Multiple Attributes in returnMap for correlation rules?

[JRDensmore (John-Robert Densmore)]

Looking for some assistance with a correlation rule the team is working on.

We have a need to correlate if three attributes match on an account to an existing identity, and not just one. Is this possible? The documentations wording read that way to us, but the example of how maps are used by the correlation rule is strange to us since instead of pairing the attribute name to the attribute value, its pairing name to name and value to value.

Can we just do the put six times, or does that overwrite the previous?

Example,
We have attribute1 and attribute2. We need both attributes to match for an account to be correlated since either one could match multiple existing, but the combination of both will only match one specific identity.

Can we do something like

returnMap.put( "identityAttributeName", "attribute1Name");
returnMap.put( "identityAttributeValue", attribute1Value);
returnMap.put( "identityAttributeName", "attribute2Name");
returnMap.put( "identityAttributeValue", attribute2Value);

Or would attribute2 just overwrite attribute 1?

Thank you

[adunker (Alex Dunker)]

You are correct, that will overwrite what is in the map. Your best bet for evaluating multiple attributes in an “AND” type model would to be use the IDNRuleUtil to search for the identity based on the attributes you are looking for and then return it specifically in the map.

These attributes will need to be searchable to use findIdentitiesBySearchableIdentityAttribute().

Correlation Rule | SailPoint Developer Community

and

Using IDNRuleUtil as a Wrapper for Common Rule Operations - Compass (sailpoint.com)

Depending on how large your aggregations are and how performant you need this to be you may have to modify some parts of the approach or architecture.