LCS Transform for attribute change

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Team,
I want to create a LCS transform that triggers when user’s department is changed.
For example when a user’s department is changed from ops to tech then it’s LCS is set to “mover”

2

Hi @DeepanshuBisht ,
you can compare the value between “Account Attribute” and Identity Attribute value present for department. if both are different, you can assign the status as “Mover”.

you can refer the below code snippet

{      
        "type": "static",
        "attributes": {
            "requiresPeriodicRefresh": "true",
            "deptChange": {
                "attributes": {
                    "expression": "$departmentID eq $olddepartmentID",
                    "positiveCondition": "true",
                    "negativeCondition": "false",
                    "departmentID": {
                        "attributes": {
                            "sourceName": "",
                            "attributeName": ""
                        },
                        "type": "accountAttribute"
                    },
                    "olddepartmentID": {
                        "attributes": {
                            "input": {
                                "attributes": {
                                    "ignoreErrors": "true",
                                    "values": [
                                        {
                                            "attributes": {
                                                "attributeName": ""
                                            },
                                            "type": "identityAttribute"
                                        },
                                        "none"
                                    ]
                                },
                                "type": "firstValid"
                            }
                        },
                        "type": "lower"
                    }
                },
                "type": "conditional"
            },
            "value": "#if($deptChange.equalsIgnoreCase('false'))true#{else}false#end"
        },
        "internal": false
    }

give a try and let us know.

Thanks

3

Hi Stella,
It is returning true for all the cases.
for both mover and not mover scenarios currently using the above shared logic

4

Hi,
It will return “true” only when mover is deducted. Please check account attribute and identity attribute has a different value. Also make sure to handle case sensitive string comparison.

Thanks

1 Like
5

This could be happening because olddepartmentID uses lower transform, where as departmentID does not. Are there any upper case alphabets in the department ID?

6

Not i fixed all of that now everytime it returns true which means both value matches i just had a doubt if both the identity attribute and account attribute are using the same source should it work?

7

Are you using this transform for an attribute that is not departmentID?
During Identity refresh, the attributes are updated in the alphabetical order. It might be so happening that the departmentID is already updated before this transform is executed, and the values are same.

In my opinion right approach would be to use oldValue keyword. You can find some discussions about it in this link
https://developer.sailpoint.com/discuss/search?q=oldvalue%20%23idn%3Adiscussion-and-questions

Also, there is a reference to oldValue in this documentation

However, information available is limited and you may run some trial n error before you can figure out the right way of using it.

** If you are able to resolve the issue, please share your transform so that it can help others **

8

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.