Department change deduction and mover Certification

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Team,
Is there a way to find any change in value of department in HR system?
I have written a transform with $oldValue but it always shows up “Changed” though the values are same between aggregations. please let me know what goes wrong here.

{
    "attributes": {
        "expression": "$deptID eq $olddeptID",
        "positiveCondition": "No Change",
        "negativeCondition": "Changed",
        "deptID": {
            "attributes": {
                "sourceName": "",
                 "attributeName": "departmentID"
            },
            "type": "accountAttribute"
        },
        "olddeptID": {
            "attributes": {
                "input": {
                    "attributes": {
                        "ignoreErrors": "true",
                        "values": [
                            "$oldValue",                            
                            "none"
                        ]
                    },
                    "type": "firstValid"
                }
            },
            "type": "lower"
        },
        "newValue": {
            "attributes": {
                "value": "newValue"
            },
            "type": "static"
        },
        "actualValue": {
            "attributes": {
                "sourceName": "",
                "attributeName": "departmentID"
            },
            "type": "accountAttribute"
        }
    },
    "type": "conditional",
    "name": "Mover"
}

Also,
Is there any way to trigger certification when there is any change in the department in Authoritative Source?

Thanks
Stella

2

You can use the Trigger “Source Account Updated”

And then actions “Create Certification Campaign” and “Activate Certification Campaign”, or just “Activate Certification Campaign” if you like to activate a saved campaign

1 Like
3

Hello Stella,

Do you have the Workflow module in your tenant? If so, you can can handle Department Change cases and much more with that.

4

No Sebastian. we havent purchased workflow module in our tenant.
any other possible solutions do you have? please let me know.

Thanks
Stella

5

Hi Nithesh,
we havent purchased workflow module and so we couldnt achieve this standard process for mover. Any other way, we can initiate compaign for mover?

Also, could you please check what is wrong in below code snippet…always it shows the “changed” even the department is not changed.

{
“attributes”: {
“expression”: “$deptID eq $olddeptID”,
“positiveCondition”: “No Change”,
“negativeCondition”: “Changed”,
“deptID”: {
“attributes”: {
“sourceName”: “”,
“attributeName”: “departmentID”
},
“type”: “accountAttribute”
},
“olddeptID”: {
“attributes”: {
“input”: {
“attributes”: {
“ignoreErrors”: “true”,
“values”: [
“$oldValue”,
“none”
]
},
“type”: “firstValid”
}
},
“type”: “lower”
},
“newValue”: {
“attributes”: {
“value”: “newValue”
},
“type”: “static”
},
“actualValue”: {
“attributes”: {
“sourceName”: “”,
“attributeName”: “departmentID”
},
“type”: “accountAttribute”
}
},
“type”: “conditional”,
“name”: “Mover”
}


Thanks
Stella
1 Like
6

It’s possible that you could write some type of BeforeProvisioning Rule for the HR Connector, either in cloud or on IQService.

Take a look at a BeforeModifyRule.

7

On what attribute are you applying this transform?

Also, if you like to trigger a Certification process, I cannot think of anything besides Workflows. In my opinion, purchasing license for the Workflow is really worth as there are many operations you can run using these and SP is constantly adding features to Workflows.

8

I agree 100% that workflows are incredibly valuable investments, capable of managing numerous use cases like this with minimal code and complexity.

9

Hi Sebastian,
let me give a try and come back.

Thanks a lot.
Stella

10

HI,
we just created one trigger flag in identity which will be set as “Changed” if department is changed to new value. based on that value,we would like to initiate “Mover” certification.

Thanks
Stella

11

Hi Stella,

As mentioned before to launch a certification on such an event in IDN you’ll need the workflow module this is the prerequisite you cannot handle this use case using transforms.

1 Like
12

Hi Nithesh,
can you suggest we have scenario when a department is changed for a user, it is not updating in AD. how can we achieve this.

thanks
osman

13

@osmanmohammed9185
Can you please post this as a new question with more details on how have you configured “Create Account” and “Attribute Sync” in AD?