Population: Fetch Identities with specific application disabled

[drosenbauer (Devin Rosenbauer)]

Yes! I knew it!

I posted here several months ago about how the CollectionCondition Filters aren’t working properly in recent versions of IIQ, and this is exactly the behavior I was seeing. This is actually the specific documented example on the Compass “Filters and Filter Strings” article, and it does indeed not work.

Filter collectionCondition appears to be broken?

Is anybody else seeing some odd behavior with Filter.collectionCondition? Specifically, it doesn’t seem to be joining only once on the table, but rather many times. This is the example query from the Filters and Filter Strings documentation page on Compass: links.collectionCondition("application.name == \"AD\" && privileged == \"true\"") With HQL debugging on, this renders as follows: select identityAlias.id, identityAlias.name from sailpoint.object.Identity identityAlias inner join i…

The good news is that it’s easy with Links, and @Jarin_James has the correct answer: use a join. This only works because there’s no intermediate join table between Identity and Link (ala spt_identity_assigned_roles), so you can join from Link to Identity directly.