Workflow for attribute change -> Certification Creation BUT - exclude new hires!

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

We have dug thru posts and have tried a few things, we have a working workflow that says, if this department id changes, get the user, get their entitlements, and create a certification for their Manager to do, and activate it.

It does work, HOWEVER - we have new hire that are getting caught up in the workflow and that’s problematic as they don’t have entitlements except standard birthrights.

How can I exclude them effectively?
We have tried within the TRIGGER - to do it.
$.changes[?(@.attribute == “jobCodeDepartment”)][?(@.employeeStatus != “contingent” || @.startDate <“now-15d”)], but it does not seem to look at this.

I think I need to do a filter at another level, but it’s not clicking for me. So open to all suggestions! TIA!

image
image714×690 46.1 KB

2 Likes
2

You have used || that will return true when any one of the conditions is true

I was just wondering if you want to have records where any one of these conditions is (or both are) true…
or do you want to select records only when both are true? I think it should be latter

2 Likes
3

I do not want users who are in a prehire status (contingent) and/or if they started today or the last 15 days. cloudLifeCycles available are prehire, active, loa, inactive. attribute to users is startDate where the value on the date is MM-DD-YYYY.

2 Likes
4

Identity Attributes Changed won’t have full identity info… I suggest you try this approach…

Apply the filter $.changes[?(@.attribute == “jobCodeDepartment”)] to Identity Attributes Changed trigger

And add a Get Identity Action element right after above trigger, which will use identity.id to get the full identity info. Then you can have 2 Compare Strings to check each of the conditions employeeStatus != "contingent" & startDate <"now-15d" based on the right Identity Attributes

4 Likes
5

Thank you! We are gonna try this :slight_smile: Will let ya know!

2 Likes
6

My idea is a bit similar to what Nithesh suggested.
You need to add a new step of getIdentity immediately after the Wait
This will get you all the values for that identity, now put up a compare string and then filter it with the LCS states you want to be allowed and then another date compare if you need.
But just a single LCS compare should do the trick.

3 Likes
7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.