Need to Hold the Existing record using Transform

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi,

We have attribute sync enabled on account attribute : SUPERVSIOR_ID.

Now the problem is when the Manager is null in SailPoint, it updates null in the target. Instead of setting null, we need to have the old value itself.

we have written the below transform for this. But the problem is when the account correlation happens it immediately triggers the attribute sync and sets as Null. I think this could be because the attribute sync happens before the Identity attribute refresh during correlation.

Is there a better option to fix this so that identity attribute gets populated instead of making it as null.


       "name": "Oracle EBS Supervisor Person ID",
       "type": "firstValid",
       "attributes": {
           "values": [
               {
                   "attributes": {
                       "name": "Cloud Services Deployment Utility",
                       "operation": "getReferenceIdentityAttribute",
                       "uid": "manager",
                       "attributeName": "ebsPersonId"
                   },
                   "type": "rule"
               },
               {
                   "type": "static",
                   "attributes": {
                       "value": "$identity.getLinksByAppIdOrName(null,\"Oracle EBS Employee Source - New [source]\")[0].getAttribute('SUPERVISOR_ID')"
                   }
               }
           ]
       },
       "internal": false
   }```
2

you’ll likely want to use a firstValid transform for this. the first value would be the authoritative source account attribute, the second value would be the downstream source account attribute. this way, if the authoritative source gives you a null value, it’ll keep whatever the downstream source already has.

(you’ll also want a third value that’s just a straight null, just in case.)

3

@sup3rmark

Thanks for your reply.

I’m using the FirstValid Transform, for any correlated accounts when there is a change in manager to null, then this transform works fine holding the previous value we have in target.

But when we correlate a new account to an identity whose manager is null, then the manager update goes as null to the target, instead of holding the previous value from target. I think This is because the attribute sync gets triggered before we have the identity attribute update.

4

As per the transform logic if the account is uncorrelated, then the identity attribute either will be manager’s “ebsPersonId” or “null”. So now the value is null which is getting updated in target as well via sync which is correct.

Now, does the value of identity attribute changes to “ABC” from “null” after getting correlated? If yes, then the “ABC” value will be synced to the account in next sync.

5

i think the only way to address this is to create a rule to override the update and not send the update through if the value is null.

1 Like