Failsafe mechanisms to mitigate outages in the authoritative source that lead to role deprovisioning

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
8

Hi Irene,
We designed and used different BuildMap Rules to make a relatively complex critical attribute substitution and attribute protection during the aggregation for different SAP and JDBC authoritative sources. In one of our use cases we implemented an intelligent amending in a BuildMap Rule for the managerID substitution in different critical use cases and/or assigned a LCM special state if an account has missing some critical attributes from a source…

Within another scenario we did a full script based pre-processing outside of IDN to protect data from cases with missing critical data of some SAP system flat text/CSV file with a quite rich multi-scenario. The script, when finished, runs the authoritative source aggregation via API. Any UI-based authoritative source aggregation in IDN was being switched off.

In your case you might not need to design such complex solutions, instead you could use an identity attribute previous value and a simple Transform.

Case 1. Protection of essential attribute using its previous value:
======Transform for Case 1=================

{
    "name": "critical_Attribute1_Protected",
    "type": "static",
    "attributes": {
        "requiresPeriodicRefresh": "true",
        "critical_Attribute1": {
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "attributeName": "critical_Attribute1",
                            "sourceName": "My_Authoritative_SourceName"
                        },
                        "type": "accountAttribute"
                    },
                    "null"
                ]
            },
            "type": "firstValid"
        },
        "critical_Attribute1_Past": {
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "name": "critical_Attribute1" <== previous non-empty attribute value kept at the identity
                        },
                        "type": "identityAttribute"
                    },
                    "null"
                ]
            },
            "type": "firstValid"
        },
        "value": "#if($critical_Attribute1=='null'&&$critical_Attribute1_Past!='null')$critical_Attribute1_Past#{elseif}($critical_Attribute1!='null')$critical_Attribute1#{elseif}($critical_Attribute1=='null' && $critical_Attribute1_Past=='null')default_value_for_critical_Attribute1#{else}$critical_Attribute1#end"

    },
    "internal": false
}

===========================
You may need to define the safe ‘default_value_for_critical_Attribute1’ for new employees/starters.

With kind regards,
Dimitri

2 Likes