Workflow - Identity trigger that checks on multiple conditions

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi,

We have a usecase that we need a trigger when the lifecyclestatus goes from active to leaver or from active to left. is this possible?

2

Yes, you should be able to handle that configuring the workflow to trigger on Identity Attribute Change with Attribute to Filter set to cloudLifecycleState. Within your workflow you can have multiple Compare String Operator Step to check for $.trigger.changes[?(@.attribute == “cloudLifecycleState”)].newValue

3

Yes. Try something like this.

$.changes[?(@.attribute == "lifecyclestatus" && ((@.newValue=="leaver" && @.oldValue=="active") || (@.newValue=="left" && @.oldValue=="active")))]

Thanks

4

previous.lifecycleState == “active” &&
(current.lifecycleState == “leaver” || current.lifecycleState == “left”)
check this.

5

Hi @papie66 ,

Yes, it is possible to create a workflow trigger when an identity’s lifecycle status changes. You can use the Identity Attribute Changed trigger for this purpose. This trigger fires after one or more identity attributes have changed, including changes to the lifecycle state.

To set up a trigger specifically for lifecycle state changes from active to leaver or left, you would need to configure the trigger with a filter. You can use JSONPath to create a filter that checks for the specific lifecycle state change you’re interested in. Using the filter you can achieve it, for your specific use case:

$.changes[?(@.attribute == "cloudLifecycleState" && @.oldValue == "active" && (@.newValue == "leaver" || @.newValue == "left"))] → change the attribute value as yours (identity attribute’s - technical name)

This filter would cause the Identity Attribute Changed trigger to fire only when the cloudLifecycleState attribute changes from “active” to either “leaver” or “left”.

Once the trigger fires, you can then configure a workflow to perform whatever actions are necessary for your leaver process.