>Exists</FilterReason>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                  <Value>
                    <Boolean>true</Boolean>
                  </Value>
                </AttributeRequest>
              </AccountRequest>
            </Filtered>
            <MasterPlan>
              <ProvisioningPlan>
                <AccountRequest application="IIQ" nativeIdentity="TINTERNE0000" op="Modify">
                  <Attributes>
                    <Map>
                      <entry key="flow" value="IdentityEditRequest"/>
                      <entry key="id" value="1569134f12cd446c836d1c401ac2a25c"/>
                      <entry key="interface" value="LCM"/>
                      <entry key="operation" value="Modify"/>
                    </Map>
                  </Attributes>
                  <AttributeRequest name="lastname" op="Set" value="Testinterne SuperEmployee">
                    <Attributes>
                      <Map>
                        <entry key="previousValue" value="Testinterne blabla"/>
                        <entry key="source">
                          <value>
                            <SourceType>UI</SourceType>
                          </value>
                        </entry>
                      </Map>
                    </Attributes>
                  </AttributeRequest>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="identityRequestId" value="0000000075"/>
                    <entry key="requester" value="spadmin"/>
                    <entry key="source" value="LCM"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </MasterPlan>
            <ProvisioningPlan targetIntegration="IIQ" trackingId="1adac7b9f7134652923b700be3965605">
              <AccountRequest application="IIQ" nativeIdentity="TINTERNE0000" op="Modify" targetIntegration="IIQ">
                <Attributes>
                  <Map>
                    <entry key="flow" value="IdentityEditRequest"/>
                    <entry key="id" value="1569134f12cd446c836d1c401ac2a25c"/>
                    <entry key="interface" value="LCM"/>
                    <entry key="operation" value="Modify"/>
                  </Map>
                </Attributes>
                <AttributeRequest name="lastname" op="Set" value="Testinterne SuperEmployee">
                  <Attributes>
                    <Map>
                      <entry key="previousValue" value="Testinterne blabla"/>
                      <entry key="source">
                        <value>
                          <SourceType>UI</SourceType>
                        </value>
                      </entry>
                    </Map>
                  </Attributes>
                </AttributeRequest>
              </AccountRequest>
              <Attributes>
                <Map>
                  <entry key="identityRequestId" value="0000000075"/>
                  <entry key="requester" value="spadmin"/>
                  <entry key="source" value="LCM"/>
                </Map>
              </Attributes>
            </ProvisioningPlan>
            <ProvisioningPlan nativeIdentity="TINTERNE0000" targetIntegration="OpenLDAP" trackingId="bdad90f9ab354d229fee5659f81a90ec">
              <AccountRequest application="OpenLDAP" nativeIdentity="uid=TINTERNE0000,ou=people,o=corp" op="Modify" targetIntegration="OpenLDAP">
                <AttributeRequest name="sn" op="Set" value="Testinterne SuperEmployee"/>
                <AttributeRequest name="manager" op="Set" value="uid=TEST00000,ou=people,o=corp"/>
                <ProvisioningResult status="committed"/>
              </AccountRequest>
              <Attributes>
                <Map>
                  <entry key="identityRequestId" value="0000000075"/>
                  <entry key="requester" value="spadmin"/>
                  <entry key="source" value="LCM"/>
                </Map>
              </Attributes>
              <ProvisioningResult status="committed"/>
            </ProvisioningPlan>
            <ProvisioningTarget assignmentId="bede4590efc1411bab0ef37cfd50c8b1" retain="true" role="Business_ROpenLDAP_Test">
              <AccountSelection applicationId="0ab2006d963d1dfa81963e2658c200d5" applicationName="OpenLDAP" selection="uid=TINTERNE0000,ou=people,o=corp">
                <AccountInfo displayName="TINTERNE0000 Testinterne" nativeIdentity="uid=TINTERNE0000,ou=people,o=corp"/>
              </AccountSelection>
            </ProvisioningTarget>
          </ProvisioningProject>
        </value>
      </entry>
      <entry key="taskResultId" value="0ab2006c968514ff8196869a252b0144"/>
    </Map>
  </Attributes>
  <RequestItems>
    <IdentityRequestItem application="IIQ" created="1746014971461" id="0ab2006c968514ff8196869a26450146" modified="1746015000941" name="lastname" nativeIdentity="TINTERNE0000" operation="Set" provisioningEngine="IIQ" provisioningState="Finished" value="Testinterne SuperEmployee">
      <Attributes>
        <Map>
          <entry key="flow" value="IdentityEditRequest"/>
          <entry key="id" value="1569134f12cd446c836d1c401ac2a25c"/>
          <entry key="interface" value="LCM"/>
          <entry key="managedAttributeType" value="Entitlement"/>
          <entry key="operation" value="Modify"/>
          <entry key="provisioningPlan">
            <value>
              <ProvisioningPlan trackingId="4b5606bc00ae46b9a186b146ad230fd6">
                <AccountRequest application="IIQ" nativeIdentity="TINTERNE0000" op="Modify">
                  <Attributes>
                    <Map>
                      <entry key="flow" value="IdentityEditRequest"/>
                      <entry key="id" value="1569134f12cd446c836d1c401ac2a25c"/>
                      <entry key="interface" value="LCM"/>
                      <entry key="operation" value="Modify"/>
                    </Map>
                  </Attributes>
                  <AttributeRequest name="lastname" op="Set" trackingId="4b5606bc00ae46b9a186b146ad230fd6" value="Testinterne SuperEmployee">
                    <Attributes>
                      <Map>
                        <entry key="previousValue" value="Testinterne blabla"/>
                        <entry key="source">
                          <value>
                            <SourceType>UI</SourceType>
                          </value>
                        </entry>
                      </Map>
                    </Attributes>
                  </AttributeRequest>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="source" value="LCM"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </value>
          </entry>
        </Map>
      </Attributes>
    </IdentityRequestItem>
    <IdentityRequestItem application="OpenLDAP" approvalState="Finished" compilationStatus="Expansion" created="1746014972283" expansionCause="AttributeSync" id="0ab2006c968514ff8196869a297b0148" modified="1746015000941" name="sn" nativeIdentity="uid=TINTERNE0000,ou=people,o=corp" operation="Set" provisioningEngine="OpenLDAP" provisioningState="Commited" value="Testinterne SuperEmployee">
      <Attributes>
        <Map>
          <entry key="expansionInfo" value="lastname"/>
          <entry key="managedAttributeType" value="Entitlement"/>
          <entry key="provisioningPlan">
            <value>
              <ProvisioningPlan trackingId="ea1f914fe4c74663bcf2b29501189ed6">
                <AccountRequest application="OpenLDAP" nativeIdentity="uid=TINTERNE0000,ou=people,o=corp" op="Modify" targetIntegration="OpenLDAP">
                  <AttributeRequest name="sn" op="Set" trackingId="ea1f914fe4c74663bcf2b29501189ed6" value="Testinterne SuperEmployee"/>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="source" value="LCM"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </value>
          </entry>
        </Map>
      </Attributes>
    </IdentityRequestItem>
    <IdentityRequestItem application="OpenLDAP" approvalState="Finished" compilationStatus="Expansion" created="1746014972284" expansionCause="ProvisioningPolicy" id="0ab2006c968514ff8196869a297b0149" modified="1746015000941" name="manager" nativeIdentity="uid=TINTERNE0000,ou=people,o=corp" operation="Set" provisioningEngine="OpenLDAP" provisioningState="Commited" value="uid=TEST00000,ou=people,o=corp">
      <Attributes>
        <Map>
          <entry key="expansionInfo" value="OpenLDAP"/>
          <entry key="managedAttributeType" value="Entitlement"/>
          <entry key="provisioningPlan">
            <value>
              <ProvisioningPlan trackingId="92f39ec4849549f4ba84ad097311a8de">
                <AccountRequest application="OpenLDAP" nativeIdentity="uid=TINTERNE0000,ou=people,o=corp" op="Modify" targetIntegration="OpenLDAP">
                  <AttributeRequest name="manager" op="Set" trackingId="92f39ec4849549f4ba84ad097311a8de" value="uid=TEST00000,ou=people,o=corp"/>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="source" value="LCM"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </value>
          </entry>
        </Map>
      </Attributes>
    </IdentityRequestItem>
  </RequestItems>
</IdentityRequest>
4

Do you have any beforeprovisioning rule?

5

No, we do not have beforeprovisioning rule on the OpenLDAP application.

6

I see there is a different value for Manager in 2nd screenshot vs the third
Do you have a provisioning policy/form with a different logic than in attribute mapping?

7

I agree, seems like ProvisioningPolicy is messing up.

8

There are different values because I tested with different data at different moments.

I will add more information. I am using a IdentityAttributeTarget rule to populate the manager attribute in OpenLDAP. In that rule, I use the value argument and transform it into the dn of the manager. The rule looks like this:

<Rule language="beanshell"  name="tOpenLDAPManagerAttributeTarget" type="IdentityAttributeTarget">
  <Description>Identity attribute target rules are used to transform identity attribute values that are being pushed to targets.</Description>
  <Signature returnType="Object">
    <Inputs>
      <Argument name="log" type="org.apache.commons.logging.Log">
        <Description>
          The log object associated with the SailPointContext.
        </Description>
      </Argument>
      <Argument name="context" type="sailpoint.api.SailPointContext">
        <Description>
          A sailpoint.api.SailPointContext object that can be used to query the database if necessary.
        </Description>
      </Argument>
      <Argument name="value" type="Object">
        <Description>
           The value of the identity attribute.  Note that this could be single value or a list of values.
        </Description>
      </Argument>
      <Argument name="sourceIdentityAttribute">
        <Description>
           The sailpoint.object.ObjectAttribute for this target.
        </Description>
      </Argument>
      <Argument name="sourceIdentityAttributeName">
        <Description>
           The name of the identity attribute for this target.
        </Description>
      </Argument>
      <Argument name="sourceAttributeRequest">
        <Description>
           The sailpoint.object.ProvisioningPlan.AttributeRequest that is
           setting the attribute on the identity.
        </Description>
      </Argument>
      <Argument name="target">
        <Description>
           The sailpoint.object.AttributeTarget that is being processed.
        </Description>
      </Argument>
      <Argument name="link">
        <Description>
           The sailpoint.object.Link that is being processed.
        </Description>
      </Argument>
      <Argument name="identity">
        <Description>
           The sailpoint.object.Identity that is being processed.
        </Description>
      </Argument>
      <Argument name="project">
        <Description>
           The sailpoint.object.ProvisioningProject that has the changes that
           are being requested.
        </Description>
      </Argument>
    </Inputs>
    <Returns>
      <Argument name="attributeValue">
        <Description>
          The transformed value that will be pushed to the target.
        </Description>
      </Argument>
    </Returns>
  </Signature>
  <Source>return String.format("uid=%s,ou=people,o=corp", value);</Source>
</Rule>

After some digging, I could see that the value passed in the value argument is always the previous value of the manager, instead of the new value. Is it normal? How can I get the new value that I attempt to set?