How to pass transform attributes to IdentityAttributeRule

[rahul_ch77 (Rahul CH)]

Hi sailers,

I’m trying to understand how values are passed from a Transform to a Cloud IdentityAttributeRule.

For example, if I define a transform like this:

{
  "attributes": {
    "name": "My Rule Utility",
    "userGroups": "group1, group2",
    "userEmail": {
      "attributes": {
        "sourceName": "HR",
        "attributeName": "email"
      },
      "type": "accountAttribute"
    }
  },
  "type": "rule",
  "name": "Rule Transform"
}

Inside the IdentityAttributeRule:

• Can I directly access userGroups and userEmail as runtime variables similar to idn, log, identity Or are these only available through the parameters map?

• If possible, could someone share a simple working example (transform JSON + rule snippet) showing the correct way to access these values?

[rohit_wekhande]

Hello @rahul_ch77 ,

If you are creating a Custom Idnetity Attribute Generator Cloud Rule, then, you cannot pass the runtime parameters from Transforms.

That approach is only for OOTB rule such as “Cloud Services Deployment Utility“.

In the custom Cloud IdentityAttributeRule which you are creating**,** you can only call the rule and input parameters will be passed inside the beanshell script.

Refer the below documentations from SailPoint.

Rule | SailPoint Developer Community

Regards,

Rohit Wekhande.

[RAKRHEEM (Rakesh Bhati)]

Hi 
 ,

This is how I had passed it in a Rule.

{

      "name": "MultivalueRule",

    "type": "rule",

    "attributes": {

        "name": "MultivalueRule",

        "cloudSourceName": "PPS Flat File",

        "attributeName": "concatTitleDept"

    },

    "internal": false

}

where cloudSourceName what the name of the source and attributeName was the input attribute

[rahul_ch77 (Rahul CH)]

@rohit_wekhande thank you for your response. However, According to the SailPoint documentation for Rule Transforms (type: "rule"), any values defined under the attributes section of the transform are passed into the rule execution context and can be accessed inside the rule. The documentation example using Cloud Services Deployment Utility clearly shows attributes like operation and numChars being supplied via the transform and consumed by the rule at runtime.

{
  "attributes": {
    "name": "Cloud Services Deployment Utility",
    "operation": "getEndOfString",
    "input": {
      "type": "trim"
    },
    "numChars": "3"
  },
  "type": "rule",
  "name": "Rule Transform"
}

@colin_mckibben @philip-ellis @KRM7 @kjakubiak @enistriminsait could you please provide your insights?

[rohit_wekhande]

@RAKRHEEM

attributeName

Hello @rahul_ch77 ,

Thanks for the insight! If that’s the case, its new for me. But, as per the Identity Attribute Cloud Rule document, its not mentioned anywhere.

Identity Attribute Rule | SailPoint Developer Community

Can you share you identity attribute cloud rule code as well if possible?

[KRM7 (Krishna Mummadi)]

SailPoint has developed a Rule with couple of methods, this Rule will be executed at cloud level.

Imagine a Java class with bunch of methods with inputs, in Transform you mention the method to use and inputs to pass.

Method → Operation

You can also have your own Identity Attribute Rule which is a cloud one, that is completely different. You cannot pass inputs from Transform to Rule.

[utkirjonkamiljanov]

This is a key distinction in ISC:

• A Rule Transform ("type": "rule") invokes a Transform Rule (type TransformRule) — NOT an IdentityAttribute rule. The variables in the attributes block ARE passed as dynamic variables to the TransformRule.

• An IdentityAttribute Rule is a separate rule type, used directly in Identity Profile mappings via the “Complex Data Source” option — it does not receive transform-level attribute variables; it only gets log, idn, identity, and oldValue.

• So userGroups and userEmail from the transform’s attributes block are only available in a TransformRule, accessed via the standard rule context, not in an IdentityAttribute rule. Docs to point to:

• https://developer.sailpoint.com/docs/extensibility/transforms/operations/rule/

• https://developer.sailpoint.com/docs/extensibility/rules/cloud-rules/identity-attribute-rule/