Identity Attribute Transform - LCS

Hi,

When LCS is changed to ‘terminated’ either from HR record or by manually changing LCS. I want my Identity Attribute: termState set as “terminated”.

Based of LCS calculation transform, I can calculate for termination happening based on HR record. But I dont see the Identity Attribute: termState updated for manual termination.

Any suggestions on this would help

What differs for manual termination? You mean manually setting the lifecycle state as terminated within SailPoint?

@dominick-miller Yes, Thats right,

Can you share your transform?

@agutschow currently I’m using my lcs calculation transform as reference to derive my identity attribute: termState..

I know this will work for termination when the source has termination date set … But for manually setting lcs to termination, I’m not sure how to get that in my transform..

@agutschow
{
“name”: “NonEmployees - Oracle EBS Attribute 3 Updated”,
“type”: “static”,
“attributes”: {
“LCS”:

{
“attributes”: {
“name”: “cloudLifecycleState”
},
“type”: “identityAttribute”
}
,
“value”: “#if($LCS==‘terminated’)$LCS #end
},
“internal”: false
}

I’m using this simple transform. I see it is working. But this Identity Attribute cloudLifecycleState itself has a transform to calculate LCS>.

I’m more worried about this

Hi @chandramohan27, I believe you would be experiencing the issue only in case of manual termination, i.e the identityAttribute “termStatus” not getting updated.
And i think that would be updated once an identity refresh is applied on the identity. This is expected behavior.

But in case you want to populate the identity attribute at the same time in case of manual termination. I would recommend using “getReferenceIdentityAttribute transform”, Wherein you can use the uid attribute to find and then capture the LCS.

Use this transform and get the LifecycleState attribute.

So doing this would eventually update the identity attribute where you apply that as it is looking for the lifecycleState attribute.

Letme know if this helps :slight_smile:

@neeraj99

Here in the document, I see uid is set as manager to get the reference attributes of manager. But In my case, I want to get reference Identity of the user itself.

I think this reference attribute is to get the Identity attribute of another user.

As you are using this transform as reference, attribute termState will be calculated based on the same logic used for setting LCS automatically. Hence, manually changing LCS will not have any effect on termState

Try using the LCS value as a reference to calculate termState

@iamnithesh
Yes, but with reference transform. It will always get the value calculated from transform even when there is change in LCS set manually on Identity.

for example, when termination date is 31-12-2025… reference LCS transform gives me ACTIVE.. But when I change the LCS manually setting it to terminated.

I need my attribute : termstate to be updated as terminated

try using identity attribute LCS to calculate the value of terminated

@chandramohan27

Your use case is a bit tricky because usually you’ll need to reference the transform that calculates your LCS but that won’t work for 2 reasons :

  1. You want to update the data even with manual LCS change
  2. You want to perform calculations after the LCS attribute is calculated.

Normally, the last attribute that gets calculated is the LCS attribute, so in theory your transform as is will not work. Unless maybe :thinking: if you adopt one of the two approaches :

  1. reprocess the identity after every manual LCS change using a workflow.
  2. force a recalculation of specific transforms as part of the identity refresh process

For the option 2, I’m not exactly sure, but this solution might help :

{
  "name": "NonEmployees - Oracle EBS Attribute 3 Updated",
  "type": "static",
  "attributes": {
    "LCS": {
      "attributes": {
        "name": "cloudLifecycleState"
      },
      "type": "identityAttribute"
    },
    "value": "#if($LCS=='terminated')${LCS}#end"
  },
  "internal": false,
  "requiresPeriodicRefresh": true // ⬅️⬅️ add this line in your transform 
}

Let me know if that works.

Is the “termState” attribute actually required? What are you using that for that you couldn’t just reference LCS for? It kind of sounds like it’s just a less-reliable version of your LCS.

You’re basically tying yourself into a situation where you need to use an identityAttribute transform which you already pointed out won’t reliably, immediately update your “termState” attribute (although it will update during the next identity refresh so depending on what you’re using it for, that may actually be sufficient).

@KevinHarrington

During terminations [termination from HR / Manually setting LCS = terminated], we are disabling our EBS account and want to update an identity Attribute : termState as “terminated”.. And we have sync on IDN attr : termstate vs EBS attribute…

Currently there is a filter in place which filters out disabled accounts in next aggregation.. So we want to make sure the sync happens before the account gets removed from sailpoint.

@WhiteBat , As you mentioned the last attribute that gets calculated in LCS, So adding the transform for termState will cause errors for the new Identities as it will try to look for LCS value before the LCS attribute is set.

Indeed that will be an issue for newly created identities and identities that didn’t have an initial value of LCS.

To fix this, you can simply add a default value when calculating the LCS attribute, but the flag I referred to should reprocess the data after the LCS calculation (in theory)

Try this one instead:

{
  "name": "NonEmployees - Oracle EBS Attribute 3 Updated",
  "type": "static",
  "attributes": {
    "LCS": {
      "attributes": {
        "values": [
          {
            "attributes": {
              "name": "cloudLifecycleState"
            },
            "type": "identityAttribute"
          },
          "N/V" // ⬅️⬅️ Default value
        ]
      },
      "type": "firstValid"  // ⬅️⬅️ add this inner transform 
    },
    "value": "#if($LCS=='terminated')${LCS}#end"
  },
  "internal": false,
  "requiresPeriodicRefresh": true // ⬅️⬅️ add this line in your transform 
}
1 Like