Support for 'Does Not Contain' operator in the role criteria

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

There was a post in the past requesting ‘Does Not Contain’ operator for role criteria. I would like to know if it is implemented or not. At least on UI and under API documentation I didn’t find anything.
Continuing the discussion from Operation Needed: "Does Not Contain" for Role Criteria:

Thanks,
Sagar

2

Hi @sabh21_KD ,

The Operation Does not contain does not exist in place of it you can use Does not equal please check the below screenshot.

image
image871×271 17 KB

Please refer the below link

Thank you!

3

Hi Sagar,

That is still not available from UI.

But i found a similar post and a solution posted as a workaround for that. please check if this helps.

Thanks

4

Thanks Jishnu,
I am aware of this solution. In my case there are many attributes which needs ‘Does Not Contain’ condition. For each of those creating Identity attribute will be overkill.

-Sagar

5

Hi Abhishek,
I can’t use ‘Does Not equal’ because there are too many combinations of possible values.

-Sagar

6

HI @sabh21_KD,
From API i think you may be able to create. Please check the screenshot for your reference.

image
image774×294 21.5 KB

Please check the below link for your reference.

Thank you!

7

I know this is not a good design but just a thought.

  1. Create 1 identity Attribute.
  2. Put together a format for each attribute and the position. Even though the identity attribute is a string object. Think of it as a array Obj. [0,1,2,3,4] separated by Semicolon (; )
  3. Now on each index you can store AttributeName=true/false for each attribute. Ex: Location does not contains “ABC” true. Store the Result in the Iden Attr as Loc=1 seperated by “;”.
  4. Hence your identity attribute will start looking like this: Loc=1;Dept=0;City=1;…
  5. Then on the role you can say contains (if Identity attribute contains Loc=1;) etc… to make that check.

This will increase your work but you will be able to do that process.

Just a hint for transforms if you do go via this route:

  • Create individual transforms for each attribute like for loc a diff. transform dept a different one. and then leverage all of them using transform type=reference and attach to the identity attribute. This way you will be able to maintain the transforms going forward as well if anything new comes up to be added.
8

Thanks Neeraj for the suggestion and it looks feasible. I will go with static transform instead of separate transform for each.