ISC Workflow expected behavior

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi All,

Did you all notice that the “Get Accounts” operation in the workflow returns only the IDs, not the entire object?

image
image646×804 14.1 KB

image
image637×589 15.7 KB

2

There’s supposed to be an option for “Additional Output Data”

Optionally, select additional attributes to preserve and pass into subsequent steps of the workflow. These are extra attributes that you want added to the output data for your own logging or because an external application depends on more output from the workflow. All data required for the functionality of the workflow is automatically preserved in the workflow. To add extra data to your workflow output, select Add Additional Data and choose which attributes to preserve

3

Hey @mcheek I have seen this, but it is not fetching all the account attributes. Just want to know a few days back I could see all the attributes; now it fetches only the IDs, and the Additional Data can fetch a few attributes only.

4

Hi @Santhakumar.

I believe this is a recent change made to get accounts actions.

5

Guess its a recent change

6

It looks like I need to use the Get Account List API and filter with Identity ID then.

7

Hi @Santhakumar ,
I am working on a similar use case where I need the account ID to disable a user account. However, I’m seeing the same behavior—only the account ID is being returned, not the complete account object. Because of that, I’m unable to determine which source the account ID belongs to.

Also, in my case, the total account count is around 29k. I’m wondering if the current loop implementation has a limitation and is not iterating through all the accounts, which could be contributing to the issue. For now, I’m exploring an alternative approach using PowerShell.

If you’ve found any workaround or have any leads on how to retrieve the source information along with the account ID, please let me know.

Thanks.

8

It looks like that’s the only workaround available at the moment.

9

I had the same problem and created a support ticket, but sailpoint confirms this is by design.

The workaround i used it to use “define variable” and just use
“variableA.$”: “$.getAccounts.accounts”

Then the getAccounts step outputs all the account data and not just the id’s.

10

Hi @Santhakumar

Yes, if you are not using the getAccounts Output then it will only return the IDS.

So, based on the new update, The Action only returns the attributes (keys) which are being referenced in the subsequent steps.

What this means is that.

  1. Only the attributes that you are referencing below the getAccounts will get pulled in during getAccounts call. (even if you dont define them in the Add Additional data")
    EXAMPLE:
    image
    image607×532 19.6 KB

    image
    image706×715 19.4 KB

    image
    image1107×472 20.2 KB

    Here in this example, the name came because of the fact that i was referencing it in the below steps.
  2. If you require all the attributes, then you will have to select the “Add additional data” fileds.
  3. If you dont want to select the fields, and you would like to have all the attributes, i would suggest use a json path filter string something like this: $.getAccounts.accounts[?(@.sourceName=='Test Users Source')].attributes.location)
    I will not suggest the last option but just for a POC you can use that.

Hope this helps :slight_smile: