Distribution list issue through lifecycle event

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

Version 8.2

Share all details related to your problem, including any error messages you may have received.

Hi All,

We have defined a rule in sailpoint IIQ which runs for employees only with license. It is defined through lifecycle event which triggers if there’s a change in attribute like country, business unit, division etc.., this is causing issue with a lot of users for whom the event is not running. Can you please help me a logic so that all reminaing users can be included and we don’t have to change the existing logic.

Regards
Amit

2

Hi Amit,

Could you please explain the issue or else post the rule if possible.

3

Hi @kavindar_sharma ,

This is the current logic define for lifecycle event which covers only employees with change in attribute. Can we add some logic for existing users for whom this event wasn’t triggered. Below is the existing logic of lifecycle event

import java.lang.Exception;
  import sailpoint.tools.Util;  

  String oldcountry = previousIdentity.getAttribute("country");
  String newcountry = newIdentity.getAttribute("country");

  String oldBusinessUnit = previousIdentity.getAttribute("businessUnit");
  String newBusinessUnit = newIdentity.getAttribute("businessUnit");

  String oldCompanyName = previousIdentity.getAttribute("companyName");
  String newcompanyName = newIdentity.getAttribute("companyName");

  String oldDivision = previousIdentity.getAttribute("division");
  String newDivision = newIdentity.getAttribute("division");

  String oldFunctionalArea = previousIdentity.getAttribute("Functional Area");
  String newFunctionalArea = newIdentity.getAttribute("Functional Area");

  String oldLocation = previousIdentity.getAttribute("location");
  String newLocation = newIdentity.getAttribute("location");

  String oldJobLevel = previousIdentity.getAttribute("Job Level");
  String newJobLevel = newIdentity.getAttribute("Job Level");

  String oldRoleLevel= previousIdentity.getAttribute("Role Level");
  String newRoleLevel= newIdentity.getAttribute("Role Level");

  try{
    // 1. Old is NULL and New is something...    
    if(Util.isNullOrEmpty(oldBusinessUnit)
       && Util.isNotNullOrEmpty(newBusinessUnit)){
      return true;
    } else if(Util.isNullOrEmpty(oldCompanyName)
              && Util.isNotNullOrEmpty(newcompanyName)){
      return true;
    } else if(Util.isNullOrEmpty(oldDivision)
              && Util.isNotNullOrEmpty(newDivision)){
      return true;
    } else if(Util.isNullOrEmpty(oldFunctionalArea)
              && Util.isNotNullOrEmpty(newFunctionalArea)){
      return true;
    } else if(Util.isNullOrEmpty(oldLocation)
              && Util.isNotNullOrEmpty(newLocation)){
      return true;
    } else if(Util.isNullOrEmpty(oldcountry)
              && Util.isNotNullOrEmpty(newcountry)){
      return true;
    } else if(Util.isNullOrEmpty(oldJobLevel)
              && Util.isNotNullOrEmpty(newJobLevel)){
      return true;
    } else if(Util.isNullOrEmpty(oldRoleLevel)
              && Util.isNotNullOrEmpty(newRoleLevel)){
      return true;
    }

    // 2. Old and New values are different
    if(!oldBusinessUnit.equals(newBusinessUnit)){
      return true;
    } else if(!oldCompanyName.equals(newcompanyName)){
      return true;
    } else if(!oldDivision.equals(newDivision)){
      return true;
    } else if(!oldFunctionalArea.equals(newFunctionalArea)){
      return true;
    } else  if(!oldcountry.equals(newcountry)){
      return true;
    } else  if(!oldLocation.equals(newLocation)){
      return true;
    } else  if(!oldJobLevel.equals(newJobLevel)){
      return true;
    } else  if(!oldRoleLevel.equals(newRoleLevel)){
      return true;
    }

    return false;
  }catch(Exception e){
    return false;
  }
4

Hi and Hello,
@ayadav_12

To include the remaining users for whom the event was not triggered without changing the existing logic, you can add a check to see if the lifecycle event has ever been triggered for those users. This can be done by checking a custom attribute or a specific flag that you can set when the event is triggered.

Maybe you can put this

// Custom attribute to check if the event was triggered before

String eventTriggeredBefore = previousIdentity.getAttribute("eventTriggeredBefore");


and this after try{

    // Check if the event has been triggered before
    
       if (Util.isNullOrEmpty(eventTriggeredBefore) || eventTriggeredBefore.equals("false")) {
        // Update the attribute to indicate the event has been triggered
       
        newIdentity.setAttribute("eventTriggeredBefore", "true");

Regards,
Adam

5

Hi @AdamVentum ,

Getting below error when i tried to add the line as you suggested and check for the user.
An unexpected error occurred: BeanShell script error: bsh.EvalError: Sourced file: inline evaluation of: import java.lang.Exception; import sailpoint.tools.Util; String oldcountr . . . '' Token Parsing Error: Lexical error at line 28, column 63. Encountered: "\u201c" (8220), after : "" : at Line: 26 : in file: inline evaluation of: import java.lang.Exception; import sailpoint.tools.Util; String oldcountr . . . ‘’ : String newRoleLevel = newIdentity .getAttribute ( “Role Level” ) BSF info: Rule-Mover-DL-Change at line: 0 column: columnNo

Regards
Amit

6

Hi @ayadav_12,

This is parsing error which must be due to some extra character copied and pasted. Try to remove this character and the parsing error should go away.

Thanks

7

The code is working fine now but it’s running for every user again and again during the refresh tasks run. How can i fix it so that it should run for only those user for whom the event hasn’t run yet. Can you please help it’s kind of on priority.

Regards
Amit

8

Hi @ayadav_12,
Can you put some loggers in the rule to see whoever are the users not satisfying the attribute changes, a life cycle event is created or not.

Using Identity refresh with filters you can run for a set of users not for all users.

Use the below identity refresh options for testing

Refresh identity attributes - this option in Identity refresh will get the attributes with the changes in attribute data.

Process events – This option is used for processing the lifecycle events that you have created.

9

Hi @ayadav_12,

Can you confirm on the part that whether every time a new event is being detected or the old one only is being re-running due to some issue?

Thanks

10

Hi @ashutosh08 ,

Mostly the old ones keeps getting triggered and i haven’t seen the new user being triggered a few new users getting triggered maybe due to the other conditions. Is there a way to cover all other users.

11

Hi @ayadav_12,

My suggestion will be to check the identity from debug page where operation is already performed to confirm that the identity being re-processed is not refreshed properly.

I would recommend looking at the logic of your rule to see if it is re-triggering on the same identity.

If you have ruled out above possibility, then kindly share the sample workflow that is being triggered as part of your event.

Thanks

12

Hi @ashutosh08 ,

Can you run a rule based on population. How can we achieve this if you can help

Regards
Amit

13

Hi @ayadav_12,

You can utilize the population as shown below and as you asked in rule also you can utilize its filter as given below snippet.

image
image999×520 25.7 KB

GroupDefinition groupDef=context.getObjectByName(GroupDefinition.class, populationName);
		QueryOptions opt=new QueryOptions();
		opt.addFilter(groupDef.getFilter());
		
		List identityList=context.getObjects(Identity.class, opt);

Thanks

14

Hi ,

I want to add 1 minute delay to the workflow before it stops as it’s executing another rule for distribution list and almost take 1 minute to complete it. Any idea how we can add it?

Regards
Amit

15

Can anyone please help it’s kind of an urgency

16

Try put Thread.sleep(60000); //1000 = 1 sec in the rule

or you can update with wait=“1” in the step and workflow will be backgrounded for a min. When Perform Maintenance trigger then workflow will be picked up and execute next steps.
Note: Perform Maintenance is scheduled for every 5 min by default(OOTB). Please adjust accordingly.