Transform firstValid, dateCompare, dateFormat, dateMath

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Looking to build an Inactive LCM state. Have used FirstValid to ignore the failed/null scenarios incase user doesnt have the details yet, then used dateCompare to find the latest logon date, dateFormat to get it in a particular format for calculation, and finally the dateCompare to get the comparison. The DateCompare works if I remove “Firstvalid” from line 2 and give a true or false. Ideally I would want to see the value (latest date) but in this case the transform does not even display a True/False

{
        "name": "Date Compare Transform",
        "type": "firstValid",
        "attributes": {
            "type": "dateCompare",
            "attributes": {
                "firstDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "expression": "-60d",
                                    "input": {
                                        "attributes": {
                                            "input": {
                                                "attributes": {
                                                    "sourceName": "Active Directory",
                                                    "attributeName": "lastLogonTimestamp"
                                                },
                                                "type": "accountAttribute"
                                            },
                                            "inputFormat": "EPOCH_TIME_WIN32",
                                            "outputFormat": "ISO8601"
                                        },
                                        "type": "dateFormat"
                                    }
                                },
                                "type": "dateMath"
                            },
                            ""
                        ]
                    }
                },
                "secondDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "expression": "-60d",
                                    "input": {
                                        "attributes": {
                                            "input": {
                                                "attributes": {
                                                    "sourceName": "Azure Active Directory"
                                                    "attributeName": "lastSignInDateTime"
                                                },
                                                "type": "accountAttribute"
                                            },
                                            "inputFormat": "dd MMM yyyy, HH:mm",
                                            "outputFormat": "ISO8601"
                                        },
                                        "type": "dateFormat"
                                    }
                                },
                                "type": "dateMath"
                            },
                            ""
                        ]
                    }
                },
               "operator": "gte",
                "positiveCondition": "true",
                "negativeCondition": "false"
            }
        },
        "internal": false
    }
2

Hi @KirtiSikarwar ,

Use the dateCompare as the main transform. As in the case where “firstDate” gives the value “null” as secondDate gives the Date value or vice-versa, how would it compare?

Also, For firstvalid, you didn’t specify the value for main transform too.

Thanks!

3

@GOKUL_ANANTH_M The reason I put firstValid before is because some identities may not have the date (both AD and AAD - like staged users) in this case it will not show failed but simply blank. For the ones I am looking to compare will have both the dates, so ideally it should show true/false

4
  1. Your outermost transform is FirstValid, but the attributes of this transform is not as per the format required. it needs to have "values" : [...] and you have a dateFormat transform directly assigned to attributes. I am not sure if it is returning any value. As per my knowledge this should be throwing an error.
    You may refer to the example from documentation page https://developer.sailpoint.com/idn/docs/transforms/operations/first-valid
  2. Instead of using an empty string as default value in these FirstValid transforms use a simple DateMath that returns now + or -100 years to suit your comparison logic.
  3. You have dateMath as values inside FirstValid transforms in both firstDate and secondDate. But the value returned from DateMath is not is ISO8601 format. Both date fields for Datecompare should be in ISO8601 format. Have a DateFormat transform wrapped around this firstValid to convert the output from DateMath to ISO8601
1 Like
5

@iamnithesh I have made changes to the transform. This is now working correctly for users without data “NA” but displays the same even when it should be a True/False. Breaking the transform so this section is using the DatFormat for the AD data and then compare it with now-60 days, should return true or false depending on the condition.

{
    "name": "AD Date Compare Transform with Today",
    "type": "firstValid",
    "attributes": {
        "values": [
            {
            "type": "dateCompare",
            "attributes": {
                "firstDate": {
                    "attributes": {
                        "input": {
                            "attributes": {
                                "sourceName": "Active Directory",
                                "attributeName": "lastLogonTimestamp"
                            },
                            "type": "accountAttribute"
                        },
                        "inputFormat": "EPOCH_TIME_WIN32",
                        "outputFormat": "ISO8601"
                    },
                    "type": "dateFormat"
                },
                "secondDate": {
                    "attributes": {
                        "expression": "now-60d",
                        "roundUp": true
                    },
                    "type": "dateMath",
					"inputFormat": "ISO8601",
				    "outputFormat": "yyyy-MM-dd'T'HH:mm"
                                    }
               },
                "operator": "gte",
                "positiveCondition": "true",
                "negativeCondition": "False"
            },
            "NA"
        ]
    },
    "internal": false
}
6

Transform you have defined for second date is not formatted correctly.

  1. dateMath does not need
    "inputFormat": "ISO8601",
    "outputFormat": "yyyy-MM-dd'T'HH:mm"
  1. You need to wrap dateMath with dateFormat with following
    "outputFormat": "ISO8601",
    "inputFormat": "yyyy-MM-dd'T'HH:mm"

so that secondDate is in ISO8601 format

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.