Workflow GetAccounts Query

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Team,

I am creating a workflow to check if any user having source, say “AD” is in disabled state, then update it to enable state when IdentityAttribute change happened. After “Get Account” action, I am using “Check Account State“ with below json to check if true or false. But it is always evaluating to FALSE.

Tried different paths like below:-

$.getAccounts.accounts[?(@.attributes.sourceName == ‘AD’ && @.attributes.disabled == true)].attributes.disabled[0]

$.getAccounts.accounts[?(@.sourceName == ‘AD’)].IIQDisabled

$.getAccounts.accounts[?(@.sourceName == ‘AD’)].disabled

Am I missing something? User can have multiple sources like Entra, Azure etc.

But

2

Hi,

You can user $.getAccounts.accounts[?(@.sourceName == ‘AD’)].disabled and compare boolean instead of compare strings.

I tried in workflow and its working fine.

Check and let me know if you still cannot work.

-Abhinov

1 Like
3

Thanks, let me try and confirm on this.

4

I tried it but didn’t worked. Below is what the input it (masked and removed other variables). Since this user has multiple sources so wondering if the json path is correct or not.

Tried:

image
image525×288 9.59 KB

Input for Step logs:

“getAccounts”: {
“accounts”: [
{
“attributes”: {
“IIQDisabled”: “true”,
“IIQLocked”: false,
“accountEnabled”: true,
“city”: “xyz”,
“country”: “xyz”,
“department”: “Uxxxxxth”,
“dirSyncEnabled”: true,
“disabled”: true,
“sourceName”: “NONAD-Source”,
“systemAccount”: false,
“type”: null,
“uncorrelated”: false,
“uuid”: null
},
{
“attributes”: null,
“uuid”: null
},
{
“attributes”: {
“disabled”: true,
“sourceName”: “AD”,

          "systemAccount": false,
          "type": null,
          "uncorrelated": false   }}}]}
5

Hi,

Attached the workflow which worked fine for me. Hope this helps.

IDNAttributeschanged20250813.json (1.8 KB)

-Abhinov

7

Thanks, it worked :slight_smile: Now I will be setting up based on search query.

8

Have you done that before? Picking users from search query or based on specific lifecycle state (like user moved from disabled to active state) and then it will enable the source account. That would be helpful :slight_smile:

9

If you want to enable account when they changed LCS then you can add it in provisioning tab, No need of workflow.

-Abhinov

10

Yes, I have that option and putting it to test.

QQ, if user does not have that source assigned yet, will system tried to create it when that lifecyclestate get processed?

11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.