How does IIQ know that a new identity has been created

IdentityIQ (IIQ) IIQ Discussion and Questions
, , ,
1

Hi all,

How does IdentityIQ know that an identity cube has been created in the system. Is there a tag in the identity XML object?

In other words, how does it know to trigger a joiner?

Thanks in advance

2

Hi @rishavghoshacc

This flow is based on the Lifecycle Event: Joiner (Event Type: Create).

When a new user record is added from the HR source (authoritative source), we run the HR aggregation task. Following this, we run “Refresh Identity Cube,” ensuring the “Process events” option is selected. This action triggers the Joiner event, which in turn activates the Business Process.

Within the Business Process, the remaining joiner tasks are performed based on the event input data.

Please check the following configurations for a better understanding of the complete joiner flow:

  1. Refresh Identity Cube: Ensure “Process events” is selected.
  2. Lifecycle Event: Joiner (Event Type: Create).
  3. Business Process: “Lifecycle Event - Joiner”.
3
  1. When a new employee record is added in the HR system, SailPoint IdentityIQ detects it during the HR aggregation process.
  2. During aggregation, IIQ collects HR account data and applies correlation rules to find matching identities.
  3. If no match is found, IIQ creates a new Identity cube in the system and marks it as newly created.
  4. However, the Joiner process does not run immediately during aggregation.
    To trigger the Joiner event, the Refresh Identity Cube task must be executed with the “Process events” option enabled.
  5. This option allows IIQ’s Lifecycle Manager to detect that a new identity has been created.
  6. The Lifecycle Manager then fires an IdentityLifecycleEvent of type Create, which corresponds to the Joiner event.
    This event is defined under Setup → Lifecycle Events → Joiner (Event Type: Create).
  7. The Joiner event is configured to call a Business Process, typically named “Lifecycle Event - Joiner.”
  8. This business process (workflow) receives the identity and event data as inputs.
  9. It then performs all joiner-related actions such as assigning birthright roles, sending notifications, and creating accounts in target systems.
  10. Once the process completes, the identity’s lifecycleState is updated (e.g., to “Active”).
  11. This marks the completion of the Joiner phase for that identity.
  12. If “Process events” is not selected during refresh, no Joiner event will trigger, even if a new identity exists.
  13. Thus, the Joiner flow depends on proper configuration of aggregation, lifecycle event, and business process linkage.
1 Like
4

@msingh900 “If no match is found, IIQ creates a new Identity cube in the system and marks it as newly created.“

Is there any indicator/tag in the identity xml indicating that the identity is newly created? LIke we do for “needsRefresh”, etc?

5

In the Identity xml, there is no tag apart from the needsRefresh.

But if it is only to find the newly created identities, then you can use the Account Aggregation task option “Actions to include in the task result“ option and choose Create New Identity.

With the help of this, you can get a report from the Task Result of Account Aggregation about the users who get created at that particular run.

1 Like
6

When a new user is created through import. It marks user as needsCreateProcessing = true in identity. Also created identitytrigger entry in the identity xml if you check from debug page

1 Like
7

This option will only be available when you have created a Joiner Event and that should be enabled. Then only at attribute level , one attribute named as needsCreateProcessing will get added and also triggerSnapshot will get added to process any newly created identities.

If you do not have any event enabled for this create then it won’t generate. The latter one that is present inside the triggerSnapshot entry key will get removed once the refresh task with process events have been completed.

This is available in the identity XML

1 Like
8

It will be present in this format.

<entry key="triggerSnapshots">

        <value>

          <Map>

            <entry key="needsCreateProcessing">

              <value>

                <Boolean>true</Boolean>

              </value>

            </entry>

          </Map>

        </value>

      </entry>
9

Yes Manish that is correct.

1 Like
10

Also, refer the below article. I know it is old but have the similar information.

Lifecycle joiner event - How IIQ marks a new user as to-be-processed? - Compass

1 Like
11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.