Create Entra ID connector User filter

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

Version 8.4

Share all details related to your problem, including any error messages you may have received.

Hey we’ve been wracking our brains, but it isn’t super clear to us how we are supposed to format a user filter for the Entra ID connector so that we only aggregate information about users that have an Employee Type of ‘Regular’

We’ve tried about 10 different variations of the following

employeeType like Regular , but we get a syntax error without fail, and Catalina.out has not shed any guidance.

2

Below Microsoft documentation illustrates how you can use filters,

I believe in your case, the filter should be somewhat like
employeeType eq Regular

HTH!

1 Like
3

Thanks Gary for the suggestion,

This was actually something we tried, catalina.out and sailpoint are both throwing the following 400 response with that filter

Exception during aggregation of Object Type Account on Application EntraID. Reason: Unable to create iterator sailpoint.connector.ConnectorException: Exception occurred in Iterate Objects. Error message - sailpoint.connector.ConnectorException: Exception occurred in processReadRequest. Error - Response Code - 400 Error - 400 Unsupported Query.

4

I am pretty sure that the query is correct (since it’s as per Microsoft documentation).
What I think could be happening is, SailPoint is generating an invalid URI because it expects the query to be written in the certain/encoded format.

Try below queries and see if it works out for you,
employeeType eq ‘Regular’
OR
employeeType%20eq%20%27Regular%27

Also, if could enable debug logging for your Entra ID connector from log4j2.properties and then look out for the final URI generated by SailPoint in the logs and share that here (masking your Entra ID tenant details) so that it helps understand better.

5

Hi Matthew Rioux,
Here is an example below : for more please refer Link: Use the filter query parameter
_____________>
Get all users in the Retail and Sales departments. GET ~/users?$filter=department in ('Retail', 'Sales')

Regards,
Priyam

2 Likes
6

Thanks Gaurav and Priyam for the suggestions.

Forgive me I just inherited this instance of sailpoint so I’m still trying to learn all that there is to offer. I’m not sure how to turn on debug logging just for the entra ID connector? I know how to get to log4j2.properties but I’m unsure of what parameter needs to be adjusted to turn on the requested logging.

I tried the following filter
startswith(‘employeeType’,‘Regular’) and got the following error

Error - Response Code - 400 Error - 400 Unsupported Query.

I then tried putting employeeType%20eq%20%27Regular%27 in the user filter under application configuration, this produced

Syntax error: character ‘%’ is not valid at position 12 in ‘employeeType%20eq%20%27Regular%27’.

Attached is the catalina.out entries for the failed query
startswith(‘employeeType’,‘Regular’)

Entrajava.txt (15.3 KB)

7

Turns out the employeeType field is not queriable by graph. I confirmed this by going to Graph Explorer | Try Microsoft Graph APIs - Microsoft Graph and attempting a GET query.

I instead used onPremisesSyncEnabled as a filter

8

Upon further review this field is querieable but the graph query looks as follows.

https://graph.microsoft.com/v1.0/users?$filter=employeeType eq ‘Regular’&$count=true

The following header also needs to be passed.

ConsistencyLevel:Eventual

Anyone have any idea on how to accomplish this?

9

In IdentityNow, it looks like the Azure AD Source needs to be patched with the: SupportsAdvanvedAccountFilter:true values. (at least according to this document here: Azure AD Aggregation Settings )

I don’t know if there’s a similar setting in IIQ, but maybe?

I’m actually trying a similar user account filter that needs the ConsistencyLevel:eventual, and it’s not working…yet… :crossed_fingers:

UPDATE: I got it to work! i had to remove ‘manager’ attribute from the account schema. (just like it said in the documentation).

10

In IIQ there is an advanded query filter which is supposed to set the consistentcy level: true flag at least the xml in debug appears to set it. However I don’t think it’s working correctly. However, I’m not familiar with how to turn on the connector logging so i can see the exact API call the server is making in catalina.out to verify.

11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.