Event Based Certification - Trigger details

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

IIQ 8.5

I’m working on Event based Certifications that are triggered by Identity Attribute changes. I need to figure out what the previous and new values are, to put into the email notification.

Is it possible to get the old and new values from within the Notification email. The notification email has access to the related WorkItem & Certification objects.

In the Certification object → CertyificationEntity, there is a reference (by ID) to a “snapshotId”. What object does the id reference?

2

hi @Paul_Meyer

Yes, you can get both the old and new values, but it takes a little digging.

The snapshotId you see in the CertificationEntity points to an IdentitySnapshot object. SailPoint creates this snapshot when the certification is generated, and it contains the state of the identity at that moment (attributes, entitlements, etc.).

Here’s the general approach:

  • Current value: You can pull this directly from the Identity object or the WorkItem context.
  • Previous value: Use the snapshotId to look up the corresponding IdentitySnapshot. That snapshot holds the old attribute values. You’ll need to parse the snapshot XML/JSON and compare it with the current Identity.

For your email notification, you can write a rule or script that:

  1. Resolves the snapshotId to the IdentitySnapshot.
  2. Extracts the attribute you care about.
  3. Compares it with the current value and passes both into the email template.

If you need more granular history, the Identity History feature is also helpful for tracking changes over time.

3

@haideralishaik

Thanks for the info.

I’ve managed to get a rule to execute in the emailtemplate, pasing the snapshotId and dumping/logging the SnapShot object in the rule. From what I can see the SnapShot contains the current value of the attribute and not the previous value.

I’m triggering the change through an aggregation task so as to make sure it follows the correct process of updating the Identity Attributes.

4

What I am seeing on the Identity after aggregation is a “triggerSnapshots” Identity Attribute, which seems to contain the previous value of the Attribute(s). Will persure this avenue for a bit.

5

Hi @Paul_Meyer ,

There are 2 ways. They are

  1. Once refer below link.

https://community.sailpoint.com/t5/IdentityIQ-Forum/Showing-Previous-Identity-Information-on-Workflow/m-p/88929

  1. Configure value change rule in identity mapping. Write a rule.
6

Thanks for the link. Certification Events does not involve Worfklows.

With point 2, do you mean run a rule to launch a certification manually?

7

Hi @Paul_Meyer ,

No need to launch certification manually. If it is an identity attribute, in identity mappings you find value change rule in that rule you will get past value and new value and then send email there.

8

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.