Help with Transform logic

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello,

I am working on a transform that when a user is in more then 1 HR source and one of the accounts is disabled to populate the correct email value. This value is used for attribute sync so my goal is to accurately show the primary email of the user. This is my first time writing a complex transform and want to make sure that I am thinking about this logic correctly. Any pointers on the below logic?

{
    "name": "findEmail",
    "type": "firstValid",
    "attributes": {
        "ADEmail":{
            "values":[
                {
                    "attributes": {
                        "attributeName": "mail",
                        "sourceName": "Active Directory"
                    },
                    "type": "accountAttribute"
                }
            ]
        },
        "workDayEmail":{
            "values": [
                {
                    "attributes": {
                        "attributeName": "EMAIL_ADDRESS_WORK",
                        "sourceName": "Workday Sandbox"
                    },
                    "type": "accountAttribute"
                }
            ]
        },
        "secZettaEmail":{
            "values":[
                {
                    "attributes": {
                        "attributeName": "personal_email",
                        "sourceName": "SecZetta"
                    },
                    "type": "accountAttribute"
                }
            ]
        },
        "SNEmail":{
            "values":[
                {
                    "attributes": {
                        "attributeName": "email",
                        "sourceName": "ServiceNow - SSMHCTEST"
                    },
                    "type": "accountAttribute"
                }
            ]
        },
        "noEmail":{
            "values":[
                {
                    "attributes": {
                        "value": "[email protected]"
                    },
                    "type": "static"
                }
            ]
            
        },
        "value": #if($workdayStatus == true)$secZettaEmail#elseif($workdayStatus == false)$workdayEmail#elseif($ADEmail != null)$ADEmail#elseif($SNEmail != null)$SNEmail#{else}$noEmail#end
    },
    "internal": false
}
2

$workdayStatus does not appear to be defined so that may an accountAttribute from Workday or additional logic. You also need double quotes around the velocity code.

"#if()#{else}#end"

In order to use the “value”, the top level type should be “static”.

I would recommend wrapping the accountAttribute types in a firstValid with a fallback value to check if null (“none”).

"adMail": {
    "type": "firstValid",
    "attributes": {
        "values": [
            {
                "type": "accountAttribute",
                "attributes": {
                    "sourceName": "AD",
                    "attributeName": "mail"
                }
            },
            "none"
        ]
    }
}

For the static value, you can either define that without the static type:

"noEmail": "[email protected]"

Or include that directly in the static “value”. Full example below (added check if Workday/SecZetta Email is “none”.

{
    "name": "findEmail",
    "type": "static",
    "attributes": {
        "workDayEmail":{
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "type": "accountAttribute",
                        "attributes": {
                            "sourceName": "Workday",
                            "attributeName": "EMAIL_ADDRESS_WORK"
                        }
                    },
                    "none"
                ]
            }
        },
        "SNEmail":{
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "type": "accountAttribute",
                        "attributes": {
                            "sourceName": "ServiceNow - SSMHCTEST",
                            "attributeName": "email"
                        }
                    },
                    "none"
                ]
            }
        },
        "ADEmail": {
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "type": "accountAttribute",
                        "attributes": {
                            "sourceName": "AD",
                            "attributeName": "mail"
                        }
                    },
                    "none"
                ]
            }
        },
        "workdayStatus": {
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "type": "accountAttribute",
                        "attributes": {
                            "sourceName": "Workday",
                            "attributeName": "status"
                        }
                    },
                    "none"
                ]
            }
        },
        "secZettaEmail": {
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "type": "accountAttribute",
                        "attributes": {
                            "sourceName": "SecZetta",
                            "attributeName": "personal_email"
                        }
                    },
                    "none"
                ]
            }
        },
        "value": "#if($workdayStatus == 'true' && $secZettaEmail != 'none')$secZettaEmail#elseif($workdayStatus == 'false' && $workdayEmail != 'none')$workdayEmail#elseif($ADEmail != 'none')$ADEmail#elseif($SNEmail != 'none')$SNEmail#{else}[email protected]#end"
    },
    "internal": false
}

If you did not have the Workday Status condition, you could just use firstValid like the below:

{
    "id": "af45ca02-45c0-491a-9067-8447b14c3c48",
    "name": "Work Email",
    "type": "firstValid",
    "attributes": {
        "values": [
            {
                "type": "accountAttribute",
                "attributes": {
                    "sourceName": "AD",
                    "attributeName": "mail"
                }
            },
            {
                "type": "accountAttribute",
                "attributes": {
                    "sourceName": "Workday",
                    "attributeName": "EMAIL_ADDRESS_WORK"
                }
            },
            "[email protected]"
        ]
    },
    "internal": false
}
1 Like
3

You don’t need a static Transform for this, firstValid type is the best for your requirement. To have email from only enabled account, we use accountPropertyFilter attribute in Transform. Every source has an attribute that defines the status of the account. For example, in AD it is UAC. I have added that option, find respective status attribute in each source and update filters accordingly.

FirstValid is nothing but if-else ladder in order.

{
  "attributes": {
    "values": [
      {
        "attributes": {
          "sourceName": "Active Directory",
          "attributeName": "mail",
		  "accountPropertyFilter": "(userAccountControl == \"512\")"
        },
        "type": "accountAttribute"
      },
      {
        "attributes": {
          "sourceName": "Workday Sandbox",
          "attributeName": "EMAIL_ADDRESS_WORK",
		  "accountPropertyFilter": "(userAccountControl == \"512\")"
        },
        "type": "accountAttribute"
      },
      {
        "attributes": {
          "sourceName": "SecZetta",
          "attributeName": "personal_email",
		  "accountPropertyFilter": "(userAccountControl == \"512\")"
        },
        "type": "accountAttribute"
      },
	  {
        "attributes": {
          "sourceName": "ServiceNow - SSMHCTEST",
          "attributeName": "email",
		  "accountPropertyFilter": "(userAccountControl == \"512\")"
        },
        "type": "accountAttribute"
      },
	  {
        "attributes": {
         "value": "[email protected]"
        },
        "type": "static"
      }
    ]
  },
  "type": "firstValid",
  "name": "Email first valid Transform"
}
4

The main issue is that if they want to use SecZetta’s Email if Workday is enabled. So getting the SecZetta attribute with the filter may not give that info, thus requiring the additional static Transform.

1 Like
5

Ya I missed that, your Transforms covers all the scenarios.

I liked the way you presented the solution. :slight_smile:

1 Like
6

Thank you I will give this a try and let you know the results. Sorry I missed the part of the logic for Workday Status I have added it below for more context to help anyone who finds this at a later date and also needs help.

{
    "attributes":{
        "workdayStatus":{
            "values": [
                {
                    "attributes": {
                        "sourceName": "WorkDay Sandbox",
                        "attributeName": "disabled"
                    }
                },
                "no workday account correlated"
            ],
            "type": "accountAttribute"
        }
    }

}
1 Like
7

I did as you suggested. Here is the error message I got.

There was an exception while calculating the value for this attribute. Error running account attribute transform for attribute 'null' on identity 'null' :java.lang.IllegalStateException: Unable to query for applications id in the account attribute transform neither sourceId or sourceName specified.

Here is the updated transform.

{
    "id": "f29865b9-3a40-4493-8dc7-61b46de16b19",
    "name": "Transform - Static - WDSZ - FindEmail",
    "type": "static",
    "attributes": {
        "workdayStatus": {
            "values": [
                {
                    "attributes": {
                        "sourceName": "WorkDay Sandbox",
                        "attributeName": "disabled"
                    }
                },
                "no workday account correlated"
            ],
            "type": "accountAttribute"
        },
        "ADEmail": {
            "values": [
                {
                    "attributes": {
                        "attributeName": "mail",
                        "sourceName": "Active Directory"
                    },
                    "type": "accountAttribute"
                },
                "none"
            ]
        },
        "workDayEmail": {
            "values": [
                {
                    "attributes": {
                        "attributeName": "EMAIL_ADDRESS_WORK",
                        "sourceName": "Workday Sandbox"
                    },
                    "type": "accountAttribute"
                },
                "none"
            ]
        },
        "secZettaEmail": {
            "values": [
                {
                    "attributes": {
                        "attributeName": "personal_email",
                        "sourceName": "SecZetta"
                    },
                    "type": "accountAttribute"
                },
                "none"
            ]
        },
        "SNEmail": {
            "values": [
                {
                    "attributes": {
                        "attributeName": "email",
                        "sourceName": "ServiceNow - SSMHCTEST"
                    },
                    "type": "accountAttribute"
                },
                "none"
            ]
        },
        "value": "#if($workdayStatus == true && $secZettaEmail != 'none')$secZettaEmail#elseif($workdayStatus == false && $workdayEmail != 'none')$workdayEmail#elseif($ADEmail != 'none')$ADEmail#elseif($SNEmail != 'none')$SNEmail#{else}[email protected]#end"
    },
    "internal": false
}
8

I also tried the following and got a different message this time.

There was an exception while calculating the value for this attribute. Error rendering template: #if($workdayStatus == true && $secZettaEmail != 'none')$secZettaEmail#elseif($workdayStatus == false && $workdayEmail != 'none')$workdayEmail#elseif($ADEmail != 'none')$ADEmail#elseif($SNEmail != 'none')$SNEmail#{else}[email protected]#end

Here is the transform:

{
    "id": "f29865b9-3a40-4493-8dc7-61b46de16b19",
    "name": "Transform - Static - WDSZ - FindEmail",
    "type": "static",
    "attributes": {
        "workdayStatus": {
            "type": "firstValid",
            "values": [
                {
                    "type": "accountAttribute",
                    "attributes": {
                        "sourceName": "WorkDay Sandbox",
                        "attributeName": "disabled"
                    }
                },
                "no workday account correlated"
            ]
        },
        "ADEmail": {
            "type": "firstValid",
            "values": [
                {
                    "attributes": {
                        "attributeName": "mail",
                        "sourceName": "Active Directory"
                    },
                    "type": "accountAttribute"
                },
                "none"
            ]
        },
        "workDayEmail": {
            "type": "firstValid",
            "values": [
                {
                    "attributes": {
                        "attributeName": "EMAIL_ADDRESS_WORK",
                        "sourceName": "Workday Sandbox"
                    },
                    "type": "accountAttribute"
                },
                "none"
            ]
        },
        "secZettaEmail": {
            "type": "firstValid",
            "values": [
                {
                    "attributes": {
                        "attributeName": "personal_email",
                        "sourceName": "SecZetta"
                    },
                    "type": "accountAttribute"
                },
                "none"
            ]
        },
        "SNEmail": {
            "type": "firstValid",
            "values": [
                {
                    "attributes": {
                        "attributeName": "email",
                        "sourceName": "ServiceNow - SSMHCTEST"
                    },
                    "type": "accountAttribute"
                },
                "none"
            ]
        },
        "value": "#if($workdayStatus == true && $secZettaEmail != 'none')$secZettaEmail#elseif($workdayStatus == false && $workdayEmail != 'none')$workdayEmail#elseif($ADEmail != 'none')$ADEmail#elseif($SNEmail != 'none')$SNEmail#{else}[email protected]#end"
    },
    "internal": false
}
9

The second format is correct for getting the account attributes. Try putting the boolean values as strings.

#if($workdayStatus == 'true' && $secZettaEmail != 'none')$secZettaEmail#elseif($workdayStatus == 'false' && $workdayEmail != 'none')$workdayEmail#elseif($ADEmail != 'none')$ADEmail#elseif($SNEmail != 'none')$SNEmail#{else}[email protected]#end
10

Here is what is currently working. We are still testing it to make sure it is a 100% but this is what I have.

{
    "id": "f29865b9-3a40-4493-8dc7-61b46de16b19",
    "name": "Transform - Static - WDSZ - FindEmail",
    "type": "static",
    "attributes": {
        "workdayStatus": {
            "attributes": {
                "type": "firstValid",
                "values": [
                    {
                        "type": "accountAttribute",
                        "attributes": {
                            "sourceName": "WorkDay Sandbox",
                            "attributeName": "disabled"
                        }
                    },
                    "none"
                ]
            },
            "type": "firstValid"
        },
        "ADEmail": {
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "attributeName": "mail",
                            "sourceName": "Active Directory"
                        },
                        "type": "accountAttribute"
                    },
                    "none"
                ]
            },
            "type": "firstValid"
        },
        "workDayEmail": {
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "attributeName": "EMAIL_ADDRESS_WORK",
                            "sourceName": "Workday Sandbox"
                        },
                        "type": "accountAttribute"
                    },
                    "none"
                ]
            },
            "type": "firstValid"
        },
        "secZettaEmail": {
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "attributeName": "personal_email",
                            "sourceName": "SecZetta"
                        },
                        "type": "accountAttribute"
                    },
                    "none"
                ]
            },
            "type": "firstValid"
        },
        "SNEmail": {
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "attributeName": "email",
                            "sourceName": "ServiceNow - SSMHCTEST"
                        },
                        "type": "accountAttribute"
                    },
                    "none"
                ]
            },
            "type": "firstValid"
        },
        "value": "#if($workdayStatus == 'true' || $workdayStatus == 'none' && $secZettaEmail != 'none')$secZettaEmail#elseif($workdayStatus == 'false' && $workdayEmail != 'none')$workdayEmail#elseif($ADEmail != 'none')$ADEmail#elseif($SNEmail != 'none')$SNEmail#{else}[email protected]#end"
    },
    "internal": false
}
11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.