Hi All,
We have a requirement to push the Identity Lifecycle State (LCS) to an Active Directory attribute in uppercase.
As you know, when the LCS is created in the Identity Profile, it is automatically converted to lowercase by design. From what I can see, the subsequent comparisons also appear to be case-sensitive.
For both the AD Account Create and Attribute Sync profiles, we need to map the LCS value and send it to AD in uppercase.
I can create a transform to convert the LCS to uppercase; however, doing so appears to affect the Identity Profile logic because of the case-sensitive comparison.
Another option would be to create a separate Identity Attribute specifically for the uppercase value, but that introduces duplicate data. Alternatively, this could be handled in a Before Provisioning (BP) rule, although that adds additional maintenance overhead.
Is there a simpler or recommended approach to achieve this common requirement?
Regards,
Hi @lalithajay
I wouldn’t recommend changing the Identity Profile value itself, since the Lifecycle State is intended to be used consistently throughout ISC and changing its case could affect lifecycle comparisons and other logic.
Instead, if the uppercase value is only needed by AD, I’d keep the LCS in its default format and apply the conversion only when provisioning to AD. That way, ISC continues to use the original lifecycle state while AD receives the value in the required format.
If you’re using a provisioning policy, have you tried applying a transform only to the mapped AD account attribute rather than to the Identity Profile attribute itself? That keeps the change local to the target system and avoids maintaining a duplicate identity attribute.
Hi @lalithajay
For ref, there is an Update Lifecycle State API (SailPoint ISC API (Beta)) however it doesn’t support updating the technicalName of the State, so it looks like you are stuck with the lower case technical name that is generated by ISC. And if, as you say, it is a case sensitive comparison, then your LCS transform will have to stay as-is.
The cleanest way is to use Attribute Sync and assign another Identity Attribute for “AD Lifecycle State”. Yes, it is “duplicate data”, but one does have to sacrifice that data design principle sometimes to enable Attribute Sync.
One thing to note is that the LCS transform is always processed last in an Identity Refresh, so from a timing perspective, you may need to duplicate your LCS logic, rather than rely simply on upper-casing the LCS value.
You could also investigate the use of an UPDATE provisioning policy (see SailPoint ISC API (Beta)).
Also, there is the possibility to get PowerShell to do the upper-casing with a Connector Executed Rule.
Hi @SuryaKiran
Thanks for your reply. That was initially my plan as well, to localise the logic. However, since this attribute change is required in both the CREATE and Attribute Sync provisioning policies, I need the value to be available at the Identity level (for example, as an Identity Attribute) to support both scenarios.
If this was only required for the CREATE operation, then a transformation at the mapping level would have been sufficient.
Another option would be to implement this logic within the AD Before Provisioning (BP) rule, but that is not my preferred approach from a maintenance perspective.
Hi @lalithajay ,
For keeping AD and ISC synchronized, I would recommend creating a new Identity attribute (for example, LCS_Upper) and associating it with a transform that simply converts the Lifecycle State value to uppercase.
You can then use this new Identity attribute in your AD provisioning policy and Attribute Sync mapping. This keeps the original Lifecycle State unchanged for ISC while providing the format required by AD.
As you already said the alternative would be to implement the conversion in an AD Before Provisioning Rule, where you intercept the provisioning plan and convert the value to uppercase before sending it to AD. However, this introduces custom logic.
The first approach is simpler.