Reference UI Assigned Identity Attribute in Transforms

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Is there any way to use one transform across multiple identity attributes where the transform grabs whatever the UI input is for Source and Attribute?

For example, I have multiple attributes that need to be changed when a lifecycle changes and the identity still remains active. So, I have the framework of a transform like below that would grab the lifecycle from the lifecycle transform then ideally look at the UI assigned Source/Attribute options, and the final static value would apply either the attribute or none based on the lifecycle.

{
    "name": "Attribute Check",
    "type": "static",
    "attributes": {
        "lifecycle": {
            "type": "reference",
            "attributes": {
                "id": "Workday Lifecycle"
            }
        },
        "attribute": {
            // check the source attribute combo here
        }
        "value": "#if($lifecycle == 'nonEmployee')none#{else}$attribute#end"
    }
}
2

Build a Transform for Lifecycle State, have explicit input in the transform, so that it will not depend on your Identity attribute data mappings.

Use Reference type Transform, get LCS value, based on that you can calculate whatever you need to for different attributes.

– Krish

3

So essentially what I already have in my example but in the attribute block use account attribute information and create a separate transform for each Identity attribute?

4

Yes, you don’t need to repeat LCS (Lifecycle State) calculation for each attribute. You can create one Transform and re-use (call) it using Reference Transform.

You need to have Transform for each attribute, there is no other way to pass inputs to another Transform at the moment.

Maybe if you can provide your requirements, I can think of if there is a way to build just one Transform for all attributes.

5

I was hoping that I could minimize the number of transforms down to one for this, but if an individual transform per Identity attribute is the only way to do this that’s fine.

Maybe there is another way to go about it, the situation we have is that we have part-time workers that are in our main HR source (Workday) as well as active in another authoritative source that has an Identity Profile at a lower level than the Workday Identity Profile. When their Workday relationship is terminated, they remain in the Workday profile for 120 days before they drop off from Workday (this is an Org requirement) however, since they have an active lifecycle in the other Identity Profile, we need to keep their Identity active. To solve this, we have a lifecycle that checks if they have an active status in the secondary authoritative source and are terminated in Workday. Along with this we need Identity Attributes such as Title and Department to be unset from their Workday values as they are no longer affiliated with that information.

6

We ended up utilizing one transform with logic similar to the way recommended in this post Lookup Transform - Default Value - #10 by nsorlien

Taking the Substing functionality of taking the implicit input we were able to reference those values in our final output value.

{
    "name": "employmentCheck",
    "type": "static",
    "attributes": {
        "lifecycle": {
            "type": "reference",
            "attributes": {
                "id": "Workday Lifecycle"
            }
        },
        "empValue": {
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "begin": 0
                        },
                        "type": "substring"
                    },
                    "none"
                ]
            }
        },
        "value": "#if($lifecycle == 'activestudent')#{else}$empValue#end"
    },
    "internal": false
}