Transform: Check Value in Multi-Valued Account Attribute

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi,

Can a Transform be used to check a value inside a multi-valued account attribute?

Example:

role = ["role1", "role2", "role3"]

I want to check whether role1 exists.

Also, is there a way to see detailed errors or debug Transforms?

Thanks!

2

Hi Sojeong,

You should be able to leverage an account attribute transform in combination with a static transform to evaluate specific roles. The static transform should address the requirement effectively. For example:

#if($var == 'test1') Value1 
#elseif($var == 'test2') Value2 
#end

Please note that the variable $var will need to be populated using an account attribute transform prior to applying the static transform.

3

Hi @sxxnex ,

can you try below transfoms

{
“type”: “conditional”,
“attributes”: {
“expression”: “$role.indexOf(‘role1’) != -1”,
“positiveCondition”: “true”,
“negativeCondition”: “false”,
“role”: {
“type”: “accountAttribute”,
“attributes”: {
“sourceName”: “Test”,
“attributeName”: “role”
}
}
}
}

{
“type”: “indexOf”,
“attributes”: {
“input”: {
“type”: “accountAttribute”,
“attributes”: {
“sourceName”: “Test”,
“attributeName”: “role”
}
},
“value”: “role1”
}
}

can you also please confirm you just wanted know weather role1 is there in this multi-valued attribute Role or Role1 will change case to case

for Debug
I would recommand to use IdentityProfile and preview option I dont see any other option for now can any one add points here im happy to learn

thanks
Avinash Mulpuru.

4

Thanks for the suggestion.

What I want to check is only whether role1 exists in the multi-valued attribute Role or not.
The position/index of role1 does not matter to me — I just need a true/false result based on existence.

5

It seems that this transform format cannot handle checking values in a multi-valued attribute. I keep getting errors when trying it.

6

@sxxnex This link has the example on how to check for the value exists in a multi-valued - Account attribute | SailPoint Developer Community

Check the last example.

7

Hi @sxxnex

Can you check bellow example please

{
“name”: “Has role1”,
“type”: “lookup”,
“attributes”: {
“input”: {
“type”: “firstValid”,
“attributes”: {
“values”: [
{
“type”: “accountAttribute”,
“attributes”: {
“sourceName”: “test”,
“attributeName”: “role”,
“accountPropertyFilter”: “(role.contains("role1"))”
}
},
“FALSE”
]
}
},
“table”: {
“FALSE”: “FALSE”,
“default”: “TRUE”
}
}
}
1 Like
8

You can do that by using nested transforms (static, accountAttribute) with accountPropertyFilter option. Please check the below transform

{
    "name": "MultiValued Check",
    "type": "static",
    "attributes": {
        "role1Exists": {
            "attributes": {
                "values": [
                    {
                        "type": "accountAttribute",
                        "attributes": {
                            "attributeName": "role",
                            "sourceName": "sourceName",
                            "accountPropertyFilter": "(attributeName.contains(\"role1\"))"
                        }
                    },
                    "none"
                ]
            },
            "type": "firstValid"
        },
        "value": "#if ($role1Exists != 'none')true#{else}false#end"
    },
    "internal": false
}

hope this helps you.

1 Like
9

It would be helpful if you could show us what you have tried and what error you are getting or what the result is. This will allow other developers to point out corrections in your code that could help, or suggest alternate options.

I would be careful (an not recommend) using “indexOf” here, because if you are looking for “role1” and have the following list, what is it going to return?

["role11","role16","role19","role234"]

The linked document does seem to have a good example for what the OP is looking to do, and would be a good starting point.

This appears that you took the example from the previous link and just plugged the user’s requirements in for them. Can you explain further why this code would work for this user?
Also, when posting code, please try to use proper code formatting to make it readable.

This seems to be the most complete example that combines most of the previous suggestions into a readable post. I would verify that when Attribute does NOT contain the value that it drops down to “none”. I would also verify that the accountPropertyFilter does not return true if there is another value that contains part of the string you are looking for (see the example above with “role1” and “role19”)

I would take a look at the UI Development Kit. I think there may be a Transform Builder/tester there (don’t quote me on that though)

1 Like
10

-The filter role.contains(“role1”) only matchs the account if the user has role1 in their role list.

-If the user has role1, the accountAttribute returns then “match”.
-If the user doesn’t have role1, it returns nothing, firstValid uses the fallback “FALSE”.
-The lookup outputs TRUE when there’s a match, otherwise FALSE.

On code formatting I’ll format any code examples with proper code blocks going forward.

Thanks

11

Hello, @sxxnex. Hope you’re doing great.

To complement the other answers given previously, an alternative way to achieve this goal could be by using something similar to the transform below.

{
    "name": "GetExceptionStatus",
    "type": "static",
    "attributes": {
        "value": "#set($hasRole = false)#foreach($role in $identity.getAssignedRoles())#if($role.getDisplayName() == 'role1')#set($hasRole = true)#end#end$hasRole"
    },
    "internal": false
}

Hope it may be helpful.

1 Like
12

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.