Search nested access filtering

SailPoint Human Fabric (SHF) SHF Discussion and Questions
, ,
1

Hi,

I’m querying Search to return a list of identities that have access on a specific set of sources.

In the response, I would like to return only the access entries related to those same sources, not the full access array for each identity.

Is this possible with Search, or does Search always return the full nested access list once the identity matches the query?

Thank you

{
    "query": {
        "query": "@access(type:\"ACCESS_PROFILE\" AND source.name.exact:(\"source1\" OR \"source2\" ... \"AppX\")) AND attributes.cloudLifecycleState:(active OR leaving)"
    },
    "indices": [
        "identities"
    ],
    "queryResultFilter": {
        "includes": [
            "displayName",
            "firstName",
            "lastName",
             ...,
            "access.type",
            "access.description",
            "access.displayName",
            "access.source.name"
        ]
    },
    "includeNested": true
}
2

Hi @fatimahm

Try using the innerHit option in your search query instead:

{
    "indices": [
        "identities"
    ],
    "query": {
        "query": "attributes.cloudLifecycleState:(active OR leaving)",
        "innerHit": {
            "type": "access",
            "query": "type:\"ACCESS_PROFILE\" AND source.name.exact:(\"source1\" OR \"source2\" OR \"AppX\")"
        }
    },
    "queryResultFilter": {
        "includes": [
            "displayName",
            "firstName",
            "lastName",
            "access.type",
            "access.description",
            "access.displayName",
            "access.source.name"
        ]
    }
}
3

You can use Innerhit to search inside of Access, search-post-v-1 | SailPoint Developer Community

{
  "indices": [
    "identities"
  ],
  "query": {
    "query": "\"John Doe\"",
    "innerHit": {
      "type": "access",
      "query": "source.name:\"Active Directory\""
    }
  }
}

And in the response , unfortnally you cant filter on that degree on the API. but you can have a postman script to do it, if its manuall.

4

Hey reference may help to build you search query

https://community.sailpoint.com/t5/Identity-Security-Cloud-Wiki/How-to-Perform-Searches-with-innerHit-criteria-via-API/ta-p/221973

5

Thank you all for the suggestions, really appreciated.

I tested innerHit, and it does help filter the access results by source/type. However, in my use case I also need the identity details in the same response.

With innerHit, I can see the filtered access entries, but I’m not seeing a clear link back to the identity details that would let me reliably join both datasets.

So what I’m really looking for is a way to:

  • return identities matching my search criteria

  • return only the matching access entries for those identities

  • keep the identity attributes in the same response

6

Ah I see. Unfortunately, I don’t think that’s possible with search.

I think the best go forward way for you would to parse it out using some code in a script. Here’s a quick powershell script of the logic that I think would work with your original query to filter out the results for the specific source you want:

$response = Invoke-RestMethod -Uri "https://{tenant}.api.identitynow.com/v3/search" -Method Post -Headers $headers -Body $body
$filteredIdentities = @()
foreach ($identity in $response) {
    $filteredAccess = $identity.access | Where-Object { $_.source.name -eq 'YOURSOURCEHERE' }
    if ($null -ne $filteredAccess) {
        $identity.access = $filteredAccess
        $filteredIdentities += $identity
    }
}

$filteredIdentities | ConvertTo-Json -Depth 10
7

The short answer is no, it will throw you the entire access object for each hit. You will need to filter it on whatever mechanism you are using to call the API.

8

If you are filtering on multiple fields within the @access object, make sure all conditions are part of the same nested query.