Listing out the users without HR Application

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Hello Everyone,

New to SailPoint IIQ. I am trying to list out the users that do not have HR application in SailPoint. I am using following Query Filter, that does not give me correct users.

Can anyone help to fix this filter?


QueryOptions qo = new QueryOptions();

  qo.addFilter(Filter.and(Filter.eq("links.application.name", "Active Directory"), Filter.eq("links.disabledAccount", "false")));
  qo.addFilter(Filter.and((Filter.eq("orgStatus", "Hired")));
  qo.addFilter(Filter.and((Filter.eq("iiqStatus", "Active")));
  qo.addFilter(Filter.and(Filter.ne("links.application.name", "HR")));
 
 
 
  List userList = new ArrayList();
  Iterator it = context.search(Identity.class, qo);
  
  while(it.hasNext()){
    Identity id = (Identity) it.next();
	userList.add(id.getAttribute("staffId"));
	}
	return userList;
2

Hi Rita,

See sample below on how you can combine your filter conditions and then add to QueryOptions.

QueryOptions qo1 = new QueryOptions(); 
Filter f1 = Filter.notnull("schedule"); 
Filter f2 = Filter.or(Filter.eq("completionStatus","failed"),Filter.eq("completionStatus","Error")); 
qo1.addFilter(Filter.and(f2,f1));

Thanks,
Pallavi

3

Hello @pallavi
Thank you for your response. Where I am struggling is finding the identities that do not have “HR” Application . I am using this filter statement "Filter.ne(“links.application.name”, “HR”)
but it does not filters out the identities without "HR " application account.
Could you provide me any idea that can filter out the identities with out “HR” account.

This is what I built based on your sample.

QueryOptions qo1 = new QueryOptions();

  Filter f1 = Filter.and(Filter.eq("links.application.name", "Active Directory"), Filter.eq("links.disabledAccount", "false")));
  Filter f2 = Filter.and(Filter.eq("orgStatus", "Hired"), Filter.eq("iiqStatus", "Active")));
  Filter f3 =Filter.ne("links.application.name", "HR")
  qo1.addFilter(Filter.and(f1,f2,f3);
4

Hi @Ritabhatta005,

Use the filters below. If the AD account is disabled, you’ll receive the value for the disabled account attribute. If the AD account is active, you won’t see the disabled account attribute value. So, i used, Filter.isnull(“links.disabledAccount”) condition.

 QueryOptions qo = new QueryOptions();
  qo.addFilter(Filter.and(Filter.eq("links.application.name", "Active Directory"), Filter.isnull("links.disabledAccount")));
  qo.addFilter(Filter.and(Filter.eq("iiqStatus", "Active"),Filter.eq("orgStatus", "Hired")));
  qo.addFilter(Filter.ne("links.application.name", "HR"));
6

Hello @Arun-Kumar
Thank you for your detailed response.
This line of filter [qo.addFilter(Filter.ne(“links.application.name”, “HR”));] still returns identity with HR application.
Is there other way of doing it?

Thank you

7

Hi @Ritabhatta005,

First try with this filter and check if it is return the expected data.

 QueryOptions qo = new QueryOptions();
  qo.addFilter(Filter.ne("links.application.name", "HR"));
  qo.addFilter(Filter.eq("links.application.name", "Active Directory"));
1 Like
8

@Ritabhatta005 -

Here’s how you can adjust your code to achieve the desired result:

  1. Retrieve identities matching the initial criteria.
  2. Filter out identities that have an HR link in your code logic.
QueryOptions qo = new QueryOptions();

// Filter for identities that have an Active Directory account that is not disabled
Filter adLinkFilter = Filter.and(
    Filter.eq("links.application.name", "Active Directory"),
    Filter.eq("links.disabledAccount", false) // Use boolean false instead of the string "false"
);

// Filters for orgStatus and iiqStatus
Filter orgStatusFilter = Filter.eq("orgStatus", "Hired");
Filter iiqStatusFilter = Filter.eq("iiqStatus", "Active");

// Combine all filters using Filter.and
Filter overallFilter = Filter.and(
    adLinkFilter,
    orgStatusFilter,
    iiqStatusFilter
);

// Add the overall filter to QueryOptions
qo.addFilter(overallFilter);

List<String> userList = new ArrayList<>();
Iterator it = context.search(Identity.class, qo);

while(it.hasNext()){
    Identity id = (Identity) it.next();

    // Check if the identity has an HR link
    boolean hasHRLink = false;
    List<Link> links = id.getLinks();
    if (links != null) {
        for (Link link : links) {
            if ("HR".equals(link.getApplicationName())) {
                hasHRLink = true;
                break;
            }
        }
    }

    // Add to the list only if the identity does NOT have an HR link
    if (!hasHRLink) {
        userList.add((String) id.getAttribute("staffId"));
    }
}
return userList;

Explanation:

  • Initial Filtering:
    • We first filter identities based on:
      • Having an Active Directory account that is not disabled.
      • orgStatus equal to "Hired".
      • iiqStatus equal to "Active".
  • Checking for HR Link in Code:
    • After retrieving the identities that match the initial criteria, we iterate through their links to check if any link is associated with the HR application.
    • If an identity does not have an HR link, we add their staffId to the userList.

Hope this helps.

9

Hello @officialamitguptaa
Thank you very much for this. It worked but I had to change the boolean false to string “false” Filter.eq(“links.disabledAccount”, “false”). Otherwise throwing error.

1 Like
10

@Arun-Kumar this filter doesn’t seem to filter out the non HR account. @officialamitguptaa filter was able to solve the issue. Thank you

11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.