Passing values into Field Value rules

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

Version 8.X

Share all details related to your problem, including any error messages you may have received.

I am seeing a behavior and wonder if anyone else is seeing this. I have been writing Active Directory connection Application objects for years and I have a very strict method for doing the provisioning policies, I reference it here:

I do not like the provisioning policy to be buried in the Application object, I prefer it to be a Form object. I also much prefer to use Field Value rules for the attributes.

On occasion for something very simple I might decide that instead of a Field Value rule, I will use a scriptlet.

So in the PP you will instead of seeing:

<Field displayName="First Name" name="givenName" type="string">
  <RuleRef>
    <Reference class="sailpoint.object.Rule" name="XYZ Field Value Active Directory First Name"/>
  </RuleRef>
</Field>

you would see:

<Field displayName="First Name" name="givenName" type="string">
  <Script>
    <Source>
      return identity.getFirstname();
    </Source>
  </Script>
</Field>

Normally anything that is computed in the Form is made part of the Beanshell Context, so if I compute givenName, I should have that value available for any Field Value rules that are after the givenName field. But I am seeing sometimes these values are not in the Beanshell Context.

My questions:

  • Do you take advantage of this feature?
  • Do you ever see the values not showing in the context?
  • Do you think this might be because I am using a scriptlet instead of a Rule?
2

I’ve done both approaches, but I don’t recall if I’ve tried using a dependent field value in another field when using the separate Form object approach.

Do you have dependencies="givenName" set on the field that would need to use givenName? This will ensure givenName is calculated first before the other field relying on it.

3

I have seen that dependencies attribute at one other client. That’s not a bad thought. Normally the rules are applied in the order they are specified in the form, but that might be a way to ensure the data are there.