Skip to main content

Correlation Rule

Overview

This rule associates or correlates an account to an identity, based on complex logic.

Execution

  • Cloud Execution - This rule executes in the IdentityNow cloud, and it has read-only access to IdentityNow data models, but it does not have access to on-premise sources or connectors.
  • Logging - Logging statements are currently only visible to SailPoint personnel.

Rule Execution

Input

ArgumentTypePurpose
logorg.apache.log4j.LoggerLogger to log statements. Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint.
idnsailpoint.server.IdnRuleUtilProvides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in IdnRuleUtil.
accountsailpoint.object.ResourceObjectRead-only representation of account data that has been aggregated. Use this as a basis to determine correlation linkages with a specific identity.

Output

ArgumentTypePurpose
returnMapjava.util.MapMap object containing a reference to the identity attributes to correlate to. These should contain both identityAttributeName and identityAttributeValue as keys.

Template

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Rule name="Example Rule" type="Correlation">
<Description>Describe your rule here.</Description>
<Source><![CDATA[

// Add your logic here.

]]></Source>
</Rule>

Example - Correlate Account to Identity Based on Calculated Email Address

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Rule name="Example Rule" type="Correlation">
<Description>Correlates based on a calculated email address.</Description>
<Source><![CDATA[

Map returnMap = new HashMap();

String calculatedEmail = account.getStringAttribute( "username" ) + "@example.com";

returnMap.put( "identityAttributeName", "email");
returnMap.put( "identityAttributeValue", calculatedEmail );

return returnMap;

]]></Source>
</Rule>