Event Trigger JsonPATH Filter

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello,
I am using the event trigger Access request submitted to verify if a request has been submitted correctly.

To submit a request correctly a user must request two access profiles, one that starts with “APP - Role …” and another that starts with “APP - Merchant …”.
I am configuring my event trigger filter to trigger only if one of the access profiles is requested without the other. Therefore the logic operation that should be used is XOR.

I implemented this with the following filter:
$.requestedItems[?((@.name contains “APP - Role” && !(@.name contains “APP - Merchant”) )|| (@.name contains “APP - Merchant” && !(@.name contains “APP - Role”)) )]
Which is the XOR logical operator using supported jsonPATH operations.

My problem here is that the trigger still fires when in my access request I have both a role and a merchant. I tried to send the result of a filter in a webhook via workflows and I recieve a null body. Did anyone have a similar problem and if yes how did you solve it.

Thank you in advance,
Nadim

2

If these are the only 2 profiles being requested you can add an additional condition on size of requestedItems like $[?($.requestedItems size 1]

For additional filtering criteria options please refer:

3

Hello Sharvari,
No we cannit add condition on size as someone might request other access profiles at the same time.

We can expect an end user to request other access profiles with the ones related to the event trigger

Regards,
Nadim

4

Have you tried

$.requestedItems[?(((@.name contains “APP - Role” && !(@.name contains “APP - Merchant”) )|| (@.name contains “APP - Merchant” && !(@.name contains “APP - Role”))) && !(@.name contains “APP - Role” && @.name contains “APP - Merchant”)]
5

Thank you for the suggestion but this filter still triggers the event if both access profiles are in a request

6

Does this mean they can request multiple access profiles with APP - Role or APP - Merchant in a single request, or that they can only have one APP - Role and one APP -Merchant, but they could have other access profiles that don’t match that criteria?

If they can only have a maximum of one APP - Role and one APP - Merchant in a request, then you could try this filter:

$[?(!($.requestedItems[?(@.name contains "APP - Role")] size 1 && $.requestedItems[?(@.name contains "APP - Merchant")] size 1))].requestedItems[?(@.name contains "APP - Role" || @.name contains "APP - Merchant")]

This will trigger only when one of APP - Role or APP - Merchant is present, but not both. If both are present, it won’t trigger. If neither are present, it won’t trigger. It ignores any other access profiles.

2 Likes
7

Hello,

Thank you very much this filter works.

Regards,
Nadim

1 Like
8

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.