Combining Outputs from 2 Workflow Steps

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Combining Outputs from 2 Workflow Steps

I’m trying to combine the output from two steps into one based on a condition. In the sample workflow below, if Verify Data Type evaluates to false, the Get Manager Identity step should fetch the manager identity from the Get Identity step. However, if it evaluates to true, the identity’s manager reference is null, so I’m using Attribute Change Events to identify the manager’s ID and storing the id in define Variable step.

My requirement is to combine these two manager ID sources so that, regardless of the condition outcome, I can always retrieve the correct manager identity.

image
image800×640 25.9 KB

2

@krutikakanathe What is the issue that you are facing?

3

Can you clarify this for us?

There is no Attribute Changed Event in the screenshot provided.

To answer the broader question, you should be able to have the workflow process link back up, but what you need to manage is how the variables are handled. The Get Manager Identity is expecting to be provided with an Identity Id, so you need to figure out how to provide it with a single value. I don’t know if the Define Variable has a first valid or not option, which is really what you need in this situation.

4

You should be able to bring both branches back together, but the important part is making sure Get Manager Identity only receives a single resolved Identity ID value. In your case, one branch would use the manager reference returned from Get Identity, while the other branch would use the manager ID you derived separately and stored in Define Variable.

The best pattern here is to normalize both branches into the same output variable, then merge the workflow and pass that one variable into Get Manager Identity. So rather than trying to make the next step interpret two possible sources, resolve the value first and give the action one clean input.

Also, one thing worth clarifying in your example: as @gmilunich mentioned, the screenshot does not appear to show an Attribute Changed Event, so that part may need a little more detail. If Define Variable supports something like “first valid” or “first non-null,” that would likely be the cleanest way to handle it.

6

Hey @Kiran, I have initially tried to include a define variable step to resolve the manager id from both branches to one single variable. But the issue being first valid transform is an invalid transform to use in this context. Only the transforms available in the dropdown can be used there.

7

Agreed — if Define Variable does not support a true coalesce/first-valid operation there, then the safer design is to move Get Manager Identity into each branch instead of merging the raw manager ID values first.

One branch uses the manager reference from Get Identity, and the other uses the separately derived manager ID. Once both branches resolve the manager identity, you can merge them back together and continue with a normalized output. That keeps Get Manager Identity fed with a single clean input in each path and makes the workflow more predictable.

8

Hey Kiran, could you please guide me on how this can be acheived? “merge them back together and continue with a normalized output.”

9

@krutikakanathe

I would have done like this

Branch A:

{
  "name": "Get_Manager_From_GetIdentity",
  "actionId": "sp:get-manager-identity",
  "attributes": {
    "identityId.$": "$.getIdentity.manager.id"
  }
}

{
  "name": "Normalize_Manager_Output_A",
  "actionId": "sp:define-variable",
  "attributes": {
    "name": "normalizedManagerIdentityId",
    "value.$": "$.getManagerFromGetIdentity.id"
  }
}

Branch B:

{
  "name": "Get_Manager_From_DerivedId",
  "actionId": "sp:get-manager-identity",
  "attributes": {
    "identityId.$": "$.defineVariable.managerId"
  }
}

{
  "name": "Normalize_Manager_Output_B",
  "actionId": "sp:define-variable",
  "attributes": {
    "name": "normalizedManagerIdentityId",
    "value.$": "$.getManagerFromDerivedId.id"
  }
}

Then both branches can continue to the same next step and use:

$.defineVariable.normalizedManagerIdentityId

So instead of merging 2 possible manager ID sources before Get Manager Identity, each branch resolves it first, and both paths return the same normalized output.

10

From branch A: define variable step, and from branch B it would be define variable 1 step. So basically continuing to fetch the normalizedManagerIdentityId via $.defineVariable.normalizedManagerIdentityId will just fetch from branch A. For branch B, it would still need to read it as $.defineVariable2.normalizedManagerIdentityId.

11

Finally, Sailpoint has addressed this issue with an Update Variable action step - I’m yet to try it out. But seems like this resolves this issue. I’ll post an update once I try it out.