Lifecycle State against AD Account expires

[VBsupport]

Hello Everyone,

While everyone sleeps need just a little look into the code below.
I had to add a LOA state that if the date is 5 days before the AD accountsexpire attribute to mark them LOA else the normal active before and inactive after the account expires. Now i have this working for the two in other code but when now added the LOA i am getting a Null response back on the lifecycle state. Any help would be greatful.

"name": "IDN LifeCycle_v1",
    "type": "static",
    "attributes": {
        "requiresPeriodicRefresh": "true",
        "activestate": {
            "attributes": {
                "firstDate": "now",
                "secondDate": {
                    "attributes": {
                        "input": {
                            "type": "accountAttribute",
                            "attributes": {
                                "attributeName": "accountExpires",
                                "sourceName": " ACTIVE DIRECTORY NON-EMPLOYEE ACCOUNT SOURCE"
                            }
                        },
                        "inputFormat": "EPOCH_TIME_WIN32",
                        "outputFormat": "ISO8601"
                    },
                    "type": "dateFormat"
                },
                "operator": "LT",
                "positiveCondition": "yes",
                "negativeCondition": "no"
            },
            "type": "dateCompare"
        },
        "inactivestate": {
            "attributes": {
                "firstDate": "now",
                "secondDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "input": {
                                        "type": "accountAttribute",
                                        "attributes": {
                                            "attributeName": "accountExpires",
                                            "sourceName": "VALEY ACTIVE DIRECTORY NON-EMPLOYEE ACCOUNT SOURCE"
                                        }
                                    },
                                    "inputFormat": "EPOCH_TIME_WIN32",
                                    "outputFormat": "ISO8601"
                                },
                                "type": "dateFormat"
                            }
                        ],
                        "ignoreErrors": "true"
                    }
                },
                "operator": "GT",
                "positiveCondition": "yes",
                "negativeCondition": "no"
            },
            "type": "dateCompare"
        },
        "LOA": {
            "attributes": {
                "firstDate": {
                    "attributes": {
                        "expression": "no",
                        "roundUp": false
                    },
                    "type": "dateMath"
                },
                "secondDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "input": {
                                        "type": "accountAttribute",
                                        "attributes": {
                                            "attributeName": "accountExpires",
                                            "sourceName": " ACTIVE DIRECTORY NON-EMPLOYEE ACCOUNT SOURCE"
                                        }
                                    },
                                    "inputFormat": "EPOCH_TIME_WIN32",
                                    "outputFormat": "ISO8601"
                                },
                                "type": "dateFormat"
                            },
                            {
                                "attributes": {
                                    "expression": "now+5d/d",
                                    "roundUp": false
                                },
                                "type": "dateMath"
                            }
                        ]
                    }
                },
                "operator": "LT",
                "positiveCondition": "yes",
                "negativeCondition": "no"
            },
            "type": "dateCompare"
        },
        "value": "#if($inactivestate=='yes')inactive#elseif($LOA=='yes')LOA#elseif(($activestate=='yes') && ($inactivestate=='no'))active#{else}UNKNOWN#end"
    },
    "internal": false
}

[sjoyee (Jo Yee Siang)]

Hi @VBsupport, is the following expression value for firstDate pasted correctly here? Else it could be the cause of error, since I think it should be “now” instead.

 "LOA": {
    "attributes": {
        "firstDate": {
            "attributes": {
                "expression": "no",
                "roundUp": false
            },
            "type": "dateMath"
        },

Hope this helps.

[VBsupport]

I also tried to use the formatted endate that formatted the Account expire into MM/DD/YYYY but I am getting a parse error

   "name": "IDN LifeCycle_v1",
    "type": "static",
    "attributes": {
        "requiresPeriodicRefresh": "true",
        "activestate": {
            "attributes": {
                "firstDate": "now",
                "secondDate": {
                    "attributes": {
                        "input": {
                            "type": "identityAttribute",
                                    "attributes": {
                                            "name": "endDate"

                            }
                        },
                        "inputFormat": "MM/dd/yyyy",
                        "outputFormat": "MM/dd/yyyy"
                    },
                    "type": "dateFormat"
                },
                "operator": "LT",
                "positiveCondition": "yes",
                "negativeCondition": "no"
            },
            "type": "dateCompare"
        },
        "inactivestate": {
            "attributes": {
                "firstDate": "now",
                "secondDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "input": {
                                        "type": "identityAttribute",
                                    "attributes": {
                                            "name": "endDate"
                                        }
                                    },
                                     "inputFormat": "MM/dd/yyyy",
                                     "outputFormat": "MM/dd/yyyy"
                                },
                                "type": "dateFormat"
                            }
                        ],
                        "ignoreErrors": "true"
                    }
                },
                "operator": "GT",
                "positiveCondition": "yes",
                "negativeCondition": "no"
            },
            "type": "dateCompare"
        },
        "LOA": {
            "attributes": {
                "firstDate": {
                    "attributes": {
                        "expression": "no",
                        "roundUp": false
                    },
                    "type": "dateMath"
                },
                "secondDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "input": {
                                        "type": "identityAttribute",
                                    "attributes": {
                                            "name": "endDate"
                                        }
                                    },
                                     "inputFormat": "MM/dd/yyyy",
                                    "outputFormat": "MM/dd/yyyy"
                                },
                                "type": "dateFormat"
                            },
                            {
                                "attributes": {
                                    "expression": "now+5d/d",
                                    "roundUp": false
                                },
                                "type": "dateMath"
                            }
                        ]
                    }
                },
                "operator": "LT",
                "positiveCondition": "yes",
                "negativeCondition": "no"
            },
            "type": "dateCompare"
        },
        "value": "#if($inactivestate=='yes')inactive#elseif($LOA=='yes')LOA#elseif(($activestate=='yes') && ($inactivestate=='no'))active#{else}UNKNOWN#end"
    },
    "internal": false
}

[VBsupport]

Good catch and must of fat fingered however I am still getting the Error

There was an exception while calculating the value for this attribute. null

This was applied to the first code i put not the change of type identity. That was just another thought i had

[sjoyee (Jo Yee Siang)]

I see.

You may need to format the dateMath output to ISO8601 using dateFormat operation as the output for dateMath operation may not be exactly the input format required by dateCompare operation. You can refer to the following related discussions:

Transform firstValid, dateCompare, dateFormat, dateMath

Your outermost transform is FirstValid, but the attributes of this transform is not as per the format required. it needs to have "values" : [...] and you have a dateFormat transform directly assigned to attributes. I am not sure if it is returning any value. As per my knowledge this should be throwing an error. You may refer to the example from documentation page https://developer.sailpoint.com/idn/docs/transforms/operations/first-valid Instead of using an empty string as default value in thes…

IDN: dateFormat transform doesn't support ISO8601, dateMath output format

Dear IDN Team, The transform dateFormat ( Date Format | SailPoint Developer Community ) supports only one format from the ISO8601 standard. ISO8601: This is the date format corresponding to the ISO8601 standard. The exact format is expressed as “yyyy-MM-dd’T’HH:mm:ss.SSSZ”. […] If no inputFormat is provided, the transform assumes that it is in ISO8601 format. From what I can see, the only supported “ISO8601 format” for dateFormat is yyyy-MM-dd'T'HH:mm:ss.SSSZ (seconds and exactly 3 digit…

[VBsupport]

I changed all the date formats like that as well and now I am getting a null value.

The attribute was refreshed with the AD time stamp, so it holds the time but the transform for some reason won’t do the math, or my values are also messed up.

I am sure it some simple, but I am just stumped at this point…

[phil_awlings (Phil Rawlings)]

Pop the whole code in here so we can see it,

[baoussounda (Ousmane N'DIAYE)]

Hi @VBsupport,

can you remove inputFormat in your transform and test again ?

Share also your transform.

[VBsupport]

{
    "id": "",
    "name": "IDN LifeCycle_v1",
    "type": "static",
    "attributes": {
        "requiresPeriodicRefresh": "true",
        "activestate": {
            "attributes": {
                "firstDate": "now",
                "secondDate": {
                    "attributes": {
                        "input": {
                            "type": "accountAttribute",
                            "attributes": {
                                "attributeName": "accountExpires",
                                "sourceName": " ACTIVE DIRECTORY NON-EMPLOYEE ACCOUNT SOURCE"
                            }
                        },
                        "inputFormat": "ISO8601",
                        "outputFormat": "yyyy-MM-dd'T'HH:mm"
                    },
                    "type": "dateFormat"
                },
                "operator": "LT",
                "positiveCondition": "yes",
                "negativeCondition": "no"
            },
            "type": "dateCompare"
        },
        "inactivestate": {
            "attributes": {
                "firstDate": "now",
                "secondDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "input": {
                                        "type": "accountAttribute",
                                        "attributes": {
                                            "attributeName": "accountExpires",
                                            "sourceName": " ACTIVE DIRECTORY NON-EMPLOYEE ACCOUNT SOURCE"
                                        }
                                    },
                                    "inputFormat": "ISO8601",
                                    "outputFormat": "yyyy-MM-dd'T'HH:mm"
                                },
                                "type": "dateFormat"
                            }
                        ],
                        "ignoreErrors": "true"
                    }
                },
                "operator": "GT",
                "positiveCondition": "yes",
                "negativeCondition": "no"
            },
            "type": "dateCompare"
        },
        "LOA": {
            "attributes": {
                "firstDate": {
                    "attributes": {
                        "expression": "no",
                        "roundUp": false
                    },
                    "type": "dateMath"
                },
                "secondDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "input": {
                                        "type": "accountAttribute",
                                        "attributes": {
                                            "attributeName": "accountExpires",
                                            "sourceName": " ACTIVE DIRECTORY NON-EMPLOYEE ACCOUNT SOURCE"
                                        }
                                    },
                                    "inputFormat": "ISO8601",
                                    "outputFormat": "yyyy-MM-dd'T'HH:mm"
                                },
                                "type": "dateFormat"
                            },
                            {
                                "attributes": {
                                    "expression": "now+5d/d",
                                    "roundUp": false
                                },
                                "type": "dateMath"
                            }
                        ]
                    }
                },
                "operator": "LT",
                "positiveCondition": "yes",
                "negativeCondition": "no"
            },
            "type": "dateCompare"
        },
        "value": "#if($inactivestate=='yes')inactive#elseif($LOA=='yes')LOA#elseif(($activestate=='yes') && ($inactivestate=='no'))active#{else}UNKNOWN#end"
    },
    "internal": false

[VBsupport]

I try to remove both input and output but I did not think you could just do one for some reason

[baoussounda (Ousmane N'DIAYE)]

May be you have this error only if account expires is empty ? :

[vguleria (Vikas Guleria)]

Hi @VBsupport

It will be difficult to analyze this if we try to troubleshoot the complete transform. Can you please try to break the transform into smaller block like create a test transform for each variable and then see the output of each variable by using that transform on identity profile preview option.

Then you should be able to identify where the issue is occurring.

I hope the information helps.

Regards
Vikas.

[phil_awlings (Phil Rawlings)]

It looks like you’ve got the input/outputs the wrong way round.
The ‘Date compare’ function only works if both are in ISO8601 format
Date Compare | SailPoint Developer Community
this is from your code:

 "inputFormat": "ISO8601",
 "outputFormat": "yyyy-MM-dd'T'HH:mm" 

and it should be:

"input": "yyyy-MM-dd'T'HH:mm",   (Or whatever format it is in)
"output": "ISO8601"

Also line 65 should be “now”, not “no”.

        "LOA": {
            "attributes": {
                "firstDate": {
                    "attributes": {
                        "expression": "no",          <=========
                        "roundUp": false
                    },
                    "type": "dateMath"
                },

[VBsupport]

so data is coming in as month -day - year- min-sec AM/PM/ Time zone.
What does SailPoint want to see it in is the real question i am wondering

I have don’t epoch to iso and that did not work either sadly. i already fixed the No thing. This has me to believe its a format problem and it can not compare the in to the out

[phil_awlings (Phil Rawlings)]

It might be because you are declaring the date format as “yyyy-MM-dd’T’HH:mm”, but in fact (according to the screenshot) its “MM/dd/yyyy 'T’HH:mm:ss *”

NB * - I’ve not seen this format where it is also including am/pm and local timezone.

If I was in your position, I would probably try to ditch everything past the year function and just keep the first 10 characters, something like this:

"secondDate": {
    "type": "dateFormat",
    "attributes": {
        "type": "substring",
        "attributes": {
            "input": {
                "type": "accountAttribute",
                "attributes": {
                    "attributeName": "accountExpires",
                    "sourceName": " ACTIVE DIRECTORY NON-EMPLOYEE ACCOUNT SOURCE"
                }
            },
            "end": 10,
            "begin": 0
        },
        "inputFormat": "MM/dd/yyyy",
        "outputFormat": "ISO8601"
    }
}

[baoussounda (Ousmane N'DIAYE)]

Can you provide an exmple of value of an account expires in your case ?

[VBsupport]

never thought about trimming everything and cleaning it up. I going to give that a try.