Correlate only one cube if there are two cubes with the same value on correlation attribute

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

8.4

Share all details about your problem, including any error messages you may have received.

Is there any example of a correlation rule that will correlate to a specific cube if there are two cubes with the same value on the correlation attribute? For example if there are two cubes I want to also check that another attribute is not null, then correlate that cube and ignore the other cube, so that the one cube that only has the same value on the correlation attribute will be ignored and not correlated.

2

Hi @Lukkah ,

PFA pdf for IIQ Rules. Here you can see examples most of types in IIQ.

Rules in IdentityIQ 7.2.pdf (2.0 MB)

3

Hi Henrik,

Give a try to below sample rule. Let me know if it helps.

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Rule language="beanshell"  name="Sample_Correlation_Rule" type="Correlation">
  <Description>Identity Correlation Rules are used to find identities to which new accounts can be attached. A correlation rule must return a Map with one of the specified Return arguments.</Description>
  <Signature returnType="Map">
    <Inputs>
      <Argument name="log">
        <Description>The log object associated with the SailPointContext.</Description>
      </Argument>
      <Argument name="context">
        <Description>A sailpoint.api.SailPointContext object that can be used to query the database if necessary.</Description>
      </Argument>
      <Argument name="environment" type="Map">
        <Description>Arguments passed to the aggregation task.</Description>
      </Argument>
      <Argument name="application">
        <Description>Application being aggregated.</Description>
      </Argument>
      <Argument name="account">
        <Description>A sailpoint.object.ResourceObject returned from the collector.</Description>
      </Argument>
      <Argument name="link">
        <Description>Existing link to this account.</Description>
      </Argument>
    </Inputs>
    <Returns>
      <Argument name="identityName">
        <Description>The name of an Identity object.</Description>
      </Argument>
      <Argument name="identity">
        <Description>A fully resolved Identity object if the rule wants to do its own queries to locate the identity.</Description>
      </Argument>
      <Argument name="identityAttributeName">
        <Description>The name of the extended attribute that can be used to locate an existing identity.</Description>
      </Argument>
      <Argument name="identityAttributeValue">
        <Description>The value of the named extended attribute that can be used to locate an existing identity. This attribute is used together with the identityAttributeName argument.</Description>
      </Argument>
    </Returns>
  </Signature>
  <Source>

  import java.util.*;
  import sailpoint.object.*;
  import sailpoint.api.*;
  
  Map sampleCorrelation = new HashMap();
  
  String attr = account.getStringAttribute("AttributeName");
   
  QueryOptions qo=new QueryOptions();
  qo.addFilter(Filter.eq("name", attr ));
   
  List identities = context.getObjects(Identity.class, qo);
  
  if(!Util.isEmpty(identities ))  {
    for(Identity idn : identities )
    {
      // Add the check for another attribute here
     if (some identity attribute check){
         sampleCorrelation .put("identity", idn );
          break;
      }
      
    }
  }  else  {  
    return null;
  }

  return sampleCorrelation ;
  
    </Source>
</Rule>

Regards
Ankush

4

@Lukkah To achieve this you need to iterate over multiple identities in your correlation rule that could increase the aggregation time. You can try with correlation config where you can define multiple attribute based correlation mapping which IIQ execute them in priority a order from top to bottom.

5

Like NeelMafhav stated, complex correlation rules can add a lot of overhead to aggregations. Sometimes these situations arise and you have to just manage the complexities if that is the data you have. Otherwise it may be worth the time to see if there are any other unique attributes that can be used or added to reduce the chances of this happening.

6

You can create a new identity attribute and add the concatenated value of both of these attributes. Then you can use this new identity attribute for the correlation rule.

Thanks

7

Hi @Lukkah use below sample code

QueryOptions options=new QueryOptions();

   options.add(Filter.*eq*("firstAtrr", ""));

   options.add(Filter.*notnull*("secondAttr"));

   //if you are sure below condition always return data use getUniqueObject

  Identity identity=context.getUniqueObject(Identity.class,Filter.*and*(Filter.*eq*("firstAtrr", ""),Filter.*notnull*("secondAttr")));

   //else iterate this list and return proper identity

  List identitys=context.getObjects(Identity.class,options);

Thanks,

PVR.

8

Thank you all for the fast response <3.

I made it work with this rule:

import sailpoint.object.;
import sailpoint.tools.;
import java.util.*;

Map result = new HashMap();

if (link != null && link.getIdentity() != null) {
return null;
}

String corrValue = account.getStringAttribute(“APP ATTRIBUTE”);

if (corrValue == null) {
return null;
}

QueryOptions qo = new QueryOptions();
qo.addFilter(Filter.eq(“IDENTITY ATTRIBUTE”, corrValue));

List identities = context.getObjects(Identity.class, qo);

if (identities == null || identities.size() == 0) {
return null;
}

if (identities.size() == 1) {

Identity id = (Identity) identities.get(0);
result.put("identity", id);

return result;

}

for (Object obj : identities) {

Identity id = (Identity) obj;

Object attr = id.getAttribute("NEW ATTRIBUTE");

if (attr != null) {

    result.put("identity", id);
    return result;
}

}

return null;