Refreshing Related Account Groups Without Running a Full Aggregation

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Version 8.4

I need to refresh my Account Attributes. Currently, I have Group 1 and Group 2, where Group 2 is related to Group 1.

Example:

  • Group 1 = Accountant

  • Group 2 linked to it = Certified Accountant, VIP Accountant

image
image1096×266 18.5 KB

image
image973×217 15.9 KB

When I remove entitlement Group 1 (“Accountant”), I want all related Group 2 values to be removed as well.

In my application (a web service), I call an API to delete the data. After I run a full aggregation, both the Group 1 and Group 2 values disappear correctly.
However, before aggregation, the old values are still shown on the UI, it deleted just for Group 1 (“Accountant”)

The issue is:
My application has many accounts (around 10k), so running a full aggregation just because one user updates their data is not a good idea.

I found information suggesting that I could use context.get to refresh only the specific user, but since I’m using IIQ with Cloud Gateway, context.get always returns null and cannot be used.

image
image968×145 11.6 KB

This is image after run full aggregation

Question:
In this situation, what is the proper way to refresh only the updated user’s account data without running a full aggregation?

2

if group 2 is always removed when group 1 is removed, what if you add that to the account request in before provisioning rule. So in before provisioning rule for this application - you could detect if the group 1 is being removed and if it is then update the account request with removal of group 2 as well.