I’m confused on how duplication prevention works in NERM. I have a custom non-employee profile I created. On the duplication prevention tab I set the following options:
Allow User to Bypass: No
Attributes: Username, Email, ObjectGuid
Then I have a Create workflow for that profile type. I included a duplication prevention step. I set the same attributes in the step and set “Requester” as the performer.
When I submit a request for a duplicate I get a screen like below:
I specifically do not expect the “Create a new profile” option. This allows the requester to bypass the duplication prevention which is what I thought I prevented in the profile settings.
Could anyone help me understand how this should work? If the workflow detects a duplicate I would want it show the user the same screen without the ability to create a new profile. Or if not possible at least it should just fail out. They should not be able to create duplicate profiles.
@kyle_knox Hi Kyle, the way this is working is as it should be, but not in the way you probably expected it to work. The “Allow bypass: No” setting for Profile Type and the Duplication Prevention step in your workflow are two different things which do not interact with each other. The purpose of the step you mentioned is to provide a “use existing or create new” dialog when there is a match this is confirmed by SailPoint documentation and is supposed to be the intended functionality, not a bug. There is no way to disable “create new” option in this step.
Hi @kannan_sb85 and thank you for your response. I’m not sure what you meant here:
This is the intended use case though. The requester is the person submitting the workflow. So, they are the one I want to interact with the duplicate prevention. I want them to know that they have tried to submit a create profile request for a profile that already exists.
Could you elaborate? The “use existing or create new” is baked into the duplicate prevention workflow action. I can’t do anything to remove it. Do you mean I should not use a duplicate prevention step at all?
What is a choice step? As far as I know that is not any kind of workflow action.
For this use case, first configure an Advanced Search step to search for existing non-employees using the email address provided in the request form.
Then add an If Condition to evaluate the search results. If a profile is found and the email address matches an existing non-employee record, route the workflow to a Close Session Action inside the If branch. This will stop the onboarding process and prevent creation of a duplicate non-employee profile.
Workflow flow:
Request Form → Advanced Search → If Condition (Email Exists?) → Close Session
In case anyone has a similar issue in the future I found the way this is intended to work. As Kannan mentioned above the duplicate prevention on the profile type and the duplicate prevention workflow action are not meant to work together the way I thought. The workflow action will allows allow override. That is it’s purpose.
If you just want to prevent any duplicates from being submitted, set up the profile type duplicate prevention without the workflow action.
The issue I had which is not well documented is that the attributes you select for duplicate prevention seem to work together as if using ‘AND’ conditional logic. This means that duplicate prevention will only stop the profile from being created if duplicates are found on a profile for every attribute listed (username AND email AND objectGuid). Since it is not well documented I believed that if any one of these attributes were duplicated across profiles that it would trigger the profile type prevention. This was not the case.
Do to the way data is entered in our form, in my testing there were duplicates for the Username or email or objectGuid but not all three at once. This allows the profile to be created even with duplicate usernames / emails.
I reworked our profile type and workflow to only require duplicate check for username and used other prevention methods for the other two attributes. For us username was the most reliable prevention attribute.
