Using managerAttributeValue in Manager Correlation Rule

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello All,

I’m in the process of creating a manager correlation rule in ISC. I’m having trouble trying to understand how to use managerAttributeValue, as it is a Java Object instead of an Identity object. If I’m correlating based on the employeeId of the manager, how can I extract the manager’s employeeId from managerAttributeValue? Please take a look at the below code, specifically the last else block.

For some context, since the auth. source can contain multiple records for a given employee, some inactive with one active record for an employee, we only want to pull the manager from the active record. The last else block is the case where we would want to just keep the current manager value that is on the Identity if the link is inactive.

import java.text.Normalizer;

import org.apache.commons.lang.StringUtils;
import sailpoint.object.Application;
import sailpoint.object.Field;
import sailpoint.object.Identity;
import sailpoint.server.IdnRuleUtil;
import sailpoint.tools.GeneralException;
import java.util.Map;
import sailpoint.object;
import java.lang.Object;


Map returnMap = new HashMap();

String managerId = link.getAttribute("supervisorId");

if (managerId == null) {
  if (managerAttributeValue == null) {
    return null;
  } else {
    //If we don't have any manager info coming in from UKG
    //but the identity does have a value for manager, then just use the currently assigned value
    returnMap.put( "identityAttributeName", "employeeId");
    returnMap.put( "identityAttributeValue", managerAttributeValue);
    return returnMap;
  }
}

//If the manager field is empty, we know that this is the first time we see a link under this identity. 
//We assign the manager based on the info we see in the current link processed under an identity
if (managerAttributeValue == null) {

  returnMap.put( "identityAttributeName", "employeeId");
  returnMap.put( "identityAttributeValue", managerId );
  

  //We only want to overwrite the manager correlation if the link is active
} else if (link.getAttribute("isactive") == "TRUE") {

  returnMap.put( "identityAttributeName", "employeeId");
  returnMap.put( "identityAttributeValue", managerId );
  
} else {
  //Else link is inactive, but identity of link has a value for manager. 
  //So we just pass what is currently on the identity for manager
  returnMap.put( "identityAttributeName", "employeeId");
  returnMap.put( "identityAttributeValue", managerAttributeValue);
}

return returnMap;
2

Depending on the data lifecycle and requriement(s) you have on the inactive records, you may want to consider filtering them to a different source. i.e. Keeping the Active record with your current source. That will make your manager correlation code-less, I would think. This approach, may / may not work well with your overall implementation depending on other requirements you may have.