Hi all,
I have run into a scenario where I am not sure if I should be returning null or not from the target mapping rule for the manager attribute.
What happens if I return null from the rule? Will it remove the manager from AD?
What happens if we do not return anything from these rules?
Thanks in advance
Hi @rishavghoshacc
This depends on what you return from the Target Mapping rule
If you return null, IIQ will treat it as an explicit update and try to clear the manager attribute in the target system (AD)
If you don’t return anything ,IIQ won’t make any change and the existing manager value will stay as it is.
So, you should return null only when you actually want to remove the manager; otherwise, just skip returning a value to keep it unchanged.
Hello @rishavghoshacc ,
@kallajayaram is correct. If you explicitly want to remove manager then only return null from the rule.
If you do not return anything from the rule then sailpoint assumes “no change required”, hence existing manager value in AD remains unchanged.
Hi @rishavghoshacc , Whatever Jaya Ram Kalla explained, it is correct. If you want to remove the attribute value, then return null otherwise don’t.
Hi @rishavghoshacc. If you want to keep the current value, you can get that from the AD link and return it.
The link is one of the parameters passed to the rule.
Hi @rishavghoshacc
Behavior in Target Mapping Rule (Manager Attribute)
Return null
IIQ treats it as explicit update
Removes manager in AD (sets it empty)
Do NOT return anything
IIQ treats it as no change
Existing manager stays as-is in AD
Return existing value (from link)
IIQ will keep same manager (safe approach)
@msingh900 Is it the same for source mapping rule?
If we do not return anything, does the value remain unchanged?
@Pankaj_IAM_SailPoint Is it the same for source mapping rule?
If we do not return anything, does the value remain unchanged?
@kallajayaram Is it the same for source mapping rule?
If we do not return anything, does the value remain unchanged?
@paul_hilchey Is it the same for source mapping rule?
If we do not return anything, does the value remain unchanged?
@saiprashanth88 Is it the same for source mapping rule?
If we do not return anything, does the value remain unchanged?
Hi @rishavghoshacc
Yes, if you don’t return anything from the target mapping rule, IIQ will treat it as no change and the existing manager value will remain unchanged.
Hi @rishavghoshacc ,
Impact of returning null or existing value remains same for any type of Rule, either Source mapping rule (Application and Global Rule) or target mapping rule.
@rishavghoshacc
for source mapping if a rule does not return any value or explicitly returns null, it is treated as no update, so the existing attribute value remains unchanged after aggregation and refresh. However, if the rule explicitly returns an empty string (""), IdentityIQ treats it as a valid value and updates the attribute, effectively overwriting the previous value and clearing it.
In Source Mapping rule, The Rule Type is identityAttribute and it returns attributeValue. So, Whatever value you are returning, it will update with that.
@msingh900 What if we do not return anything from the source mapping rule? Will it remove the attribute value or keep it unchanged?
We faced an issue a few days back where we did not return anything from the rule and the attribute value was removed from the identities
@rishavghoshacc Whenever you are using rule, then keep try to return something, otherwise SailPoint will assume that no value is needed and remove the value from the attribute.
You can write a logic to return the same value what was present before in the case where you are returning null.
@rishavghoshacc Yes !
@rishavghoshacc Always return the value that should be there in that attribute. If value is already set, then in that case IIQ will filter it out and not send to provisioning. Make sure that these are casesensitive, ex : department = Finance or FINANCE both will be treated as separate entries.