Dynamic scope issue

[lsaipriya26 (saipriya lingala)]

Which IIQ version are you inquiring about?

8.5

I had a requirement where Managers can see their reporting users and who should not have matrix AD account, so created below scope and rule but i still sett matrix users ,can someone suggest on this. Rule:String launcher = requester.getName();

return Filter.and(
Filter.or(
Filter.eq(“manager.name”, launcher),
Filter.eq(“manager.manager.name”, launcher),
Filter.eq(“newManager.name”, launcher),
Filter.eq(“newManager.manager.name”, launcher)
),
Filter.not(
Filter.eq(
“links.application.name”,
“RSLI - Application - Active Directory Matrix”
)
)
);

[punna0001 (harish Punna)]

Hello Saipriya. The issue is the negative filter on the multi-valued links relationship. I would exclude identities that have a Matrix account at the identity level using a subquery

Filter matrix = Filter.subquery(
    "id", Link.class, "identity.id",
    Filter.eq("application.name", "RSLI - Application - Active Directory Matrix")
);

return Filter.and(
    Filter.or(
        Filter.eq("manager.name", requester.getName()),
        Filter.eq("manager.manager.name", requester.getName()),
        Filter.eq("newManager.name", requester.getName()),
        Filter.eq("newManager.manager.name", requester.getName())
    ),
    Filter.not(matrix)
);

This excludes any identity that has a Link for the Matrix application, regardless of its other accounts.

[neel193 (Neelmadhav Panda)]

@lsaipriya26 Can you share the dynamic scope xml?

Also, please check the test manager which you are trying is it a regular identity or an identity with admin capabilities?

[lsaipriya26 (saipriya lingala)]

Thanks harish for responding i tried the rule as below but that gives me all users instead of their reports and also contains matrix users,

[lsaipriya26 (saipriya lingala)]

<?xml version='1.0' encoding='UTF-8'?> user is non iam manger

[punna0001 (harish Punna)]

Since the test user is a regular manager and the rule is returning all identities, I would look at the Dynamic Scope configuration next.

Could you share the full Dynamic Scope XML, particularly the PopulationRequestAuthority section? The one above looks incomplete. It would help to confirm the Identity Filter Generator rule is configured under “Who can members request for?”, and to check whether the requester matches any other Dynamic Scope granting broader authority.

[neel193 (Neelmadhav Panda)]

xml is not shared. please send it as attachment or in a script tags

[lsaipriya26 (saipriya lingala)]

[neel193 (Neelmadhav Panda)]

@lsaipriya26 This is not a complete xml, could you please do a word wrap and share? we wanted to see the complete xml to figure out if it is configured properly or not.

[lsaipriya26 (saipriya lingala)]

[wrap=“code wrap”]<?xml version='1.0' encoding='UTF-8'?>

[/wrap]

[lsaipriya26 (saipriya lingala)]

I have now word wrapped the code in Notepad++ and shared it here by copy pasting. Is it readable now? or what are the other ways apart from attaching ?

[neel193 (Neelmadhav Panda)]

Still not visible.

[lsaipriya26 (saipriya lingala)]

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE DynamicScope PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<DynamicScope created="1734380327005" id="0a0a006993be1c5a8193d11f905d4492" modified="1787657117883" name="Manager" significantModified="1787657117883">
  <ApplicationRemoveControl>
    <Reference class="sailpoint.object.Rule" id="8a7e811e6be6ce5a016be6d385b401b5" name="Objects in Requestor&apos;s Authorized Scopes"/>
  </ApplicationRemoveControl>
  <ApplicationRequestControl>
    <Reference class="sailpoint.object.Rule" id="8a7e811e6be6ce5a016be6d3869e01b6" name="Objects in Requestee&apos;s Assigned Scope"/>
  </ApplicationRequestControl>
  <Description></Description>
  <ManagedAttributeRemoveControl>
    <Reference class="sailpoint.object.Rule" id="8a7e811e6be6ce5a016be6d385b401b5" name="Objects in Requestor&apos;s Authorized Scopes"/>
  </ManagedAttributeRemoveControl>
  <ManagedAttributeRequestControl>
    <Reference class="sailpoint.object.Rule" id="8a7e811e6be6ce5a016be6d3869e01b6" name="Objects in Requestee&apos;s Assigned Scope"/>
  </ManagedAttributeRequestControl>
  <PopulationRequestAuthority>
    <MatchConfig customControl="inactive !=true" enableCustomControl="true" enableFilterGenerationRule="true" filterGenerationRuleName="RSLI - IdentityFilterGenerator - Managers" matchAll="true"/>
  </PopulationRequestAuthority>
  <RoleRemoveControl>
    <Reference class="sailpoint.object.Rule" id="8a7e811e767cf5210177831032dd088a" name="RSLI - Rule - Roles Non Requestable"/>
  </RoleRemoveControl>
  <RoleRequestControl>
    <Reference class="sailpoint.object.Rule" id="8a7e811e767cf5210177831032dd088a" name="RSLI - Rule - Roles Non Requestable"/>
  </RoleRequestControl>
  <Selector>
    <IdentitySelector>
      <MatchExpression>
        <MatchTerm name="managerStatus" type="Entitlement" value="true"/>
      </MatchExpression>
    </IdentitySelector>
  </Selector>
</DynamicScope>

[lsaipriya26 (saipriya lingala)]

@neel193 @punna0001 shared the code in above message. This should make the code readable now, Can you take a look? Many thanks in advance.

[neel193 (Neelmadhav Panda)]

@lsaipriya26 please share xml for RSLI - IdentityFilterGenerator - Managers rule as well.. seems it is generating the filters.

[lsaipriya26 (saipriya lingala)]

 <Source>import sailpoint.object.Filter;

String launcher = requester.getName();

Filter matrix = Filter.subquery(
    "id", Link.class, "identity.id",
    Filter.eq("application.name", "RSLI - Application - Active Directory Matrix")
);

return Filter.and(
    Filter.or(
        Filter.eq("manager.name", requester.getName()),
        Filter.eq("manager.manager.name", requester.getName()),
        Filter.eq("newManager.name", requester.getName()),
        Filter.eq("newManager.manager.name", requester.getName())
    ),
    Filter.not(matrix)
);</Source>

[neel193 (Neelmadhav Panda)]

@lsaipriya26 Is newManager an searchable identity attribute?

[bohorapujan (Pujan Bohora)]

@lsaipriya26 I noticed you have not imported Link;
import sailpoint.object.Link;
add this

[punna0001 (harish Punna)]

Hello Saipriya. I would add @bohorapujan’s missing import first

import sailpoint.object.Link;

Then isolate one piece at a time. Test with only manager and manager.manager and confirm that scopes correctly. Once it does, add the Matrix subquery back and test again. The subquery structure looks correct for excluding identities that hold a Matrix Link.

Add newManager last, and confirm it is configured as Attribute Type Identity and Searchable, not a searchable String. Since the filter uses newManager.name and newManager.manager.name, it needs to resolve as an Identity relationship.

If each piece works on its own but the QuickLink still shows everyone, I would then check whether the requester matches another Dynamic Scope associated with the same QuickLink with broader request authority.

[lsaipriya26 (saipriya lingala)]

Thanks above issue is resolved by adding import. One another scope issue, I had a quicklink which is not opening at all and nothing seeing in logs to verify but changing to different scope (Everyone) it is working. Below is the Quick link , scope and rule XMLS. can you help me to check on <QuickLink action="workflow" category="Access" created="1786531962068" id="0a0a00699f761fb6819ff59a5cd42834" messageKey="RSL AD Account Delete Workflow" modified="1786532141800" name="RSL AD Account Delete Workflow" ordering="5" significantModified="1786532141800"> <Attributes> <Map> <entry key="launcher"> <value> <Script> <Source> return currentUser.getName(); </Source> </Script> </value> </entry> <entry key="workflowName" value="RSL AD Account Delete Workflow"/> </Map> </Attributes> <QuickLinkOptions allowOther="true" created="1787747536206" id="0a0a0069a01b143981a03e0e8d4e4e86"> <DynamicScopeRef> <Reference class="sailpoint.object.DynamicScope" id="0a0a0069a01b143981a03e0781a44e73" name="DeleteAdScope"/> </DynamicScopeRef> </QuickLinkOptions> </QuickLink>