Identity attribute change filter

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , ,
1

Hi everyone, I need to create a filter that checks if the “codigoDepartamento” and “titleCode” attributes exist and if the “segmento” attribute is equal to “LJ” or “EC_In_LJ”; otherwise, it checks if the “codigoDepartamento” attribute has changed and if the “segmento” attribute has changed and is different from “EC_In_LJ”.

If I do it this way, it works, but it will be incomplete
$[?((“codigoDepartamento” in @.changes[].attribute) || (“codigoDepartamento” in @.changes[].attribute && “titleCode” in @.changes[*].attribute))]

I set it up this way, but it isn’t working correctly.

$[?(((“codigoDepartamento” in @.changes[].attribute) && (“titleCode” in @.changes[].attribute) && @.changes[?(@.attribute == “segmento” && @.newValue in [“LJ”,“EC_In_LJ”])]))]

this is my input:
{
“_meta”: {
“invocationId”: “”,
“subscriptionId”: “”,
“triggerType”: “FIRE_AND_FORGET”
},
“changes”: [
{
“attribute”: “codigoDepartamento”,
“newValue”: “ss”,
“oldValue”: “asas”
},
{
“attribute”: “title”,
“newValue”: “aaa”,
“oldValue”: “1qaaq”
},
{
“attribute”: “titleCode”,
“newValue”: “aaa”,
“oldValue”: “1qaaq”
},
{
“attribute”: “segmento”,
“newValue”: “LJ”,
“oldValue”: “sas”
}
],
“identity”: {
“id”: “”,
“name”: “User Mov”,
“type”: “IDENTITY”
}
}

2

Hi @guilherme_sec ,

Try this filter:

$[?(
  ($.changes[?(@.attribute=='codigoDepartamento')].length() > 0 && $.changes[?(@.attribute=='titleCode')].length() > 0 && $.changes[?(@.attribute=='segmento' && @.newValue in ['LJ','EC_In_LJ'])].length() > 0)
  ||
  ($.changes[?(@.attribute=='codigoDepartamento')].length() > 0 && $.changes[?(@.attribute=='segmento' && @.newValue != 'EC_In_LJ')].length() > 0)
)]

Test it against your payload (and a non-matching variant) with the JSON Path Evaluator before deploying — full operator reference: Filtering Events.

3

Hello Guilherme. Your first filter works but is incomplete because: A || (A && B) always reduces to just A. So it is effectively only checking whether codigoDepartamento changed.

In your second filter, this part is valid:

@.attribute == "segmento" &&
@.newValue in ["LJ","EC_In_LJ"]

Both conditions are being checked against the same segmento change entry.

The issue is more likely that the nested filter result is being used directly as a Boolean. Add size 1 so the filter explicitly checks that a matching change exists. Based exactly on the conditions you described, the filter would be:

$[?(
  (
    ($.changes[?(@.attribute == "codigoDepartamento")] size 1) &&
    ($.changes[?(@.attribute == "titleCode")] size 1) &&
    ($.changes[?(
      @.attribute == "segmento" &&
      @.newValue in ["LJ","EC_In_LJ"]
    )] size 1)
  )
  ||
  (
    ($.changes[?(@.attribute == "codigoDepartamento")] size 1) &&
    ($.changes[?(
      @.attribute == "segmento" &&
      @.newValue != "EC_In_LJ"
    )] size 1)
  )
)]

$[?((($.changes[?(@.attribute == "codigoDepartamento")] size 1) && ($.changes[?(@.attribute == "titleCode")] size 1) && ($.changes[?(@.attribute == "segmento" && @.newValue in ["LJ","EC_In_LJ"])] size 1)) || (($.changes[?(@.attribute == "codigoDepartamento")] size 1) && ($.changes[?(@.attribute == "segmento" && @.newValue != "EC_In_LJ")] size 1)))]

I would test it with your sample payload in SailPoint’s JSONPath evaluator before adding it to the workflow.

4

There is one overlap in that requirement. When segmento is LJ, the second branch also matches because LJ != EC_In_LJ. That means titleCode would not be required for LJ. If your intention is for titleCode to be required whenever segmento is either LJ or EC_In_LJ, replace:

@.newValue != "EC_In_LJ"

with:

@.newValue nin ["LJ","EC_In_LJ"]

Also make sure the actual filter uses straight quotes ("), not smart quotes (" ").

The changes array only contains attributes that changed during that event. So “exists” here means the attribute is present in the change payload, not that those attributes currently hold values on the identity.

5

It’s working, thank you harish Punna