Hi All,
Does anyone know if identity attributes can be selectively hidden?
I need to hide one identity attribute for all identities but hidden attribute is required for provisioning.
Thank you…!!!
Hi Suresh. Do you mean to hide the attribute in the UI? I don’t believe this is possible. If you can explain your use case, maybe we can find a workaround solution. For example, if you are trying to generate a report of identities, but don’t want one of the attributes to be included, then we can probably figure out a way to do it.
Hi Colin McKibben,
Thank you for your response, in my case i have created one identity attribute for deriving(i have created one transform for deriving that attribute) one provisioning attribute but i need to hide that attribute in identity attribute list and need to use that attribute in provisioning.
Thank you…!!!
Hello @SureshKiran,
You can accomplish this using the transform you created in the CREATE provisioning profile.
For example if you call the GET provisioning profile API for the source you are looking to create identities on. {{baseUrl}}/sources/:sourceId/provisioning-policies/CREATE
You can take that response and modify the transform associated with the identity attribute you want to transform. I have wrapped the identity attribute displayName in a lower case transform below.
{
"name": "Account",
"description": null,
"usageType": "CREATE",
"fields": [
{
"name": "email",
"transform": {
"type": "identityAttribute",
"attributes": {
"name": "email"
}
},
"attributes": {},
"isRequired": false,
"type": "string",
"isMultiValued": false
},
{
"name": "displayName",
"transform": {
"type": "lower",
"attributes": {
"input": {
"type": "identityAttribute",
"attributes": {
"name": "displayName"
}
}
}
},
"attributes": {},
"isRequired": false,
"type": "string",
"isMultiValued": false
},
{
"name": "department",
"transform": {
"type": "identityAttribute",
"attributes": {
"name": "displayName"
}
},
"attributes": {},
"isRequired": false,
"type": "string",
"isMultiValued": false
},
{
"name": "firstName",
"transform": {
"type": "identityAttribute",
"attributes": {
"name": "displayName"
}
},
"attributes": {},
"isRequired": false,
"type": "string",
"isMultiValued": false
},
{
"name": "lastName",
"transform": {
"type": "identityAttribute",
"attributes": {
"name": "displayName"
}
},
"attributes": {},
"isRequired": false,
"type": "string",
"isMultiValued": false
},
{
"name": "enabled",
"transform": {
"type": "identityAttribute",
"attributes": {
"name": "displayName"
}
},
"attributes": {},
"isRequired": false,
"type": "boolean",
"isMultiValued": false
},
{
"name": "locked",
"transform": {
"type": "identityAttribute",
"attributes": {
"name": "displayName"
}
},
"attributes": {},
"isRequired": false,
"type": "boolean",
"isMultiValued": false
}
]
}
Once you have your post body, you can use the same API to PUT the new create provisioning policy
{{baseUrl}}/sources/:sourceId/provisioning-policies/CREATE. This will transform the attribute during provisioning and you will not have a visible attribute for it in the identity profile.
Hi @tyler_mairose,
Please see below transform, same like that i have written transform but i have tested more than 50 conditions.
In provisioning policy again i am adding two attribute values (Ex: attribute name = $Fname.$Sname.$condition-attribute) to the derived attribute.
is it possible to write same transform in policy?
{
"name": "condition-attribute",
"type": "static",
"attributes": {
"Department": {
"attributes": {
"sourceName": "source",
"attributeName": "Attribute1"
},
"type": "accountAttribute"
},
"Company": {
"attributes": {
"sourceName": "source",
"attributeName": "Attribute2"
},
"type": "accountAttribute"
},
"Division": {
"attributes": {
"sourceName": "source",
"attributeName": "Attribute4"
},
"type": "accountAttribute"
},
"value": "#if($Attribute1=='xyz' && $Attribute2=='abc' && $Attribute3=='pqr' && $Attribute4=='klm')condition1value#{elseif}($Attribute1=='xyz1' && $Attribute2=='abc1' && $Attribute3=='pqr1' && $Attribute4=='klm1')condition2value#{elseif}($Attribute1=='xyz2' && $Attribute2=='abc2' && $Attribute3=='pqr2' && $Attribute4=='klm2')condition3value#{else}condition4value"
}
}
As long as the attributes that you are attempting to combine in the condition-attribute transform exist as identity attributes, then yes, this is possible. You will just need to modify this transform to reference identityAttributes instead of accountAttributes. Taking your example above, it might look like this:
{
"name": "condition-attribute",
"type": "static",
"attributes": {
"Department": {
"attributes": {
"name": "Attribute1"
},
"type": "identityAttribute"
},
"Company": {
"attributes": {
"name": "Attribute2"
},
"type": "identityAttribute"
},
"Division": {
"attributes": {
"name": "Attribute4"
},
"type": "identityAttribute"
},
"value": "#if($Attribute1=='xyz' && $Attribute2=='abc' && $Attribute3=='pqr' && $Attribute4=='klm')condition1value#{elseif}($Attribute1=='xyz1' && $Attribute2=='abc1' && $Attribute3=='pqr1' && $Attribute4=='klm1')condition2value#{elseif}($Attribute1=='xyz2' && $Attribute2=='abc2' && $Attribute3=='pqr2' && $Attribute4=='klm2')condition3value#{else}condition4value"
}
}