Lifecycle event trigger for application link attribute change

Hello,

I have to setup an event trigger for an application if the link attribute for another application changes. For eg user has application A link and value of email is “[email protected]” if this changes to anything, i have to trigger the event. Now i have done this in past with IDENTITY LEVEL attribute but cant seem to make it work for the link attribute.
What i did: i have created a life cycle event with below code as the rule trigger

if( newIdentity!=null && previousIdentity!=null ){
log.debug("old identity in event test is "+ previousIdentity.toXml());
log.debug("new identity in event test is "+ newIdentity.toXml());
    IdentityService is=new IdentityService(context);
    Application app=context.getObjectByName(Application.class, "appname");
    Iterator oldIT=is.getLinks(previousIdentity,app).iterator();
    Iterator newIT=is.getLinks(newIdentity,app).iterator();
    while (newIT!=null && oldIT!=null && oldIT.hasNext() && newIT.hasNext()) {
      Link linkOld = (Link) oldIT.next();
      Link linkNew = (Link) newIT.next();

      String oldValue= linkOld.getAttribute("firstName");
      String newValue= linkNew.getAttribute("firstName");
     
log.debug("We found the value on link" + oldEndDate + "----old value----" + newEndDate+ "---new value---");
      if(oldValue!=null && newValue!=null && (!oldValue.equals(newValue)) )
	  {
	  seiamLog.debug("inside if block as value difference found");
        toReturn=true;
}
    }
    Util.flushIterator(oldIT);
    Util.flushIterator(newIT);
    context.decache();
  }

I went and changed the value via postman directly in the API DB and ran account aggregation, link value changes but when i run refresh with process event trigger , it doesnt do anything, log shows that both identity XML have the same link information.

Anyone knows what i am missing here? is link based event trigger not possible ?

Have asked the same question on compass as well, posting here for any help :slight_smile:

https://community.sailpoint.com/t5/IdentityIQ-Forum/Lifecycle-event-for-link-attribute-change/m-p/233140#M177422

1 Like

So i found a way to make this work through native change detection on primary application and trigger the workflow via native change event type on secondary app.

Please let me know if there is a better way/another way to do this.

1 Like

Hello @rohit_jaiswal1,

I came across this topic again. Here are some comments:

  1. From my point of view, no matter which trigger logic (Attribute Change, Native Change, Rule) used in your Lifecycle event. All will work.
  2. The problem within your code is that (most likely) while using IdentityService, it will always retrieve the links from the database one. Therefore, it will be always the same value. Instead, I would suggest the below logic:
String appName = "XXXX";
List oldLinks = previousIdentity.getLinks();
List newLinks = newIdentity.getLinks();

Link oldLink = oldLinks.stream().filter(e -> e.getApplicationName().equals(appName)).findFirst().orElse(null);
Link newLink = newLinks.stream().filter(e -> e.getApplicationName().equals(appName)).findFirst().orElse(null);

if (oldLink != null && newLink != null) {
	// your logic 
}	
  1. If you tend to use Attribute Change trigger, then this account attribute must be also sourced as an identity attribute. If you would like to display this attribute to the user for additional visibility then using Attribute Change trigger can be a good choice here. Otherwise, rule can also be a good option. In my opinion, there is major difference between using “Attribute Change/Rule” and Native Change Detection as Identity Trigger. Using Native Change Detection as a trigger only covers the changes happens on the endpoint directly, that means if by any chance this acconut attribute can be updated by IIQ, we will need to trigger the workflow separately. If you can make sure this attribute will only be changed during aggregation then Native Change Detection is also a good approach here.

Best regards,
Mike

1 Like

Thanks Mike for that let me give it a go without IS and using link iterator.
as for the second one, yes the attribute changes just in target. there is no source for it in IIQ