Transform is setting LCS to Active no matter the criteria

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I have created a transform that I am trying to set the lifecycle state and I am referencing other transforms. The InactiveAccount_test sets an identity attribute to either Hold(if they are in the suspend or Litigation Hold OU in AD), true(if in the inactive OU in AD), or false. Below is my transform and it keeps setting the LCS to Active for a specific user that is in the Inactive OU or the other OUs mentioned.

“name”: “Temp Passport LCS Calc”,

"type": "static",

"attributes": {

    "isInactiveAccount": {

        "attributes": {

            "id": "InactiveAccount_Test"

        },

        "type": "reference"

    },

    "standardLCS": {

        "attributes": {

            "id": "Calculate_NonEmployee_LifecycleState"

        },

        "type": "reference"

    },

    "adInactive": {

        "type": "static",

        "attributes": {

            "value": "adInactive"

        }

    },

    "litigationHold": {

        "type": "static",

        "attributes": {

            "value": "hold"

        }

    },

    "value": "#if($isInactiveAccount == 'Hold')$litigationHold#{elseif($isInactiveAccount == 'true')}$adInactive#{else}$standardLCS#end"

},

"internal": false
2

I have seen invalid syntax in the static transform elseif condition.

Try this,

#if($isInactiveAccount == ‘Hold’)$litigationHold#{elseif} ($isInactiveAccount == ‘true’)$adInactive#{else}$standardLCS#end

3

I tried this and it is still not setting it correct

4

You can debug and find the value of each attribute in this transform and you will get an idea why the conditions failing. Since it always goes to else condition, print all the values in the else condition and see what value each attribute brings to you.

5

Ok so the standard lifecycle state transform looks at the end date and if it has not lapsed it sets the LCS to Active and if it has it sets to Inactive. We do a manual process every month that we move users that have had no login activity to an inactive OU and if the account is in Litigation Hold or suspend we move the accounts to the respective OU for those.

image
image451×422 5.66 KB

image
image468×434 5.97 KB

“name”: “InactiveAccount_Test”,

"type": "static",

"attributes": {

    "ADContainer": {

        "type": "firstValid",

        "attributes": {

            "values": \[

                {

                    "attributes": {

                        "sourceName": "ARHSB-AD",

                        "attributeName": "distinguishedName"

                    },

                    "type": "accountAttribute"

                },

                {

                    "type": "static",

                    "attributes": {

                        "value": "N/A"

                    }

                }

            \]

        }

    },

    "value": "#if ($ADContainer.contains('OU=Litigation') || $ADContainer.contains('OU=Suspended')) Hold #elseif ($ADContainer.contains('OU=Inactive')) true #else false #end"

},

"internal": false
6

I would recommend breaking this transform down into smaller chunks to see which part is the issue instead of trying to debug all at once. Try with just the first part, then when you have that part working, move onto the next part until it’s complete.

7

Thank you for the advice, I figured out what was causing the issue, the AD container contains Litigation Hold and I was setting that to Hold instead of Litigation Hold. It is working now for me

image

1 Like