NERM Assignment aggregation issue

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hey Team,

We have the NERM module configurated with Quickstart setup and using person+assignment profile synced to ISC for identity cube creation.

(1 person+1→’* assignment(s) == Identity Cube)

We are using the out of the box source+identity profiles that are created automatically when we sync from NERM.

We are currently testing a lot of the functionality in before release later in spring and have realised assignments are not really working as intented in ISC. A person can have multiple assignments, either multiple old inactive ones or multiple active at the same time for different organizations. This has not been an issue before, now hower:

  • The identity cube is only readiing from the “first” assignment. Identity attributes are not changed when the new assignment should be in place and the old one is disabled.

    Example:

    image
    image1678×519 22.4 KB

    Karl Testare has 2 assignments, one is disabled and the new one has startDate: 01-15.

    Identity is still synced with the “old” assignment:

    image
    image823×367 12.5 KB

    Another issue:

  • When an additional assignment is created for a person, it does not aggregate instantly into ISC. It can take several hours before the new assignment shows on the identiy cube in ISC - why is this? All other changes are always synced instantly.

Example:
Darrth Vader has 2 assignments in NERM:

image
image1681×552 32.9 KB

Only 1 of the assignments(the old, inactive one) is aggregated to ISC:

image
image938×551 11.5 KB

Thankful for information regarding these 2 cases as they are crucial for our release.

Best regards,
Seb

3

Identity profile mapping for the attributes unfortunately just grabs the first account from the source with a value which makes the multiple assignments a little more of a challenge.

Transforms doin’t support multiple accounts so you are left with cloud identity attribute rules to contain logic for which account on the source you want to use for each attribute in the identity profile.

Another route, for now, is to build the logic on the nerm side and setup new attributes on the person profile that contain which assignment attributes you want for the identity profile – like isc_start_date, isc_end_date, isc_organization, etc – you’ll need to build that into workflows in nerm related to creating/updating profiles so they stay up to date.

1 Like
4

Hello Derek,

Thanks I have actually begun redesigning our NERM tenant to what you are saying.

Solution is to create person and assignment profile simultaneously as well as sync all assignment attributes to the person profile - hence only needing the 1 profile sync to ISC. I have not yet configured this entirely yet as I’m having issues with the person→assignment correlation now that person profile is no longer created before the assignment form, but am working on this. Happily accepting some help there if you have an idea on how to create the correlation.

Seb