# ManagerCorrelation Rule Not Falling Back to Secondary Source

**URL:** <https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524>\
**Category:** SHF Discussion and Questions\
**Tags:** sailpoint-identity-security\
**Created:** [December 1, 2025, 7:53am UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524 "2025-12-01T07:53:14Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [December 1, 2025, 7:53am UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/1 "2025-12-01T07:53:14Z")

</div>

I am implementing a ManagerCorrelation rule in SailPoint ISC to correlate maanger from 2 different source systems.

1. Read maanger employeeID from HR source (Current Manager)
2. If HR deosnot contains the value, read the manager from Secondary Source (Onboarding - Manager ID)
3. REturn the correct manager ID for identity correlation.

The HR part works correctly, but when HR doesn’t have data, the rule doesn’t fall back to Secondary Source.

**Below is the Rule:**

```auto
import sailpoint.object.Identity;
import sailpoint.object.Link;

Map returnMap = new HashMap();

// HR Attribute
String hrMgrAttr = "Current Manager";

// Cornerstone Attribute
String ssMgrAttr = "Onboarding - Manager ID";

// Values
String hrMgr = link.getAttribute(hrMgrAttr);
log.debug("HR Manager ID extracted: " + hrMgr);
String ssMgr = null;

// Extract manager ID from secondary source
Identity id = link.getIdentity();
for (Link l : id.getLinks()) {
    if (l.getApplicationName() != null &&
        "Secondary-Source".equalsIgnoreCase(l.getApplicationName())) {
        ssMgr = l.getAttribute(ssMgrAttr);
    }
}

// Final managerId
String finalMgrId = null;

if (hrMgr != null && hrMgr.trim().length() > 0) {
    finalMgrId = hrMgr;
} else if (ssMgr != null && ssMgr.trim().length() > 0) {
    finalMgrId = ssMgr;
}

if (finalMgrId == null) {
    return null;
}

returnMap.put("identityAttributeName", "uid");
returnMap.put("identityAttributeValue", finalMgrId);
return returnMap;

```

I have attached the manager correlation rule only to HR source and executing HR aggregations and observed below behaviors.

**Observed Behavior:**

HR value exists & Secondary Source value exists → manager mapped successfully using HR data in user’s identity profile.

HR value exists & Secondary Source value doesn’t exists → manager mapped successfully using HR data in user’s identity profile.

HR value doesn’t exists (= null) & Secondary Source value exists - \> no manager mapping in user’s identity profile.

Any guidance or recommended patterns for correlating manager from multiple sources would be appreciated.

---

<div class="post-metadata">

**Author:** ![schattopadhy](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/schattopadhy/32/8854_2.png) [@schattopadhy](https://developer.sailpoint.com/discuss/u/schattopadhy)\
**Post date:** [December 1, 2025, 11:04am UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/2 "2025-12-01T11:04:28Z")

</div>

> [@thiruppathit](#):
>
> ot contains the value, read the manager from Secondary Source (Onb

@thiruppathit

you can try the below code it check the correlation from multiple sources

```auto

import sailpoint.object.Link;
import sailpoint.object.QueryOptions;
import sailpoint.object.Filter;
import sailpoint.object.Identity;
import java.util.Map;
import java.util.HashMap;
  
  
log.error("Rule Name: HR Manager Correlation Rule - Message = Creating list of applications");
//Creating a list of all the HR applications to search for.
List applications = new ArrayList();
applications.add("HR - ONE");
applications.add("HR - TWO");

/**
	Gets the manager identity link from HR system. "Reporting Officer ID" attribute of the subordinate HR record will be matched against "Employee Number" / account name record of the manager HR record.
	
	@param employeeNumber employeeNumber of the manager.
	@return manager identity if available.Else null value will be returned.
*/
Identity getManagerIdentity(String employeeNumber){
	log.error("Entering the method - getManagerIdentity - employeeNumber = "+ employeeNumber );
	//QueryOptions and filters are built for querying the account in HR sources.
	QueryOptions qo = new QueryOptions();
	qo.addFilter(Filter.eq("nativeIdentity", employeeNumber));
	qo.addFilter(Filter.in("application.cloudDisplayName", applications));
	//Getting links based on the filters built. This should match with only 1 account as per the customer data / design.
	List links = context.getObjects(Link.class, qo);
	//No links found or duplicates found.
	if( links.size() != 1 ){
		//Manager can't be set in this case. Hence, return null.
		log.error("Exiting the method - getManagerIdentity - identity = " + links.size());
		return null;
	}
	else{
		//returns identity of matching HR record.
		Identity identity = links.get(0).getIdentity();
		log.error("Exiting the method - getManagerIdentity - identity = " + identity.getName());
		return identity;
	}
	// safety null return 
    log.error("Exiting the method - getManagerIdentity - identity = null");
	return null;
}

  
//Find reporting ID number based on RO ID.
String managerEmployeeNumber = null;
if( link != null)
{	
	managerEmployeeNumber = link.getAttribute( "Reporting Officer ID" );
  log.error("Rule Name: HR Manager Correlation Rule - Message = Link not null and RO ID is " + managerEmployeeNumber);
}
else{
	log.error("Rule Name: HR Manager Correlation Rule - Message = Link is null");  
}

//Creating an empty return map
Map returnMap = new HashMap();

//No manager correlation if there is no manager employee number found.
if(managerEmployeeNumber == null)
{
	return returnMap;
}
else{ // Retrieve manager identity based on the manager employee number.
	Identity managerIdentity = getManagerIdentity(managerEmployeeNumber);
  
	if(managerIdentity == null){
		log.error("Rule Name: HR Manager Correlation Rule - Message = Manager Identity is null");  
		return returnMap;// No manager correlation manager is not found.
	}
	else{ //Correlation based on uid attribute (SailPoint user name attribute from Identity profile) in case manager identity is found.
		log.error("Rule Name: HR Manager Correlation Rule - Message = Manager Identity = " + managerIdentity.getName());
		String uid = managerIdentity.getStringAttribute("uid");
    
		returnMap.put("identityAttributeName", "uid");
		returnMap.put("identityAttributeValue", uid);
		log.error("Rule Name: HR Manager Correlation Rule - Message = Manager UID = " + uid);
		return returnMap;
	}
}

  return returnMap;

```

---

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [December 1, 2025, 12:25pm UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/3 "2025-12-01T12:25:12Z")

</div>

Thanks @schattopadhy for sharing the sample rule.

Getting rule validation failure when try with the shared code. Rule validator throws errors stating ‘getObjects’ are not allowed. please refer the below screeshot.

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/1/e/1e28ff5936ad6006e77de5ed836b35256683b9e7.png)

How did you manage to get this deployed into your tenant?

---

<div class="post-metadata">

**Author:** ![iamnithesh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iamnithesh/32/42445_2.png) [@iamnithesh](https://developer.sailpoint.com/discuss/u/iamnithesh)\
**Post date:** [December 1, 2025, 12:36pm UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/4 "2025-12-01T12:36:11Z")

</div>

> [@thiruppathit](#):
>
> `"Secondary-Source".equalsIgnoreCase(l.getApplicationName())) {`

try with `“Secondary-Source [source]”` here

---

<div class="post-metadata">

**Author:** ![schattopadhy](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/schattopadhy/32/8854_2.png) [@schattopadhy](https://developer.sailpoint.com/discuss/u/schattopadhy)\
**Post date:** [December 1, 2025, 12:51pm UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/5 "2025-12-01T12:51:16Z")

</div>

> [@thiruppathit](#):
>
> lsIgnoreCase(l.getApplicationN

@thiruppathit this rule is running but might be some classes might not be used any more.you check once with sailpoint

---

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [December 1, 2025, 1:15pm UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/6 "2025-12-01T13:15:41Z")

</div>

Sure will check and let you know. Is there any specific reason you recommend to add [source] with the source name to compare?

---

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [December 1, 2025, 1:16pm UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/7 "2025-12-01T13:16:53Z")

</div>

sure. Thanks @schattopadhy

---

<div class="post-metadata">

**Author:** ![iamnithesh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iamnithesh/32/42445_2.png) [@iamnithesh](https://developer.sailpoint.com/discuss/u/iamnithesh)\
**Post date:** [December 1, 2025, 3:09pm UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/8 "2025-12-01T15:09:21Z")

</div>

This is the format to be used in Cloud rules when you are referring to a source by it’s name

---

<div class="post-metadata">

**Author:** ![iamnithesh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iamnithesh/32/42445_2.png) [@iamnithesh](https://developer.sailpoint.com/discuss/u/iamnithesh)\
**Post date:** [December 1, 2025, 3:10pm UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/9 "2025-12-01T15:10:14Z")

</div>

SailPoint does not allow context object to be used in cloud rules anymore

---

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [December 1, 2025, 4:51pm UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/10 "2025-12-01T16:51:12Z")

</div>

@colin_mckibben do you have any suggestions?

---

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [December 2, 2025, 1:30am UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/11 "2025-12-02T01:30:47Z")

</div>

I tried with the suggested format , but no luck.

---

<div class="post-metadata">

**Author:** ![lampard08](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/lampard08/32/32646_2.png) [@lampard08](https://developer.sailpoint.com/discuss/u/lampard08)\
**Post date:** [December 2, 2025, 2:41am UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/12 "2025-12-02T02:41:46Z")

</div>

if you can have an identity attribute, you can map it in you correlation directly with below transform :

“name”: “ManagerFromMultiSources”,  
“type”: “static”,  
“attributes”: {  
“value”: “#set($primaryLinks = $identity.getLinksByAppIdOrName(‘123456789123456789’, null)) #foreach($pl in $primaryLinks) #if($pl.getAttribute(‘mgrID’)) $pl.getAttribute(‘mgrID’)#if($foreach.hasNext), #end#else#set($secondaryLinks = $identity.getLinksByAppIdOrName(‘987654321123456789’, null)) #foreach($sl in $secondaryLinks) #if($sl.getAttribute(‘ssMgrID’) ) $sl.getAttribute(‘ssMgrID’)#if($foreach.hasNext), #end#end#end#end #end”  
},  
“internal”: false  
}

---

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [December 2, 2025, 5:30pm UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/13 "2025-12-02T17:30:03Z")

</div>

Hi @lampard08,

Thank you so much for your response. I tried with the shared transform but it always set manager correlation only from HR source. If manager details doesn’t exists in HR , it doesn’t fall back to Secondary Source. Below is my sample Transform, Could you please correct me what exactly the problem is with my transform,

```auto
{
  "name": "ManagerFromMultiSources",
  "type": "static",
  "attributes": {
    "value": "#if( $identity.getLinksByAppIdOrName('01be94060209437xxxxxxx', null)[0].getAttribute('Current Manager') != '') $identity.getLinksByAppIdOrName('01be940602094371bbcxxxxxxxx', null)[0].getAttribute('Current Manager') #elseif( $identity.getLinksByAppIdOrName('6d1fd0d00bce4298851f216a60b06c8a', null)[0].getAttribute('Onboarding - Onboarding User Future Manager ID') != '') $identity.getLinksByAppIdOrName('6d1fd0d00bce4298851f216a60b06c8a', null)[0].getAttribute('Onboarding - Onboarding User Future Manager ID') #elseif #set( $result = '' ) $result #end"
  },
  "internal": false
}

```

btw , I have attached this transform to maanger (Manager Name) attribute.

manager attribtue has below reference,

HR System (source) → Current Manager (Attribute) → Transform (ManagerFromMultiSources)

Note: Also i noticed if i use firstValid , it fetches the maangerID properly but the manager correlation doesn’t occurs.

Sample Transform with firstValid:

```auto
{
        "id": "a7ad9018-3864-4a95-8843-c3cc6cd941bd",
        "name": "ManagerFromMultiSources30",
        "type": "firstValid",
        "attributes": {
            "values": [
                {
                    "type": "static",
                    "attributes": {
                        "value": "#set($primaryLinks = $identity.getLinksByAppIdOrName('01be940602094371bbcb4a33816ba19f', null)) #foreach($pl in $primaryLinks) #if($pl && $pl.getAttribute('Current Manager')) $pl.getAttribute('Current Manager') #end #end"
                    }
                },
                {
                    "type": "static",
                    "attributes": {
                        "value": "#set($secondaryLinks = $identity.getLinksByAppIdOrName('6d1fd0d00bce4298851f216a60b06c8a', null)) #foreach($sl in $secondaryLinks) #if($sl && $sl.getAttribute('Onboarding - Onboarding User Future Manager ID')) $sl.getAttribute('Onboarding - Onboarding User Future Manager ID') #end #end"
                    }
                },
                null
            ],
            "ignoreErrors": true
        },
        "internal": false
    }

```

I just come across this KB article from SP stating we can’t use Transform to correlate manager from multiple source accounts. Reference : [Support Articles - Transform does not pull correct manager with multiple authoritative source accounts - Customer Support](https://support.sailpoint.com/csm/en/transform-does-not-pull-correct-manager-with-multiple-authoritative-source?id=kb_article&sys_id=cb7f6d802bc66e543b36ff9dee91bff0)

Is it working in your Tenant?

---

<div class="post-metadata">

**Author:** ![lampard08](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/lampard08/32/32646_2.png) [@lampard08](https://developer.sailpoint.com/discuss/u/lampard08)\
**Post date:** [December 2, 2025, 6:41pm UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/14 "2025-12-02T18:41:41Z")

</div>

try this and let me know ….

{  
“name”: “ManagerFromMultiSources”,  
“type”: “static”,  
“attributes”: {  
“value”: “#if( $identity.getLinksByAppIdOrName(‘01be94060209437xxxxxxx’, null)[0].getAttribute(‘Current Manager’) && !$identity.getLinksByAppIdOrName(‘01be94060209437xxxxxxx’, null)[0].getAttribute(‘Current Manager’).empty ) $identity.getLinksByAppIdOrName(‘01be940602094371bbcxxxxxxxx’, null)[0].getAttribute(‘Current Manager’) #elseif( $identity.getLinksByAppIdOrName(‘6d1fd0d00bce4298851f216a60b06c8a’, null)[0].getAttribute(‘Onboarding - Onboarding User Future Manager ID’)) $identity.getLinksByAppIdOrName(‘6d1fd0d00bce4298851f216a60b06c8a’, null)[0].getAttribute(‘Onboarding - Onboarding User Future Manager ID’) #elseif #set( $result = ‘’ ) $result #end”  
},  
“internal”: false  
}

---

<div class="post-metadata">

**Author:** ![lampard08](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/lampard08/32/32646_2.png) [@lampard08](https://developer.sailpoint.com/discuss/u/lampard08)\
**Post date:** [December 2, 2025, 11:35pm UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/15 "2025-12-02T23:35:12Z")

</div>

you are right. I tried this in my tenant. while i was able to get the data from both sources, the manager name was not updated. Let me see why your rule is not working.

---

<div class="post-metadata">

**Author:** ![lampard08](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/lampard08/32/32646_2.png) [@lampard08](https://developer.sailpoint.com/discuss/u/lampard08)\
**Post date:** [December 3, 2025, 12:03am UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/16 "2025-12-03T00:03:12Z")

</div>

here is one issue i found.

in this piece:

`for (Link l : id.getLinks()) {`  
`if (l.getApplicationName() != null &&`  
`“Secondary-Source”.equalsIgnoreCase(l.getApplicationName())) {`  
`ssMgr = l.getAttribute(ssMgrAttr);`  
`}`  
`}`

id.getLinks() will return a list of links but you are assigning it to single link object which will fail and are never going to get the send source data.

try below :

```auto
Identity id = link.getIdentity();
List<Link> links = id.getLinksByAppIdOrName('12345678900987654321', null);
if (links != null && !links.isEmpty()){
for (Link l : links) {
    
        ssMgr = l.getAttribute(ssMgrAttr);
}

```

---

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [December 4, 2025, 12:49am UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/17 "2025-12-04T00:49:50Z")

</div>

Thanks a lot Chelsea. This rule is working fine.

Rule along with the Transform is the way to achieve the manager correlation from multiple source systems.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [February 2, 2026, 12:50am UTC](https://developer.sailpoint.com/discuss/t/managercorrelation-rule-not-falling-back-to-secondary-source/189524/18 "2026-02-02T00:50:25Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.