Sailpoint ISC birthright roles

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Team,

Can we set-up ISC birthright role as below?

Account to be added to AD group on user start date

Account to be removed from AD group 14 days after the start date.

2

Yes. You will need to create a transform which will set an Identity Attributes when someone is in that window.

Transform Example:

{
    "name": "Start Example",
    "type": "static",
    "attributes": {
        "startDate_reached": {
            "attributes": {
                "firstDate": "now",
                "secondDate": {
                    "attributes": {
                        "input": {
                            "attributes": {
                                "attributeName": "<startDate Attribute>",
                                "sourceName": "<source>"
                            },
                            "type": "accountAttribute"
                        },
                        "inputFormat": "M/d/yyyy",
                        "outputFormat": "ISO8601"
                    },
                    "type": "dateFormat"
                },
                "operator": "gte",
                "positiveCondition": "activate",
                "negativeCondition": "N/A"
            },
            "type": "dateCompare"
        },
        "14daysPastStartDate": {
            "attributes": {
                "firstDate": "now",
                "secondDate": {
                    "attributes": {
                        "expression": "+14d/d",
                        "input": {
                            "attributes": {
                                "input": {
                                    "attributes": {
                                        "attributeName": "<startDate Attribute>",
                                        "sourceName": "<source>"
                                    },
                                    "type": "accountAttribute"
                                },
                                "inputFormat": "M/d/yyyy",
                                "outputFormat": "ISO8601"
                            },
                            "type": "dateFormat"
                        },
                        "roundUp": false
                    },
                    "type": "dateMath"
                },
                "operator": "gte",
                "positiveCondition": "pastStartDate",
                "negativeCondition": "N/A"
            },
            "type": "dateCompare"
        },
        "value": "#if($14daysPastStartDate=='pastStartDate')false#elseif($startDate_reached=='activate')true#{else}false#end"
    }
}

Setup a role to look at that new Identity Attribute, and apply the role if the Identity attribute = true.

1 Like
3

Hello,

Yes.

You can create an Identity Attribute and write a JSON transform to determine that.

Once the above is done, add that identity attribute to the criteria.

Regards,

Rohit Wekhande.