# Lifecycle Transform issue

**URL:** <https://developer.sailpoint.com/discuss/t/lifecycle-transform-issue/1093>\
**Category:** SHF Discussion and Questions\
**Created:** [July 29, 2021, 2:17pm UTC](https://developer.sailpoint.com/discuss/t/lifecycle-transform-issue/1093 "2021-07-29T14:17:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![srimathiraman](https://avatars.discourse-cdn.com/v4/letter/s/bcef8e/32.png) [@srimathiraman](https://developer.sailpoint.com/discuss/u/srimathiraman)\
**Post date:** [July 29, 2021, 2:17pm UTC](https://developer.sailpoint.com/discuss/t/lifecycle-transform-issue/1093/1 "2021-07-29T14:17:34Z")

</div>

Hi,

We have a requirement to set Lifecycle State value as active or inactive based on attribute from HRSource and AD. If Status attribute in HR in A and in AD if it is not present in Disabled OU then we are setting it as active else inactive.

We have few users who dont have AD account. I just wanted to pass not null condition on DN value to incorporate this. I have added one extra condition for those users marked in bold nd italic in below transform. However it is not working.

Any suggestions.

Below is the transform:

{  
“attributes”: {  
“Status”: {  
“attributes”: {  
“attributeName”: “Status”,  
“sourceName”: “xxxx”  
},  
“type”: “accountAttribute”  
},  
“DN”: {  
“attributes”: {  
“attributeName”: “distinguishedName”,  
“sourceName”: “Active Directory”  
},  
“type”: “accountAttribute”  
},  
“value”: “#if($DN && !($DN.contains("OU=xxx,DC=ad-dev,DC=xxx,DC=net")) && $Status==‘A’)active#elseif($DN && ($DN.contains("OU=xxx,DC=ad-dev,DC=xxx,DC=net")) && $Status==‘D’)inactive#end”  
},  
“id”: “Transform-LifeCycleState Mapping”,  
“type”: “static”  
}

NOTE: Is there any way we can check whether the application account (Link) is present in user profile.

---

<div class="post-metadata">

**Author:** ![lisa\_ivy](https://avatars.discourse-cdn.com/v4/letter/l/ee7513/32.png) [@lisa\_ivy](https://developer.sailpoint.com/discuss/u/lisa_ivy)\
**Post date:** [July 29, 2021, 2:36pm UTC](https://developer.sailpoint.com/discuss/t/lifecycle-transform-issue/1093/2 "2021-07-29T14:36:51Z")

</div>

Hi Srimathiram,

I would suggest wrapping DN in a firstValid transform. I’ve edited the transform below (note the change to the value from " to ’ in the contains). Please try this new transform:

```auto
{
    "attributes": {
        "Status": {
            "attributes": {
                "attributeName": "Status",
                "sourceName": "xxxx"
            },
            "type": "accountAttribute"
        },
        "DN": {
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "attributeName": "distinguishedName",
                            "sourceName": "Active Directory"
                        },
                        "type": "accountAttribute"
                    },
                    "NA"
                ],
                "ignoreErrors": "true"
            }
        },
        "value": "#if($DN != 'NA' && !($DN.contains('OU=xxx,DC=ad-dev,DC=xxx,DC=net')) && $Status=='A')active#elseif($DN != 'NA' && ($DN.contains('OU=xxx,DC=ad-dev,DC=xxx,DC=net')) && $Status=='D')inactive#end"
    },
    "id": "Transform-LifeCycleState Mapping",
    "type": "static"
}

```

Thanks,

Lisa Ivy

---

<div class="post-metadata">

**Author:** ![srimathiraman](https://avatars.discourse-cdn.com/v4/letter/s/bcef8e/32.png) [@srimathiraman](https://developer.sailpoint.com/discuss/u/srimathiraman)\
**Post date:** [July 30, 2021, 2:57pm UTC](https://developer.sailpoint.com/discuss/t/lifecycle-transform-issue/1093/3 "2021-07-30T14:57:55Z")

</div>

Thanks Lisa for the response!  
Is there a way to check whether the AD account is disabled using the transform.

---

<div class="post-metadata">

**Author:** ![cpatel](https://avatars.discourse-cdn.com/v4/letter/c/48db29/32.png) [@cpatel](https://developer.sailpoint.com/discuss/u/cpatel)\
**Post date:** [August 2, 2021, 5:52am UTC](https://developer.sailpoint.com/discuss/t/lifecycle-transform-issue/1093/4 "2021-08-02T05:52:28Z")

</div>

There are 2 attributes you can use to derive if account is enabled or disabled.  
One is IIQDisabled-\> If NULL it is active and if true , account is disabled.  
This variable is common between all connectors and can be used for any type of source.

For specifically AD, There is another attribute which is accountFlags. If it contains “User Account is Disabled” then your AD account is disabled.

I wrote 2 transforms in past to get active account only from Identity if there are multiple AD account from same source under identity. You can take reference and build your transform

```auto
{
    "attributes": {
        "accountPropertyFilter": "( IIQDisabled.isNull())",
        "applicationId": "2c91808362878e2a01628fdf0c7d5aa2",
        "applicationName": "IdentityNow AD [source-111329]",
        "attributeName": "sAMAccountName",
        "sourceName": "AD"
    },
    "id": "Filter using IIQDisabled",
    "type": "accountAttribute"
}

{
				"attributes": {
					"accountPropertyFilter": "!(accountFlags.contains(\"User Account is Disabled\"))",
					"applicationId": "2c91808362878e2a01628fdf0c7d5aa2",
					"applicationName": "IdentityNow AD [source-111329]",
					"attributeName": "distinguishedName",
					"sourceName": "AD"
				},
				"id": "Filter using account Flag",
				"type": "accountAttribute"
			}

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [July 19, 2023, 2:21pm UTC](https://developer.sailpoint.com/discuss/t/lifecycle-transform-issue/1093/5 "2023-07-19T14:21:58Z")

</div>