Retrieving Role assignments in a Transform

Identity Security Cloud (ISC) ISC Community Knowledge Base
, ,
1

Problem

Need to determine if a role exists on a user.

Solution

Example:

{
    "id": "9772f8d4-7ef8-40ca-a3a8-bd1ea85c0996",
    "name": "hasO365License",
    "type": "static",
    "attributes": {
        "requiresPeriodicRefresh": "true",
        "value": "#set($roleAssignments = $identity.getRoleAssignments())#set($hasO365License = false)#foreach($roleAssignment in $roleAssignments)#if($roleAssignment.roleName.contains('O365:'))#set($hasO365License = true)#break#end#end$hasO365License"
    },
    "internal": false
}

This transform is using Velocity Template Language (VTL) to determine if the identity has any role assignments that contain “O365:” in the role name. Here’s a breakdown of what the transform is doing:

  1. It retrieves all the role assignments for the identity using $identity.getRoleAssignments() method and stores them in the $roleAssignments variable.

  2. It initializes a boolean variable $hasO365License to false. This will be used to store whether the identity has an O365 license or not.

  3. It then loops through each role assignment using #foreach($roleAssignment in $roleAssignments).

  4. For each role assignment, it checks if the role name contains the string “O365:” using #if($roleAssignment.roleName.contains('O365:')).

  5. If a role assignment is found with “O365:” in the name, it sets $hasO365License to true and breaks out of the loop using #break. This is done because we only need to know if the identity has at least one O365 license, not the specific number of licenses.

  6. After the loop finishes, the value of $hasO365License is returned, which will be either true or false depending on whether an O365 license was found in the identity’s role assignments.

In summary, this transform checks the identity’s role assignments and returns true if the identity has at least one role with “O365:” in the name, indicating they have an O365 license, and false otherwise.

The requiresPeriodicRefresh attribute is set to true, which means this transform will be re-evaluated periodically to ensure the O365 license status stays up-to-date.

3 Likes
2

That is a very good piece of code. However, I do question if the loop is required, as we have found this to work:

{
    "type": "static",
    "attributes": {
        "value": "#if($identity.getAssignedRoles().toString().contains('O365:'))true#{else}false#end"
    }
}

Phil

5 Likes
3

Great idea Phil! Converting it to a string and looking for the contains makes a lot of sense.

2 Likes