Fetch end date of the users terminated manually as emergency termination

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi Everyone,

When the user gets terminated manually then we need the same date to be fetched in any attribute, when the account was moved to terminated state and this date needs to be selectable via SailPoint. The format should be in the YYYY-MM-DD.
See if anyone has developed such requirement with the help of SailPoint.

2

Do you mean to say, LCS set manually?

If you want to store the date when LCS is changed to “terminated” you can do so using another identity attribute where the value is calculated based on the below logic:

  1. If LCS is not “terminated”, then empty string
  2. If LCS is “terminated”, and
    • the current value of this attribute is empty, then assign current date
    • the current value is not empty, then leave it as is
3

If the requirement is to retrieve the exact timestamp when an identity was manually moved to the Terminated lifecycle state, I don’t believe ISC exposes that as a built-in identity attribute that can be directly mapped or referenced later.

If you need to retain that date, you’ll need to capture it when the lifecycle state changes (for example, using a workflow) and persist it in a dedicated identity attribute. That attribute can then be used for provisioning or reporting in the required YYYY-MM-DD format.

If your requirement is different (for example, you need the termination date from the authoritative source rather than the manual lifecycle state change), could you clarify that scenario?

4

yes its manual, how to assign that from sailpoint ?

5

Middle paragraph is the requirement.

6

Just to clarify, do you only need to set the date when the Lifecycle State is manually changed to Terminated?

Also, do you already have any transforms or rules that automatically set the Lifecycle State to Terminated?

One approach would be to use a Workflow triggered when the Lifecycle State changes to Terminated. From there, you could update a dedicated attribute (to set current date) stored in a delimited source and mapped to an Identity Attribute.

7

Do you mean to ask how to set the LCS manually in SailPoint? If yes, this is available to ORG_ADMINs only, and you can change the LCS of an identity directly from “Details” tab under the identity.

Also note that any LCS set manually returns to automatically calculated when the calculated value changes from what it was originally when the LCS was changed manually.

8

@iamnithesh I mean to assign the date of manually terminated user via sailpoint. (END_DATE)

9

In that case you can use this logic

10

checking on the transform will update if this works.

11

You can have a workflowwho detects that action and writes back to the identity or a Delimited file source that your transform can use.

12

ok Thanks Ivan will check on workflow as well but till now I haven’t got that date valued updated on the basis of the manual user termination.

13

Ita actually simple. you can look in the workflow for the Event using the search API that way you can capture it and use the Delimited File apis to update values.

Let me know if you need more help with it.

14

Hi Ivan, using this one and in HTTP Request using PATCH to assign the date but not working as expected

image
image397Ă—492 16.7 KB

15

If you’re seeing any errors, could you please share the error message and the configuration of the HTTP Request Action?

16

I think this is not possible in the way we got the suggestions. Only this is I found on sailpoint. https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html#defining-identity-profile-attributes

17

You can use a feed file source created for this purpose and map any column to that specific attribute. Then in your workflow you can use the update API to create an account or to update an account for this specific scenario and in that API call you can actually pass the end date value which will be mapped to that user. It’s kind of a work around but I think it will work.

18

Hi @Deepak_Chaudhary,

Create a custom identity attribute (for example, terminationDate).

  • Trigger a workflow on Identity Lifecycle State Changed.
  • When the lifecycle state changes to Terminated, update the terminationDate attribute with the current date in YYYY-MM-DD format.
  • Ensure the attribute is only populated once to preserve the original termination date.

If the current workflow is not working, we may need to verify:

  • Whether the workflow trigger is firing correctly.
  • Whether the HTTP Request step is successfully updating the identity attribute.
  • Whether the custom attribute is configured and writable.
  • Whether there are any permission or API-related issues.

Alternatively, if workflow limitations prevent updating the attribute, we may need to explore a rule-based or API-driven solution.

19

I am not able to understand why is there a need to have a workflow and another delimited source etc in your use case. I have successfully implemented this logic and it’s been working for over a year now

20

Hi @iamnithesh can you share the transform json if this is the case will change accordingly and try to do that. Thanks