Using idn.getFirstAccount() in Identity Attribute Rule

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi experts,

I have an identity attribute rule that manipulates an identity attribute after checking for the accounts correlated to the identity.

The pseudocode logic for my rule is as follows:

*attribute = source 1, source 2, source 3*

attributeList = attribute.split();
for (attribute : attributeList) {
if (idn.getFirstAccount() for source 1) => remove 'source 1' from attribute list
if (idn.getFirstAccount() for source 2) => remove 'source 2' from attribute list
if (idn.getFirstAccount() for source 3) => remove 'source 3' from attribute list

return attributeList .join()

So an e.g. would be:
initial attribute value = source 1, source 2, source 3
accounts correlated to identity:
source 1
source 2

for the above case, rule will return attribute value = source 1, source 2

This rule works fine for most of my connector types. However there are 2 source types that do not work:

  1. JDBC Connector Type
  2. SQL Loader Connector Type

Not sure if ‘getFirstAccount()’ is the wrong way to check if these accounts are really correlated to the identity in this case… Pretty new to identity attribute rule, any help would be much appreciated!!

2

Yes, the idn.getFirstAccount(,) would get the first account and only if it is correlated, otherwise it would not show up on the identity itself.

I assume you are already aware of this:

In general it is good to be aware of this:

Especially the distinction between cloud and connector executed rules.

1 Like
3

Hi @mingsiewang

Of course getFirstAccount method works for all the connector sources. Check if some issue is there with the identity you are testing, maybe it is a data issue.

There is lack of clarity in using sourceName in getting account whether to use [source] appended, for example if your source name is HR then in

Account acct = idn.getFirstAccount("HR [source]", identity.getName());

Last thing I would like to inform you is, you don’t need to depend on Rule for this requirement. I know Rule is more flexible in writing complex logics compared to Transform, but you need to depend on SailPoint Expert Services for any change or if you would like to know what is happening.

Due to that, we avoid developing cloud Rules unless there is no other way. You can develop a static transform and get the account details, check this post.
Display multiple account id using transform - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community

Thanks
Krish

4

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.