SailPoint IIQ Rule - Isolating Identities based on Detected Role?

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

IIQ 8.3p3

Share all details related to your problem, including any error messages you may have received.

Hey there!

Assigned Roles / Detected Roles as I understand it, is searchable OOTB under Advanced Analytics. Is it possible to utilize that field to put in an IF condition in a IIQ rule?

For example,

If condition (identity has “Detected Role = Test Role”) then perform function, then return result to target attribute.

I’m unsure the syntax to write out for this if this is possible,

Thank you!

2

This will give list of all the detected Role for the user , now you can use this list to perform your logic.

	Identity iden = context.getObjectByName(Identity.class, "<name>");
	List<Bundle> detectedRole =iden.getDetectedRoles();
3

Hi Vishal thanks for the reply!

I receive a “System encountered error processing your request” when inputting 2nd line into the IIQ rule.

The next step after is to check from that list, if user has a certain role that is detected. And if so, do x.

Is this something you can put in as detectedRole.equals or detectedrole.contains?

4 
import sailpoint.object.QueryOptions;
  import sailpoint.object.Filter;
  import sailpoint.object.Identity;

  QueryOptions qo=new QueryOptions();
  Filter filter=Filter.eq("inactive", false);
  List identityList=new ArrayList();
  qo.addFilter(filter);
  Iterator itr=context.search(Identity.class,qo);
  while(itr.hasNext()){
    Identity identity=itr.next();
    if(null!=identity){
      List detecRoles = identity.getDetectedRoles();
      if(!Util.isEmpty(detecRoles)){
        for(Bundle role : detecRoles){
          if(null==role){ continue; }
          if(Util.nullSafeCaseInsensitiveEq(role.getName(),"Test Role")){
            identityList.add(identity.getName());
          }

        }
      }
    }

  }
  return identityList;

Try this this will give you the list of all active identity with detectedRole with name “Test Role”

2 Likes
5

Hi there dheeraj,

This is helpful! I was able to produce results utilizing some of your code snippets onto my own. Thank you!

Does this also work for assigned roles? Meaning, the syntax would then be getAssignedRoles() instead of getDetectedRoles() correct?

6

Yes you can replace identity.getDetectedRole() to identity.getAssignedRoles().

If this is good please mark solution as resolved.

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.