Search account ID from a specific source

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi community,

I have a scenario where I have an email from a user and I need to get the account Id from a specific source (non-employee). I have used search API for that and tried lots of different ways, but even trying to filter in the query by user email and source.type (source.name, source.id, nothing worked) it is not working, and it’s giving me the reply with account ID from all sources that a user has an account. Is it possible to filter the result to give me the ID only from one source that I want? See below the request body and the reply received:

Request body:

{
"indices": [
"identities"
],
"queryType": "SAILPOINT",
"queryVersion": "5.2",
"query": {
    "query": "accounts.source.type:\"Non-Employee\" AND attributes.email:\"[email protected]\""
},
    "queryResultFilter":{
        "includes":[
            "accounts.source.type",
            "accounts.id",
            "email"
            ]
    }
}

Reply:

[
    {
        "accounts": [
            {
                "id": "67b08b53****************eb8c28987",
                "source": {
                    "type": "Non-Employee"
                }
            },
            {
                "id": "c91904694**********************d98a2f",
                "source": {
                    "type": "IdentityNowConnector"
                }
            }
        ],
        "email": "[email protected]",
        "_type": "identity",
        "type": "identity",
        "_version": "v2"
    }
]

API used: https://sailpoint.api.identitynow.com/v3/search

Any help to understand if that would be possible or not is highly appreciated.

Thank you!

2

You can reduce the results to a single response with something like:

{
  "indices": [
    "identities"
  ],
   "query": {
    "query": "@accounts(email:\"[email protected]\")",
    "innerHit": {
      "type": "accounts",
      "query": "source.name:\\\"Non-Employee\\\""
    }
  },
}

However, innerHit does not respect “queryResultsFilter”. So from search, you would need to use another program to iterate through the accounts array and find the right source for your Non-Employee to get the id or in my example, iterate through the results to find the id field.

If you have to write a program anyway, you may find that you have better results with the SDK. Check out this session from @colin_mckibben

3

Hi Avner,

Do you have any other attributes from the identity you can use to search? The accounts list API (v3/accounts) allows you to add filters to search accounts for a specific identity. For example, you could add a filter like (identityId eq “” and sourceId eq “”) to return the non-employee account for that identity. You can filter on identity.name as well. Here is a link to the API endpoint documentation:

Thanks,

Liam

4

Hi Avner,
Is your use case for a workflow, or a simple ad-hoc search?
If you are attempting to do this in a Workflow for some other operations, you can use the ‘Get Accounts’ tile, and then define a variable using something like the below…
$.getAccounts.accounts[?(@.sourceId==‘’)].id

5

Hey all,

Thank you for all the inputs.
I have used innerHit as well, however as queryResultsFilter weren’t being applied, I have used the other way, but as I can have the account in multiple and different sources, that indeed may be the best option.

Regarding list-accounts API, it is not applicable, unfortunately, because the only information that I would have at that point would be the email address, which I can’t use to apply as a filter in this endpoint.

The use case if with ServiceNow. At some point in customer process, serviceNow will execute an API to get accountId, and the only information available that serviceNow has at that point is the email. So I’m looking for the query that would bring the information as simple as possible, so they wouldn’t need to code to much on their side to clean that up.

I’ll discuss with the user about the result that comes when innerHit is used and I’ll update you guys.