Unique Account Attribute Generation with Future Edit functionality

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
3

Hi @ACoutinho , You can configure before provisioning cloud rule here and inside rule only you can check the uniqueness of display name with the help of below method.

public boolean isUnique(String displayName) throws GeneralException {
    return !idn.accountExistsByNativeIdentity(application.getName(), displayName);
}

you can create a separate method for iteration for unique counter something like.


public String updateDisplayname(String displayname_identity, int iteration) {
    String Displayname_temp = "";
    int maxIteration = 30;
    if (displayname_identity != null)) {
        Displayname_temp = displayname_identity + iteration";
    }
    String dn = Displayname_temp;

    if (iteration <= maxIteration) {
        if (isUnique(dn)) {
            return Displayname_temp;
        } else {
            return updateDisplayname(displayname_identity, iteration + 1);
        }
    } else {
        return null;
    }
}

here you can get the displayname or firstname and lastname identity attribute from plan :

String displayName = StringUtils.trimToNull(plan.getIdentity().getAttribute("displayName"));

so for account creation you will get the unique displayName with this method. you can pass the value of displayName from the plan itself.

For attribute sync:

since your displayName is combination of firstname and lastname if any change occurs in these attribute then only you have to sync your displayName to the account. so that also you can handle from cloud rule as inside the accountRequest you can get the attribute list from there you can check if firstname or lastname mismatch there between identity attribute and account attribute then again you can use the same methods we have create for create account and can implement the attribute sync functionality.

Note: we can customize it on identity attribute generator rule as well but as per my understanding there is a gap because displayName uniqueness should be checked on AD accounts level otherwise it may give the object already exist exception from AD.

please find some URL for reference:

Github Sample BeforeProvisioning Rule

I hope this helps!