Need Help with setting the correct Identity Profile

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , ,
1

I have a use case where a user goes inactive in one HR source and active in another one. When this happens the HR source where they are inactive remains as the Identity Profile that is being applied to the account even though the data from the HR source no longer applies to the user.

What is the best way to force the Identity Profile to update when the one HR source account goes inactive? This is causing a lot of issues in down stream systems that the support teams use to communicate with the user and the manager of the user.

We already have the proper priority set for the HR sources. But due to the massive difference in the data between the 2 HR sources the needed data is not updating properly for these users. And we would like IdN to accurate reflect which HR source is being set as Primary.

Any ideas how I can address this use?

2

Hi @mpotti

I think you can do it with a transform that fills the lifecycle state attribute with ‘inactive’ string in the desired identity profile (or both). For example, transform should get the inactive state from HR1 in the HR2 identity profile, so when aggregating or at identity refresh, both identities in both identity profiles are syncrhonized regarding the status attribute.

3

To make sure I follow here is the transforms that are being used to calculate LCS. Also I want to call out that I did not write these transforms and I know I would need to update them. I am not 100% sure where I would start to look at setting the correct identity profile.

{
    "id": "b183bb61-3294-4dc7-9ec4-c0d5cd4f0525",
    "name": "WD - DateCompare - Determine Preterm LCS",
    "type": "dateCompare",
    "attributes": {
        "firstDate": {
            "type": "dateFormat",
            "attributes": {
                "input": {
                    "attributes": {
                        "input": {
                            "attributes": {
                                "expression": "+1d/h",
                                "roundUp": true,
                                "input": {
                                    "attributes": {
                                        "input": {
                                            "attributes": {
                                                "values": [
                                                    {
                                                        "attributes": {
                                                            "attributeName": "Term Date__c",
                                                            "sourceName": "Workday Production Sandbox"
                                                        },
                                                        "type": "accountAttribute"
                                                    },
                                                    {
                                                        "attributes": {
                                                            "attributeName": "Term Date__c",
                                                            "sourceName": "Workday Test Data"
                                                        },
                                                        "type": "accountAttribute"
                                                    },
                                                    "2999-12-13"
                                                ]
                                            },
                                            "type": "firstValid"
                                        },
                                        "inputFormat": "yyyy-MM-dd",
                                        "outputFormat": "ISO8601"
                                    },
                                    "type": "dateFormat"
                                }
                            },
                            "type": "dateMath"
                        },
                        "begin": 0,
                        "end": 10
                    },
                    "type": "substring"
                },
                "inputFormat": "yyyy-MM-dd",
                "outputFormat": "ISO8601"
            }
        },
        "secondDate": {
            "type": "dateMath",
            "attributes": {
                "expression": "now-6h/s",
                "roundUp": false
            }
        },
        "operator": "gt",
        "positiveCondition": "active",
        "negativeCondition": "preterm"
    },
    "internal": false
}

{
    "id": "1e7d0400-088a-4c66-bfdd-497d0cdee284",
    "name": "WD - DateCompare - HireDate to TermDate",
    "type": "dateCompare",
    "attributes": {
        "firstDate": {
            "attributes": {
                "input": {
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "sourceName": "Workday Production Sandbox",
                                    "attributeName": "Hire Date__c"
                                },
                                "type": "accountAttribute"
                            },
                            "2021-08-06"
                        ]
                    },
                    "type": "firstValid"
                },
                "inputFormat": "yyyy-MM-dd",
                "outputFormat": "ISO8601"
            },
            "type": "dateFormat"
        },
        "secondDate": {
            "attributes": {
                "input": {
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "sourceName": "Workday Production Sandbox",
                                    "attributeName": "Term Date__c"
                                },
                                "type": "accountAttribute"
                            },
                            "1900-08-07"
                        ]
                    },
                    "type": "firstValid"
                },
                "inputFormat": "yyyy-MM-dd",
                "outputFormat": "ISO8601"
            },
            "type": "dateFormat"
        },
        "operator": "GTE",
        "positiveCondition": "active",
        "negativeCondition": "terminate"
    },
    "internal": false
}

{
    "id": "cb98b844-5016-4a7a-a1a1-b559dccb41bd",
    "name": "WD - DateCompare - Pre Term and Inactive for LCS",
    "type": "dateCompare",
    "attributes": {
        "firstDate": {
            "type": "dateFormat",
            "attributes": {
                "input": {
                    "attributes": {
                        "input": {
                            "attributes": {
                                "expression": "+3d/d",
                                "roundUp": false,
                                "input": {
                                    "attributes": {
                                        "input": {
                                            "attributes": {
                                                "values": [
                                                    {
                                                        "attributes": {
                                                            "attributeName": "Term Date__c",
                                                            "sourceName": "Workday Production Sandbox"
                                                        },
                                                        "type": "accountAttribute"
                                                    },
                                                    "2999-12-31"
                                                ]
                                            },
                                            "type": "firstValid"
                                        },
                                        "inputFormat": "yyyy-MM-dd",
                                        "outputFormat": "ISO8601"
                                    },
                                    "type": "dateFormat"
                                }
                            },
                            "type": "dateMath"
                        },
                        "begin": 0,
                        "end": 10
                    },
                    "type": "substring"
                },
                "inputFormat": "yyyy-MM-dd",
                "outputFormat": "ISO8601"
            }
        },
        "secondDate": {
            "attributes": {
                "input": {
                    "attributes": {
                        "expression": "now/d",
                        "roundUp": false
                    },
                    "type": "dateMath"
                },
                "inputFormat": "yyyy-MM-dd'T'hh:mmX",
                "outputFormat": "ISO8601"
            },
            "type": "dateFormat"
        },
        "operator": "gte",
        "positiveCondition": {
            "attributes": {
                "id": "Transform - DateCompare - Determine Preterm LCS"
            },
            "type": "reference"
        },
        "negativeCondition": "inactive"
    },
    "internal": false
}

{
    "id": "1b91077f-863f-4a6f-9520-c399f38c6845",
    "name": "WDSZ - Dual Source - cloudLifecycleState",
    "type": "static",
    "attributes": {
        "workdayLifecycle": {
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "id": "WD - Static - Lifecycle State"
                        },
                        "type": "reference"
                    },
                    "null"
                ]
            },
            "type": "firstValid"
        },
        "seczettaLifecycle": {
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "id": "secZettaLifeCycleState"
                        },
                        "type": "reference"
                    },
                    "null"
                ]
            },
            "type": "firstValid"
        },
        "value": "#if($seczettaLifecycle=='no SecZetta account correlated')$workdayLifecycle#elseif(($workdayLifecycle=='inactive' || $workdayLifecycle=='preterm') && $seczettaLifecycle!='inactive')$seczettaLifecycle#{else}$workdayLifecycle#end"
    },
    "internal": false
}
4

Hi @mpotti

If I understood your use case correctly,

  • HR1 has higher priority than HR2 identity profile.

  • User is in both HR sources.

  • When a user becomes inactive in HR1, it should take data from HR2 as HR1 is no longer applicable for the user. Is this correct ?

Thanks
Krish

5

Yeah that is the exact use case.

6

1. Identity Profile Priority

When you have multiple Identity Profiles, if user has account in more than 1 HR sources associated with identity profiles then Identity will be created from HR source whose identity profile has higher priority (lowest in the number).

You cannot switch to a different HR source just like that if user goes inactive in HR source. It will still read data from that source only though user is inactive.

You need to depend on Transforms to choose which source for identity attribute calculation.

However there is a way,

  • If you apply filter string to your HR source and enable account deletion. It will not aggregate inactive accounts. Then HR1 account will be deleted.

  • As per priority, user’s identity profile switch to HR2 source automatically.

  • However user Account ID will not be changed

There is a downside with deletion, if user is not active in any HR Source then identity gets deleted, accounts become uncorrelated and will never gets disabled. We should not be in this situation.

2. Transforms

If you cannot delete HR source account,

Then you need to add firstValid Transform with values as account attribute transform using account property filter. For example

{
    "name": "FirstName FirstValid Transform"
    "type": "firstValid",
    "attributes": {
        "values": [
            {
                "attributes": {
                    "attributeName": "firstName",
                    "sourceName": "HR Source1",
                    "accountPropertyFilter": "(status == \"active\")"
                },
                "type": "accountAttribute"
            },
            {
                "attributes": {
                    "attributeName": "firstName",
                    "sourceName": "HR Source2",
                    "accountPropertyFilter": "(status == \"active\")"
                },
                "type": "accountAttribute"
            }
        ]
    }
}

Let me know if you need me to look into your Transforms and see what it is doing exactly.

Thanks
Krish

7

If I am understanding correctly in order to have these values set correctly I would need to update all the transforms to take in account if the HR1 is active or not and if not then point to HR2?

8

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.