Correlate two identities

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi, all,

I have a situation as following

  1. we have two identity profiles from two sources
  2. the two sources contain the same employee with different employee number
  3. hence, two identities are created.

Now, I add a new column to one source (source1), let’s say, employee_number_from_auther_source, and make it searchable, hence, I configured it as correlation key in another source (source2)

I expect all the accounts in source2 moving to the source1 because source2 correlated to the identity created by source1, but it does not happen.

Does anyone have any idea how to make it work?

Thank you
John

2

Did you remove the identity profile associated with the 2nd source? (not sure that will solve the issue just curious of what you’ve done so far)

3

Hi @johnsu,

If an account is there in both Authoritative sources, Identity will be created based on Identity Profile priority.

You need to make sure the account from 2nd authoritative source correlated to the identity created from the other authoritative source.

Thanks
Krish

4

The second identity profile is needed, which is used to create identities. but there are some users in both of the two sources, the higher priority identity profile should take control.

5

I understood that. The issue is both the identity profile should create identities. there are some users from the two sources are the same users, I added a new column trying to get them correlated.

6

Since the employee number is different in 2 sources for same user, it didnt correlate. Do you have any other unique attribute to add one more correlation config.

Thanks
Krish

7

I added a column in the source1 and added in the first identity profile and made it searchable, which is used as correlation key in the source2 correlation configuration

8

As mentioned by @vkashat here delete the second Identity Profile and recreate it after aggregating the second source.

If you have already set up the mappings, you can take a back up of the same as json using VS Code and once 2nd Identity Profile is recreated, update it’s mappings using the backed up json.

9

So, if the Id of the account, or the “name” field is the same for booth identities they are going to be correlated.
If somehow the identity was created before you did the correlation logic, you need to reset the sources so it can re-make the correlation.

have you try that?

10

Not sure I understand your point. – why deleting the second identity profile and recreate it after aggregating the second source?

11

If you want identities to be correlated you first need to have IdentityProfile 1 Created with the identities.
Them you create IdentityProfile2 and aggregated it.
you agree that if a correlation is not in place and you dont have any identities on the environment, booth source will create identities? So for correlation to take place , the identity must already exist when you run the “second” source aggregation. that way it will try to correlate using the identity name, correlation rule , if noon work it will create the identity .

Hope it made sense.

12

Thanks, Ivan for prompt response. Let’s take one step back, now I have two identities (which should be the same user, therefore should be one identity), and I have an identity attribute (can be used as correlation key), can the two identities be linked into one identity?

13

Well , try running a non-optimized aggregation on the second source.
you can use the API or the Vscode

14

ahthoritative source always runs non-optimized aggregation, doesn’t it?

15

Nope. Always optimized.