Merge multi valued attribute using delimiter

antra_saxena · January 31, 2025, 1:36am

Hi All,

I have a source with a multi valued attribute and I want to map that attribute to an identity attribute and create a single value separated with a delimiter.
For example, if the values on the account are Dep1 and Dep2, I want to create the corresponding identity attribute as |Dep1|Dep2|.

I have tried using rule transform and identity attribute rule both, but I am not getting the required output. In both the cases, the output is |Dep1|. Which means only one value is being picked up by the rule.

I have attached the identity attribute rule. Could you please help me validate if the logic in the rule is correct? Or if there is another way to implement this requirement?

Rule - IdentityAttribute - MergeHRDepartmentID.xml (1.4 KB)

Any help is appreciated!

Thank you.

Sandeep2025 · January 31, 2025, 3:39am

Hello Antra,
Can you please check if the identity attribute that you are trying to map is defined as multi= true from API?

Please let me know
Thanks!!
Sandeep

antra_saxena · January 31, 2025, 6:32am

Hi @Sandeep2025,
Thanks for your reply.

I am trying to define the attribute as multi=true but looks like it is not working. The API response is 200 but in the response body it is still showing as false.

Sandeep2025 · January 31, 2025, 9:42pm

Hello Antra,
Can you check and see if users are getting multiple values for the specified account attribute after aggregation from the source?

Thanks!!
Sandeep

mehuljogi · February 1, 2025, 5:21am

Hello @antra_saxena ,

I had also faced the same issue, getting Api response as 200 but multi remains false. I also tried using vscode but that didn’t work either.

-Mehul

mehuljogi · February 1, 2025, 5:30am

Hello @antra_saxena and @Sandeep2025 ,

I found the below post which says that some identity attributes are locked by SailPoint and you can’t change it’s properties like multi or searchable to any other value.

-Mehul

j_place · February 2, 2025, 11:35am

Hi @antra_saxena and @mehuljogi You can’t mark Identity attributes as multi-valued, it is a known constraint within ISC. However, that’s a red herring as you are not requiring a multi-valued Identity attribute - I assume that’s why you are wanting to concatenate in the first place.
As @Sandeep2025 says in the other post, can you confirm HRDepartmentAssignedDepartmentId is multi-valued in the Account schema and has multiple values following an aggregation?

antra_saxena · February 3, 2025, 1:30am

Hi Sandeep,

Yes the attribute is getting multiple values on the source. Please see the red highlighted text for an example.

antra_saxena · February 3, 2025, 1:44am

Hi Jeremy,

Yes your assumption is correct, I am having to concatenate the values only because they are not available as multi valued on identity attribute.
As confirmed above, the attribute is marked as multi valued on account schema and has multiple values after aggregation.

antra_saxena · February 3, 2025, 1:53am

Hi All,

An update on the original question - I am getting the output as “|” and not “|Dep1” as mentioned previously from the identity attribute rule. Apologies for the confusion.

This mostly means the values variable in the rule is null. I suspect something incorrect in the way I am fetching the Link object in the rule?

Appreciate any help to review and validate the rule. Thanks much!

aditprad003 · February 3, 2025, 10:05am

Your code is generating some error and hence it giving output as “|” which you mentioned in catch block .can you run rule validator against your rule , not sure if the methods you are using are available in IDN.

Sushantmr · February 3, 2025, 7:57pm

You can use the transform to retrieve multiple values and concatenate them using ‘|’.

Here is an example:

{
  
   "name":"GetMultiValues",
   "type":"static",
   "attributes":{
      "multiValues":{
         "type":"static",
         "attributes":{
            "value":"#foreach($link in $identity.getLinksByAppIdOrName(\"ID of the Source\",null))#if($foreach.index + 1 != $identity.getLinks().size())$link.getAttribute(\"objectClass\")#else$link.getAttribute(\"objectClass\")#end#end"
         },
         "internal":false
      },
      "value":"$multiValues.replaceAll('[\\[\\]]', '').replaceAll(', ','|')"
   },
   "internal":false
}

I have multiple values in the objectClass attribute in AD, and with this transform, I can get all the values into a single identity attribute.
Account Attribute

Identity Attribute

antra_saxena · February 5, 2025, 1:58am

Hi @Sushantmr,

Thank you for your response - this works like magic!
I can combine multi valued account attributes into single identity attribute now. But facing an issue:

While provisioning this identity attribute downstream by splitting the values based on the delimiter, there is an additional value on the account attribute [object Object]. Please see screenshots below:

Identity attribute:

Account attribute (downstream application):

This is how the provisioning policy looks like for this attribute:

{
“name”: “uaDepartmentNumber”,
“transform”: {
“type”: “identityAttribute”,
“attributes”: {
“name”: “departmentNumber”
}
},
“attributes”: {
“cloudDelimiter”: “|”
},
“isRequired”: false,
“type”: “string”,
“isMultiValued”: true
}

But on the target system, this value doesn’t show up (which means it only shows 2 values which is correct).

Any idea what could be going wrong and why are we seeing this value in SailPoint?

Thank you!

j_place · February 5, 2025, 1:36pm

Hi @antra_saxena - you’ve got multiple ‘|’ characters in your identity attribute - compare your’s to @Sushantmr example. Could you share your Identity attribute transform?

antra_saxena · March 6, 2025, 5:32am

Hi all,

Just to provide an update: Here is the final transform I used. This handles all cases where there are multiple values, one value or no value on the account attribute from which the data is sourced. We needed the value to be like this: |Dep1|Dep2| - i.e., we needed pipes at the start and end as well.

        "id": "fee764ee-dfd-448e-aca2-sdcx",
        "name": "IdAttribute_department",
        "type": "firstValid",
        "attributes": {
            "values": [
                {
                    "attributes": {
                        "calculatedValue": {
                            "attributes": {
                                "values": [
                                    {
                                        "type": "static",
                                        "attributes": {
                                            "multiValues": {
                                                "type": "static",
                                                "attributes": {
                                                    "value": "#foreach($link in $identity.getLinksByAppIdOrName(\"Staging Database\",null))|$link.getAttribute(\"department\")|#end"
                                                }
                                            },
                                            "value": "$multiValues.replaceAll('[\\[\\]]', '').replaceAll(', ','|')"
                                        }
                                    },
                                    "null string"
                                ]
                            },
                            "type": "firstValid"
                        },
                        "null": null,
                        "value": "#if($calculatedValue!='null string')$calculatedValue#{else}$null#end"
                    },
                    "type": "static"
                },
                null
            ]
        },
        "internal": false
    }

Additionally, the pipe at the start is what was causing the [object, object] value in the account attribute when provisioning downstream. To fix this issue, I used a transform on the provisioning policy:

{
            "name": "departmentNumber",
            "transform": {
                "type": "substring",
                "attributes": {
                    "begin": 1,
                    "input": {
                        "attributes": {
                            "name": "departmentNumber"
                        },
                        "type": "identityAttribute"
                    }
                }
            },
            "attributes": {
                "cloudDelimiter": "|"
            },
            "isRequired": false,
            "type": "string",
            "isMultiValued": true
        }

Hope this helps.

system · May 5, 2025, 5:32am

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Transform for multi-valued Account Attributes ISC Discussion and Questions	2	2777	July 19, 2023
Providing a multivalued attribute as input to a rule transform ISC Discussion and Questions transforms , identity-security-cloud	8	252	April 25, 2025
Multivalued attribute sync ISC Discussion and Questions identity-security-cloud	2	845	July 19, 2023
ISC: How to split an account attribute to make it multivalued ISC Discussion and Questions saas-connector , webservice-connector , identity-security-cloud , attributes , accounts , connectors	19	134	August 23, 2025
Filter on multi valued attributes ISC Discussion and Questions	2	1135	July 19, 2023

Merge multi valued attribute using delimiter

Related topics