Dynamic scope issue

IdentityIQ (IIQ) IIQ Discussion and Questions
,
23 
<DynamicScope created="1787747074468" id="0a0a0069a01b143981a03e0781a44e73" modified="1787747536203" name="DeleteAdScope" significantModified="1787747536203">
  <ApplicationRemoveControl>
    <Reference class="sailpoint.object.Rule" id="8a7e811e6be6ce5a016be6d385b401b5" name="Objects in Requestor&apos;s Authorized Scopes"/>
  </ApplicationRemoveControl>
  <ApplicationRequestControl>
    <Reference class="sailpoint.object.Rule" id="8a7e811e6be6ce5a016be6d3869e01b6" name="Objects in Requestee&apos;s Assigned Scope"/>
  </ApplicationRequestControl>
  <Description></Description>
  <ManagedAttributeRemoveControl>
    <Reference class="sailpoint.object.Rule" id="8a7e811e6be6ce5a016be6d385b401b5" name="Objects in Requestor&apos;s Authorized Scopes"/>
  </ManagedAttributeRemoveControl>
  <ManagedAttributeRequestControl>
    <Reference class="sailpoint.object.Rule" id="8a7e811e6be6ce5a016be6d3869e01b6" name="Objects in Requestee&apos;s Assigned Scope"/>
  </ManagedAttributeRequestControl>
  <PopulationRequestAuthority>
    <MatchConfig customControl="inactive == true" enableCustomControl="true" enableFilterGenerationRule="true" filterGenerationRuleName="Rule - IdentityFilterGenerator - ManagerADDelete"/>
  </PopulationRequestAuthority>
  <RoleRemoveControl>
    <Reference class="sailpoint.object.Rule" id="8a7e811e767cf5210177831032dd088a" name="RSLI - Rule - Roles Non Requestable"/>
  </RoleRemoveControl>
  <RoleRequestControl>
    <Reference class="sailpoint.object.Rule" id="8a7e811e767cf5210177831032dd088a" name="RSLI - Rule - Roles Non Requestable"/>
  </RoleRequestControl>
  <Selector>
    <IdentitySelector>
      <MatchExpression>
        <MatchTerm name="managerStatus" type="IdentityAttribute" value="true"/>
        <MatchTerm name="workgroups" type="IdentityAttribute" value="IAM Team"/>
      </MatchExpression>
    </IdentitySelector>
  </Selector>
</DynamicScope>
import sailpoint.object.Filter;
import sailpoint.object.Identity;

log.error("ManagerADDelete rule entered");
log.error("requester = " + requester);
String launcher = requester.getName();

// IAM Team workgroup
Identity iamWG = context.getObjectByName(
    Identity.class,
    "IAM Team"
);

// Inactive identities in Stale OU
Filter staleInactiveFilter = Filter.and(
    Filter.eq("inactive", true),
    Filter.like("addn", "OU=Stale-IDS", Filter.MatchMode.ANYWHERE)
);

// IAM Team can see all inactive users in Stale OU
if (iamWG != null &amp;&amp; requester.isInWorkGroup(iamWG)) {
  log.error("user is IAM user");
    return staleInactiveFilter;
}

// Managers can only see their inactive reports in Stale OU
Filter managerFilter = Filter.or(
    Filter.eq("manager.name", launcher),
    Filter.eq("manager.manager.name", launcher),
    Filter.eq("newManager.name", launcher),
    Filter.eq("newManager.manager.name", launcher)
);

return Filter.and(
    managerFilter,
    staleInactiveFilter
);