I have a Role with assignment definition as, if a user has a particular entitlement on a source then assign another Entitlement.
A user can have multiple accounts on the this Source (defined in the assignment) but the entitlement will be on only one account.
Issue: for some users with multiple accounts, the Role is not detecting the entitlement defined in the assignment and not adding the role. I think Role is looking for the first identified account and moving on if its does not find the entitlement. If I remove the other account and process the user, then role assignment flows through.
Any help on this? how can i make role detect the defined criteria even if the user has multiple accounts?
There might be a simpler way, but my first thought is to create an identity attribute to handle this. Since standard role criteria can sometimes trip up when a user has multiple accounts on a single source, moving that logic into a transform usually does the trick!
Here is how you could set it up:
First, create a new Identity Attribute that will act as a flag (like a true/false value).
Next, you’ll want to write a transform for that attribute. In the transform, you can use the accountAttribute operation to look for the specific entitlement.
The secret sauce here is using an accountPropertyFilter in your transform. This tells ISC to evaluate all of the user’s accounts on that source to find the right one, rather than just stopping at the first account it sees. Just keep in mind that accountPropertyFilter will only work if you have a programmatic way to determine the specific account you want to look at (for example, filtering by a specific accountType attribute, a naming convention, or another unique identifier on the account).
If the transform finds the entitlement on that filtered account, you can configure it to return true.
Finally, just update your role’s assignment criteria to look for this new identity attribute. If the attribute equals true, the role gets assigned!
Let me know if you want a hand putting the transform together!
That was my next option but my identity attrs list is already long and was trying to avoid as this will lead to performance eventually but if was going to do that as last restort.