Incorrect Output for Static Transform

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , ,
1

I have the following transform (for identity profile):

{
    "name": "Pwd Never Expires",
    "type": "static",
    "attributes": {
        "adUserAccountControl": {
            "attributes": {
                "values": [
                    {
                        "type": "accountAttribute",
                        "attributes": {
                            "sourceName": "Active Directory",
                            "attributeName": "userAccountControl"
                        }
                    },
                    "null"
                ]
            },
            "type": "firstValid"
        },
        "value": "#if($adUserAccountControl == '66048' || $adUserAccountControl == '65536')True#elseif($adUserAccountControl == 'null')#{else}False#end"
    },
    "internal": false
}

The transform checks the value of accountAttribute “userAccountControl”.

  • If the value is ‘66048’ or ‘65536’, it returns True.
  • If the value is ‘null’, it returns nothing.
  • Otherwise, it returns False.

This transform works well for all identities except for one.
For some reason, this single identity is not returning True, False, or nothing, but it’s returning the value of accountAttribute “userAccountControl”.

  1. Other Identities (Correct Output)
  1. Single Identity (Incorrect Output)

I tried removing the #elseif condition, but the issue persists.
Is there anything wrong with the transform?

2

Try this:

#if($adUserAccountControl == '66048' || $adUserAccountControl == '65536')True#elseif($adUserAccountControl != 'null')False#{else}#end
3

“value”: “#if($adUserAccountControl && ($adUserAccountControl == ‘66048’ || $adUserAccountControl == ‘65536’))True#{else}False#end”

Can you check this ?

4

Unfortunately, that single account is still experiencing issues with this one.

5

Unfortunately, this didn’t resolve the issue and is failing for many identities.

6

Is it just failing for one identity ? For all other it is working fine ?

7

Hi @mike.lim - I’m confused as to how the value of userAccountControl could leak into the value of Pwd Never Expires based on that transform. Could it have been populated with a previous version of the transform and the new transform is choosing not to overwrite it because it’s returning null?

Maybe include a value for your third condition, “Not set” or something?

8

The identity was failing to process correctly due to a different transform.
Resolving the issue with another transform fixed the incorrect output problem.

9

Glad I could point you in the right direction

10

DId you just copied Marks response? Dude… @sup3rmark LOL