Transform to index Multi-Valued Account Attributes

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello! I’m throwing in the towel and asking for help on this one. I have an HR source that is providing Multi-Valued information for users. The information is coming in as 2 separate attributes, one is the licenses (RN,MA,MD, etc) and the other is the dates the licenses were issued. I need a transform to find the corresponding date to a specific license. Ex: Find which line is “RN” and find the corresponding date of license.

Example of Attribute data below:

 "attributes": {
            "Supervisor": "T9210",
            "Credential": [
                "RN",
                "MA"
            ],
            "PositionTitle": "RN Emergency Room",
            "FirstName": "First",
            "PositionCategory": "RN",
            "OriginalCredentialDate": [
                "10/14/2024",
                "10/10/2024"
            ],
            "StartDate": "10/27/2023",
            "Department": "Emergency Room",
            "EmployeeStatus": "ACTIVE",
            "LastName": "Last",
            "EmployeeID": "T5625",
        }

So given the above I would need a transform to find “RN” and store what line it is found on and then use that line to return the value of “10/14/2024”. My attempts at this have only resulted in errors or just blank values:

{
    "name": "CredentialDateLookup",
    "type": "static",
    "attributes": {
        "credentials": {
            "type": "accountAttribute",
            "attributes": {
                "sourceName": "HRSource",
                "attributeName": "Credential"
            }
        },
        "credentialDate": {
            "type": "accountAttribute",
            "attributes": {
                "sourceName": "HRSource",
                "attributeName": "OriginalCredentialDate"
            }
        },
        "value": "#set($index = -1)#foreach($credential in $credentials)  #if($credential == 'RN')    #set($index = $foreach.index)    #break  #end#end#if($index >= 0)  #set($date = $credentialDate[$index])  $date#end"
    },
    "internal": false
}
2

Hey @Salsbrook !

This is actually less of a Transforms thing and more of a Source Configuration thing.

Assuming this is a custom Web Services connector, you’ll want to refine the Schema and Attribute Mapping to pull in the OriginalCredentialDate values for each possible credential as separate attributes. You’d do this by using jsonPath filtering.

Schema Attribute Expression
RNCredentialDate $.credential[?(@.name==‘RN’)].originalCredentialDate
MACredentialDate $.credential[?(@.name==‘MA’)].originalCredentialDate

This assumes that the API is actually returning a hashtable with the credentials, which is a big assumption… If you can share a (redacted) sample of the actual API call, rather than just the SailPoint Attributes as interpreted, that may be more helpful.

1 Like
3

The source is actually coming through as a CSV so it is a Delimited File source type.

4

Is it because you have an upper case C in $CredentialDate?

5

That is actually a typo when I changed the labels for things to not potentially expose anything sensitive. In the actual transform it is the correct case and still returning nothing. The issue seems to be with “#foreach($credential in $credentials)” It is like the $credentials attribute isn’t an array or that it can’t pick it up as such.

1 Like
6

You can try addressing this in the BuildMap rule (cloud rule), potentially merge the two attributes into something like the following:
“RN:10/14/2024”,
“MA:10/10/2024”

7

do you have separate records coming in for each of the credentials? if not, how can we be sure which date goes with which credential?

8

Unfortunately I don’t want to combine the Credential and Date because I want to use the date later on in a datemath transform.

Each credential record comes in as separate lines in the CSV. The Credential and OriginalCredentialDate are set as Multi-Valued. Like this:

EmployeeID FirstName LastName StartDate EmployeeStatus PositionTitle Department Supervisor PositionCategory Credential OriginalCredentialDate
T5626 TestFirst TestLast 10/27/2023 ACTIVE RN Emergency Room Emergency Room T9210 RN RDCS 4/4/2024
T5626 TestFirst TestLast 10/27/2023 ACTIVE RN Emergency Room Emergency Room T9210 RN MA 6/7/2024
T5626 TestFirst TestLast 10/27/2023 ACTIVE RN Emergency Room Emergency Room T9210 RN RN 10/10/2024
9

if you have a set list of credentials you care about, could you instead have a separate date column for each credential, rather than having separate rows for each? if they don’t have the credential, just leave the date blank.

10

Unfortunately I don’t have control over the HR csv file and the format. If we had separate columns for each type of credential and separate columns for each date it would be probably 50 or more columns. I might be misunderstanding what you’re saying though.

11

You can either:

  1. Keep the original two attributes untouched, and added a third attribute in the buildmap for the merged data. Or;
  2. In your datemath transform, wrap / pre process that merged attribute by substring to get the date.
1 Like
12

yeah given the other constraints, i think your best bet is to combine the credential and the date into a single object with a specific delimiter (like an underscore or something) and then have a transform that splits those apart to get specific dates for specific credentials.

unfortunately, a multi-valued attribute is standalone and can’t be tied to another multi-valued attribute, so the dates and credentials you see in the account aren’t necessarily guaranteed to match each other ordinally.

13

Unfortunately my Rule building skills are weak so I’m not sure how to properly utilize the BuildMap Rule if it is the best solution to my issue.