I need to aggregate specific AD accounts and automatically create Identity Cubes for them while keeping the following Account Aggregation option enabled:
“Only create links if they can be correlated to an existing identity.”
What is the best approach for creating identities dynamically only for specific accounts during aggregation while keeping correlation working correctly?
Would a Correlation Rule, Customization Rule, or another approach be recommended? Also, do you have any rule or guide that could help achieve this?
Hi @IslamElkhouly - could you explain more about your use case?
Based on you message, you’re looking to create new identity cubes but only when they correlate to existing identities? If you are creating a new cube, how would they be correlating to a pre-existing identity? Let me know if my understanding is correct.
There are definitely things you can do using customization/correlation/creation rules, but want to understand better so I can recommend a more accurate solution.
No, the account already exists in AD, but there is no corresponding Identity Cube in SailPoint yet.
During the next AD aggregation, I need SailPoint to create a new Identity Cube for this account instead of correlating it to an existing one. However, this is blocked because the aggregation option:
“Only create links if they can be correlated to an existing identity.”
prevents the account from being linked or creating a new cube when no identity already exists.
Ok understood - you can use a customization rule for this and turn that option off
Without that option selected, SailPoint will attempt to create a new identity cube for eachg non-correlating identity, however, if you return null from your customization rule when you do not want an identity created, you will drop the resource object and nothing will be created within SailPoint.
Alternatively given this is AD, you may be able to use some search filtering to only look at certain OUs and accounts matching specific filter attributes to read in. Not sure if your use case to see if that would be a viable option.
I already tried this, but it did not work because I already have a Correlation Rule configured for AD. I need a way to bypass or handle the logic between the two rules, but currently it is not working as expected.
@IslamElkhouly Since you want to keep the option enabled in the task.
The best way to do it, you can create the identities using a csv import first and make sure the correlating attribute is present in the identity. Then you can keep the option enable that will make sure that your accounts gets correlated to those identities.
in order for you to make sure new acccounts are also created as identity you can keep a weekly/monthly schedule to import these identities in IIQ.
You can use batch csv for this.
Using correlation rule to acheive this i won’t recommend since it could lead to other issues later.
If you don’t want to do it using a csv also then for those accounts you can set up a separate application itself and use ldpa filter to bring only those account. basically segragate your AD application into 2.
I think you may have misunderstood my requirement. I need to create cubes in SailPoint for the accounts that exist only in AD during the next aggregation. However, the option enabled in the aggregation task is preventing this behavior.
I believe I found a solution based on your suggestion. I will create a new application specifically for these accounts, then uncheck the option in the aggregation task and run the aggregation again. I think this should create cubes in SailPoint for the AD accounts. I’ll test it in my test environment first.
@IslamElkhouly Could you mark the reply as solution if you think that solves your issue please.
and creating identity using batch job is to make sure those identity already exists which you want to create so those accounts are correlated in sailpoint. This is also sustainable approach if the number of new identities getting created by this approach is low.
use a customization rule to return null for ResourceObjects that are not “valid” (i will let you define the valid case)
turn off the “Only create links if they can be correlated to an existing identity.” given you are essentially doing this with your customization rule now and you need to bring in the identities to correlate
optionally add a creation rule to format the initial identity cube created for these accounts with better names and other initial identity attribute data