Trigger filter parsing

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi folks , I am trying to filter the provisioning completed event trigger.
Requirement is :
Filter events which are from specific source, with Modify Account request, Add attribute request, specific role, the account request should be committed AND action should be “Access Request”.

I am able to achieve all other filtering apart from action because of the way json is structured. Sharing the json for provisioning trigger

{
    "_metadata": {
        "invocationId": "6a700aed-8c01-410b-9578-ef37958d7f5f",
        "triggerId": "idn:post-provisioning",
        "triggerType": "fireAndForget"
    },
    "accountRequests": [
        {
            "accountId": "123",
            "accountOperation": "Modify",
            "attributeRequests": [
                {
                    "attributeName": "detectedRoles",
                    "attributeValue": "Signage - Zoom [AccessProfile-1675050307522]",
                    "operation": "Add"
                }
            ],
            "provisioningResult": "IdentityNow Task",
            "provisioningTarget": "IdentityNow",
            "source": {
                "id": "IdentityNow",
                "name": "IdentityNow",
                "type": "SOURCE"
            },
            "ticketId": null
        },
        {
            "accountId": "VkHJk3oMQLapAWC9kLUcYw",
            "accountOperation": "Modify",
            "attributeRequests": [
                {
                    "attributeName": "role_id",
                    "attributeValue": "123",
                    "operation": "Add"
                },
                {
                    "attributeName": "email",
                    "attributeValue": "[email protected]",
                    "operation": "Add"
                },
                {
                    "attributeName": "first_name",
                    "attributeValue": "abc",
                    "operation": "Add"
                },
                {
                    "attributeName": "last_name",
                    "attributeValue": "abc",
                    "operation": "Add"
                }
            ],
            "provisioningResult": "committed",
            "provisioningTarget": "Zoom",
            "source": {
                "id": "123",
                "name": "Zoom",
                "type": "SOURCE"
            },
            "ticketId": null
        }
    ],
    "action": "Access Request",
    "errors": [],
    "recipient": {
        "id": "123",
        "name": "Abc",
        "type": "IDENTITY"
    },
    "requester": {
        "id": "abc",
        "name": "1002",
        "type": "IDENTITY"
    },
    "sources": "Zoom, IdentityNow",
    "trackingNumber": "abc",
    "warnings": []
}

and the filter which is working fine without action filter.
$.accountRequests[?(@.source.id == "abc" && @.provisioningResult == "committed" && @.accountOperation == "Modify")].attributeRequests[?(@.attributeName == "role_id" && @.operation == "Add" && @.attributeValue == "abc")]

Some of the values are randomly replaced but the filter is working fine.

How do I add action=“Access Request” along with above filter.

Single filter on action is working fine which is below:

$[?(@.action == 'Access Request']

2

What if you try this?

$[?($.action == "Access Request")].accountRequests[?(@.source.id == "abc" && @.provisioningResult == "committed" && @.accountOperation == "Modify")].attributeRequests[?(@.attributeName == "role_id" && @.operation == "Add" && @.attributeValue == "abc")]

3

action and accountRequest are at same level so nesting would not work in filter.

attribute request is inside account request so it’s working fine. This is something quite common use case where we want to filter using attributes which are on same level. It is not working.

4

FWIW, I tested the above JSONpath and it worked for me. Have you tried it?

5

Thanks @colin_mckibben , seems like it is working. I tried so many combinations and made mistake.

I still do not understand why do I need to use “.” which is for inner object but action and accountRequests are at same level.
Also you have used $.action which was throwing error in jsonpath.com but works fine in trigger filter. @.action also works fine here but I am not able to understand underlying logic.

6

Our ETS service uses Jayway jsonpath, while http://jsonpath.com/ uses Goessner jsonpath. Jayway has support for more operators than Goessner, hence the reason for some things not working in that editor. I recently updated the trigger filter docs to point to a new online editor that matches very closely, if not exactly, to the ETS jsonpath implementation. In the future, use https://www.javainuse.com/jsonpath when crafting jsonpath for ETS filters.

I’m not a JSONpath guru, but I find it helps to break down the expression into parts when using the online editor. This expression will return the entire root object if the filter matches:

$[?($.action == "Access Request")]

Hence, the need for the .accountRequests, since the output of the above expression is the original object to begin with.

1 Like