Iteration during aggergation

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hey, I’ve got a bit of a pickle with the data returned from Google’s Admin API. I’ve started building a web services connecter instead of using the SP provided one due to a correlation issue (which I’m now facing again).

The endpoint returns a response like:

{
  "kind": "admin#directory#users",
  "etag": "\"etag\"",
  "users": [
    {
      "kind": "admin#directory#user",
      "id": "userid",
      "etag": "\"etag\"",
      "primaryEmail": "[email protected]",
      "name": {
        "givenName": "Name",
        "familyName": "LastName",
        "fullName": "Name LastName"
      },
      "isAdmin": true,
      "isDelegatedAdmin": false,
      "lastLoginTime": "someDate",
      "creationTime": "someDate",
      "agreedToTerms": true,
      "suspended": false,
      "archived": false,
      "changePasswordAtNextLogin": false,
      "ipWhitelisted": false,
      "externalIds": [
        {
          "value": "someNumber",
          "type": "organization"
        }
      ],
      "emails": [
        {
          "address": "[email protected]",
          "primary": true
        },
        {
          "address": "[email protected]"
        }
      ],
      "languages": [
        {
          "languageCode": "en",
          "preference": "preferred"
        }
      ],
      "nonEditableAliases": [
        "[email protected]"
      ],
      "customerId": "customerId",
      "orgUnitPath": "/",
      "isMailboxSetup": true,
      "isEnrolledIn2Sv": false,
      "isEnforcedIn2Sv": true,
      "includeInGlobalAddressList": true
    }
  ],
  "nextPageToken": "nextPageToken"
}

The trouble is that the key “externalIds” - I’m mapping this to an attribute in the account schema via $.externalIds[?(@.type=='organization')].value - root path being $.users[*]. This looks fine on first glance but if I set the employeeID (the attribute name in account schema) as accountName on the source, I can see that Sailpoint actually stores it as an array (so an accountName in this instance would be [someNumber] instead of someNumber, which causes correlation to fail.

There’s no way to work around it with jsonpath since the output will always be an array if the input is an array - for the rest of the attributes that is not an issue since IDN will iterate over each object and map the corresponding attributes.
Is there a way I could… instruct IDN to “iterate” over a specific attribute? Perhaps a child account aggregation operation, where the root path would be $.users[*].externalIds[?(@.type=='organization')].value?
Any suggestions welcome.

2

write afteroperation rule and convert that array into normal string. Should not be much complex.

1 Like
3

Hey Chirag, yeah that would probably work.

I found an even easier alternative to simply create a new custom schema in Google Workspace with a single custom attribute.