FirstValid provisioning policy

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I created this FirstValid Create provisiong policy. And it is working fine.

It gives new created account on source in “user_name”… “aduserprincipalname” or if attribute not existing, it gives the second attribute “uid”

{
“name”: “user_name”,
“transform”: {
“name”: “First Valid”,
“type”: “firstValid”,
“attributes”: {
“ignoreErrors”: “true”,
“values”: [
{
“attributes”: {
“name”: “adUserprincipalname”
},
“type”: “identityAttribute”
},
{
“attributes”: {
“name”: “uid”
},
“type”: “identityAttribute”
}
]
}
},
“attributes”: {},
“isRequired”: false,
“type”: “string”,
“isMultiValued”: false
},

However I need, that the “second” attribute is not simple “uid” . But a combination of “uid’” and string “@test.com”

So i tried to replace second attribute with “Concat” type like this…

But this doesn’t work. The created user/account has always empty “user_name” if the first attribute is not present. For me the FirstValid is working, but there is an issue somewhere in second attribute and concat type.

I cannot find what is wrong. maybe I am missing something obvious?

Also is there a way or a tool, that somehow checks the provisoining policy results? It is very tiresome to create always a new user, just to see if the provisioning policy is working or not.

  {
    "name": "user_name",
    "transform": {
	  "name": "First Valid",
	  "type": "firstValid",
      "attributes": {
	       "ignoreErrors": "true",
           "values": [
            {
              "attributes": {
                "name": "adUserprincipalname"
              },
              "type": "identityAttribute"
            },
            {
              "type": "concat",
			  "name": "Concatenation transform",
			  "attributes": {
                "values": [
                 {
                    "attributes": {
                       "Name": "uid"
                                  },
                    "type": "identityAttribute"
                 },
                    "@test.com"
				 ]	
                 }
            }
          ]
        }
  },
    "attributes": {},
    "isRequired": false,
    "type": "string",
    "isMultiValued": false
  }
2

Hi @vasilcin3

You shouldn’t have a name on your nested concat transform. Also, using Visual Studio Code with ISC plugin gives you an ability to test transforms against Identity objects.

3

Also, while testing, dont ignoreErrors

4
  1. You don’t need to name your sub transforms, however that won’t change the behavior
  2. In you Concat Transform, Identity Attribute Transform has attribute Name, it should be name, that’s why it didn’t work, just a syntax error
5

Thank you very much. Yes it was the wrong attribute “Name”. I was almost sure it is something stupid like that. But could not see it. And I spend hours of the problem :). It is working now as expected!

6

Here is the updated transform code -

{
  "name": "user_name",
  "transform": {
    "name": "First Valid",
    "type": "firstValid",
    "attributes": {
      "ignoreErrors": "true",
      "values": [
        {
          "attributes": {
            "name": "adUserprincipalname"
          },
          "type": "identityAttribute"
        },
        {
          "type": "concat",
          "attributes": {
            "values": [
              {
                "attributes": {
                  "name": "uid"
                },
                "type": "identityAttribute"
              },
              "@test.com"
            ]
          }
        }
      ]
    }
  },
  "attributes": {},
  "isRequired": false,
  "type": "string",
  "isMultiValued": false
}