Lifecycle state "Mover" setting, how to identify the change of attribute and how to configure JML

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , , ,
1

Hi Professionals,
I am integrating the Workday with identitynow and we applied the JML(joiner, mover and leaver). For example, there is a person who worked in HR department and will change to IT department. For the configuration of mover, i have couple thought:

  1. Set Mover as a lifecycle state, and we will have a transform rule for detecting if the old department attribute value equals to the current value. If not match, then this identity will change its lifecycle state from “Joiner” to “Mover”. And in the provisioning page, we will choose configure changes under the ‘Settings for previous accounts’ and tick Disable to disable the current accounts. and set a Before Provisioning Rule to change the identity to “Joiner” state and enable corresponding account.

  2. Set Mover as a Before Provisioning Rule. After detecting the old department attribute value is not equals to the current value. The identity will be switched to “Leaver” from “Joiner”, the “Leaver” lifecycle state will disable the current account of the identity and then we change the identity to “Joiner” lifecycle state which will assign corresponding accounts to the identity.

Could you tell me can the thoughts above be achieved in identitynow and may i ask about how should i set it to achieve the thoughts into practice? Thank you very much~~~

2

Hey Yema and congratulations on your first post here!
I think a good thing would be to clarify what you want the mover process to trigger or happen before deciding on a solution. Typically, a mover scenario updates current access assignements and so on - do you really want to disable accounts based on the mover process? Or what’s the business requirements here? :slight_smile:

3

Hi @YEMA1,

Typically your lifeCycle states would be prestart/active/inactive. There is no ‘mover’ status, as they would be going from ‘active’ to ‘active’. As the attributes change from the HR source, then if you have any RBAC in place, entitlements will change automatically with no need from beforeProvisioning rules.

4

Hi Yema,
Yes based on comparing with the old value a workflow can be triggered. But can you provide more information on what you would trigger as movers process?
Thanks

5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.