How to prioritize "Active" account record over "Inactive" when multiple records exist for one Person Number in ORACLE HCM CLOUD

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Sailors,

I am working with an Oracle HCM Cloud source as our authoritative system. And using single File for All active terminated and future hires, For a single PersonNumber there were multiple account records (e.g., one Active and multiple Inactive). Currently, all records have the primaryFlag set to ‘Y’.

The Issue:
During aggregation, SailPoint is following a “last record processed wins” behavior.

My Goal:
I want the Identity to pull the Full Record (all attributes) based on this priority:

  1. If an Active record exists, use that record for all identity attributes.e.

  2. If no Active records exist, multiple inactive exists use the record with the latest Hire Date.

Questions:

  1. Is there a way to handle this at the Source Schema/JSON Path level

  2. Is there a more efficient “Best Practice” for Oracle HCM to ensure the identity’s attributes don’t “flip” between different assignment records?

Any advice or examples of how you’ve handled multi-assignment Oracle HCM identities would be greatly appreciated!

2

Hey @Tulasi ,

I would suggest to go with ISC filterstring pull in all active accounts from Oracle HCM

(active=true) at source level IdentityNow Account Filtering during Account Aggregation - Compass

Or try with below transform at IP, which filters accounts with hire date and

  "type": "accountAttribute",
  "name": "Identity Attribute Transform",
  "attributes": {
    "attributeName": "abc",
    "sourceName": "xyz",
    "accountPropertyFilter": "(WORKER_STATUS == \"active\")",
    "accountSortAttribute": "hireDate",
    "accountSortDescending": true,
    "accountReturnFirstLink": true
  }
}

and then checks active status as per krishna s suggestion IDN Multiple Authoritative Source in Single Identity

Thanks in advance
Avinash Mulpuru

3

Hi @amulpuru
Thanks for suggestion, but it will result in filtering only active records, where as I need to have both active and inactive records to be fetched, and if single user has both active and inactive record I need active one to be fetched whereas if all records present for the user were inactive then I need the latest inactive account to be fetched

Thanks
Tulasi

5

Go for the second option of transform lmk the behaviour of ISC

6

Thanks for the suggestion. I’ve considered this approach; however, to ensure consistency across the entire Identity Cube, I would need to apply this transform to every identity attribute (Name, Email, Hire Date, etc.).

Without doing so, the ‘last record processed’ will still overwrite other attributes, leading to a mismatched identity where the Status is active but the Name or Email belongs to an old, terminated record

So I was checking for is there any other approach I can achieve my requirement,

7

I have couple of qsns

Have you tried applying this transformation at accountID was it overriding other attributes like email firstname lastname as there no filter transform being applied or you just assuming it as it will override ,any concrete evidence like screenshots or HCM account payload for the same?

As of now I don’t think any other approach than applying transforms every attributes if it is overriding values without filter transforms on every attributes

Thanks in advance

Avinash Mulpuru

8

I did try this out but not at AccountID level since the Account ID is PERSON_NUMBER and it will be same for MultipleRecords , Where As I tried IT Out At ASSIGNMENT_STATUS attribute only that attribute fetched the Active status one where as all other attributes still has the last records Value
For ORACLE HCM Cloud Connector there will be Json Path mapping which helps us to choose the attribute to fetch from which record So I was hoping for any Guidance from that end will it be possible to acheive it from Json Path Mapping or not

Thankyou!

9

@Tulasi It appears similar to scenarios involving the same user across multiple authoritative sources, which are typically handled through identity profile prioritization. Applying transforms at all the attribute level in this context is not considered a best practice. I suggest engaging SailPoint Expert Services for further guidance.