Unable to extract field using Regex in jsonpath filter

[salam1 (Shajedul Alam)]

Hello,
I am building a workflow where I am sending email to a distribution list. This email will contain all active directory groups of the active directory account.

I am looking to only extract the group name from the jsonpath.

Example of the jsonpath:

{
"attributes": {
		"telephoneNumber": "blur",
		"mail": "blur",
		"accountExpires": "blur",
		"displayName": "blur",
		"lastLogonTimestamp": "blur",
		"description": "blur",
		"distinguishedName": "CN=blur,OU=blur,OU=blur,DC=blur,DC=blur",
		"title": "blur",
		"objectType": "blur",
		"objectguid": "blur",
		"memberOf": [
			"CN=External,OU=blur,OU=blur,DC=blur,DC=blur",
			"CN=All,OU=blur,DC=blur,DC=blur"
		]
}}

My jsonpath filter is:
$…attributes.memberOf[?(@ =~ /(?<=CN=)(.*?)(?:,OU)/i)]

This is currently not working. The result im getting back is not correct.

Using SailPoint Developer Community

I am only looking to extract the group name here which is external, all from the memberof.

Can you please assist in why the jsonpath regex filter is not working?

Documentation reference: GitHub - json-path/JsonPath: Java JsonPath implementation

[iamnithesh (Nithesh Rao)]

I don’t think jsonpath filter is meant to process the value. it simply returns the entire value based on the criteria in the filter. So you would need to iterate through the array and use velocity template to modify the list values in email body.

Also, you might use more specific regex like /.*CN=External.*?/ if you want to omit the group names not containing External

[Karthikeyan_U (Karthikeyan Udhayasurian)]

Hi @salam1 ,

The simple filter $.attributes.memberOf[*] will return all the groups under the memberOf attribute. Or if you want to filter out more specific values, you need to use a more specific filter like Nitesh mentioned above.

Regards,
Karthi

[baoussounda (Ousmane N'DIAYE)]

@salam1

All

Hi @salam1 ,

You can do this in two steps.

• First Step : define a variable memberOfList in your Email Template context :

{
   "memberOfList.$": "$.attributes.memberOf[*]"
}

Here an example of how to define a template contexte variables :

• Second Step : in your email body iterate on memberOfList and retrieve only the group name

#set($groupNames = [])

#foreach($group in $memberOfList)
    #set($groupName = $group.replaceAll("^CN=|,.*$", ""))
    ${groupNames.add($groupName)}
#end

List of Groups :
#foreach($name in $groupNames)
    - ${name}
#end

Please let me if it work.

Note: You have the option to adapt your email body content based on your needs. The provided template demonstrates how to retrieve a list of groups into a new array. However, you can also choose to display the groups directly without creating a new array.

[officialamitguptaa (Amit Gupta)]

@salam1 -
In a nutshell, JSONPath filters (the ?[...] syntax) are meant to return or omit entire elements in an array based on a boolean match. They do not extract partial substrings via capture groups. That’s why your lookbehind regex ((?<=CN=)(.*?)(?:,OU)) is returning the full "CN=External,OU=..." string instead of just "External"—and often JSONPath engines simply don’t support lookbehind or match‐extraction at all.

Why your filter isn’t working as intended

1. Filters only return the whole item or no item
   For example:

$..memberOf[?(@ =~ /some-regex/)]

will either include or exclude each string in memberOf[] as a whole. You will never get back just the portion of the string that matched the capture group.

2. Lookbehind may not be supported
   Even if an engine supports a subset of regex, many do not allow lookbehind syntax ((?<= … )) or do not reliably capture sub‐matches.
3. You need a transform, not a filter
   JSONPath (at least in its canonical spec) does not have a built-in way to transform each element from "CN=External,OU=..." into simply "External".

How to get the group names

Because JSONPath won’t extract sub‐matches directly, you have two main approaches:

1. Pull the full array, then parse in a separate step

1. Use a simple JSONPath to collect all group strings:

$..attributes.memberOf[*]

That returns:

[
  "CN=External,OU=blur,OU=blur,DC=blur,DC=blur",
  "CN=All,OU=blur,DC=blur,DC=blur"
]

2. Strip out the “CN=” part and everything after the comma in a subsequent workflow step (e.g. using a “Regex Replace,” “Substring,” or “Split” function).

Bottom line

• JSONPath filter syntax (?[...]) is for boolean filtering, not substring extraction.
• Lookbehind and capturing groups typically aren’t supported in a way that returns only the captured text.
• Recommended approach: fetch the entire array with $..attributes.memberOf[*], then strip off the CN=... boilerplate in a second step (e.g. with a regex or split function in the workflow).

[salam1 (Shajedul Alam)]

Thank you! I will be trying this approach and analyze the results.

[salam1 (Shajedul Alam)]

Thank you! I will be trying this approach and analyze the results.
@officialamitguptaa