Event Trigger Filter Help

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Need to filter Provisioning Event Triggers to contain specific items within the body, but only when they meet criteria.

{
    "_metadata": {
        "invocationId": "398b8135-f188-494a-8877-329b47c9dec9",
        "triggerId": "idn:post-provisioning",
        "triggerType": "fireAndForget"
    },
    "accountRequests": [
        {
            "accountId": "104678",
            "accountOperation": "Modify",
            "attributeRequests": [
                {
                    "attributeName": "detectedRoles",
                    "attributeValue": "Active Directory - Dev - T2_APP_Jira_Employees [AccessProfile-1637344464648]",
                    "operation": "Add"
                }
            ],
            "provisioningResult": "IdentityNow Task",
            "provisioningTarget": "IdentityNow",
            "source": {
                "id": "IdentityNow",
                "name": "IdentityNow",
                "type": "SOURCE"
            },
            "ticketId": null
        },
        {
            "accountId": "CN=Anshul Mittal,OU=T2-Users,OU=Tier2,OU=Production,OU=RAI,DC=devad,DC=rai,DC=com",
            "accountOperation": "Modify",
            "attributeRequests": [
                {
                    "attributeName": "memberOf",
                    "attributeValue": "CN=T2_APP_Jira_Employees,OU=T2-Groups,OU=Tier2,OU=Production,OU=RAI,DC=devad,DC=rai,DC=com",
                    "operation": "Add"
                }
            ],
            "provisioningResult": "committed",
            "provisioningTarget": "ActiveDirectory-Dev",
            "source": {
                "id": "2c91808672dd6f660172f1bde4ff27f7",
                "name": "ActiveDirectory-Dev",
                "type": "SOURCE"
            },
            "ticketId": null
        }
    ],
    "action": "Access Request",
    "errors": [],
    "recipient": {
        "id": "2c9180877947438001794f96cd3e613b",
        "name": "Anshul Mittal",
        "type": "IDENTITY"
    },
    "requester": {
        "id": "2c9180877b9ce230017bd0ece41c56f8",
        "name": "SVC.Service-Now",
        "type": "IDENTITY"
    },
    "sources": "IdentityNow, ActiveDirectory-Dev",
    "trackingNumber": "e9c891ddba7a44e5925a99da43ef6f4b",
    "warnings": []
}

For this - We’d like to filter the requester id, recipient id, and tracking number to be sent but ONLY when the requester ID = 2c9180877b9ce230017bd0ece41c56f8

We have mixed results.

$…[trackingNumber,requester,recipient] seems to help with reduction but cannot get it to include the item for only when 2c9180877b9ce230017bd0ece41c56f8 is present.

[?($.requester.id==“2c9180877b9ce230017bd0ece41c56f8”)] seems to fit for filtering for this identity - but combining them has been difficult.

2

I took a look at this and am struggling to come up with a solution where you can do both the filter expression and select which values to return. I think the best course of action is to use the filter expression to limit which events the trigger will send you, and then pull the values out of the payload of the event that is sent.

3

Thank you Colin for taking a look. I’ve been struggling as well.

Should we be using the filter to reduce the amount of events sent through the event trigger? Or only the data sent for each event?

Ideally, we’re just wanting items sent for when “id”: “2c9180877947438001794f96cd3e613b” is present. Is this achievable?

4

The primary purpose of JSONpath for event trigger filtering is to limit what events the trigger service will send you to only those events that you care about. It is not meant to limit the payload to specific fields. Filtering Event Triggers has more information on this.

In your specific case, you will want to use the following filter when configuring your Post Provisioning subscription to only receive events when the requester’s ID is 2c9180877b9ce230017bd0ece41c56f8.

$[?($.requester.id == “2c9180877b9ce230017bd0ece41c56f8”)]
1 Like