PSA: New Transform Types Available for IdentityNow

Hey Folks!!!

Since the last time we chatted about transforms and had said we are in process of adding new types in future. Well.. here we are with few news ones fresh out of the oven!!!

They will greatly help you achieve your goals without the need of rules. Please do revisit them while doing your design or upliftment. The goal is to minimise dependency on rules and by using transforms it gives you more control over the testing and deployment process.

For some new noteworthy ones

The date math transform allows you to add, subtract and round components of a timestamp to or from an incoming value. It also allows you to work with a referential value of “now” to run operations against the current date and time instead of a fixed value.

Imagine using this for LCS calculation if simple or just to get some dates for different systems say 10 days in future or so.

The username generator transform allows you to specify logic to use when attempting to derive a unique value for an attribute in an account create profile, . Oftentimes this can be as simple as combining parts of a user’s name and/or HR data (e.g., firstName.lastName), but sometimes generator logic such as a uniqueness counter might be needed to find a unique value in the target system (e.g., firstName.lastName1 if firstName.lastName is already taken).

How about ditching an AttributeGenerator rule and using this? 

The UUID generator is a simple transform allows you to create a universal unique id (UUID) in the form of a 36-character string. The underlying code is written in such a way as to provide a 1 in 68,719,476,736 chance of creating a string that actually collides with another string within the tenant.

Generate UUID on the fly

The name normalizer transform allows you to clean or standardize the spelling of strings coming in from source systems. Most commonly, this pertains to names and other proper nouns, but the transform is not necessarily limited to those data elements.

Get rid of the WiERd CasINg

The get reference identity attribute transform is an out-of-the-box rule transform provided via SailPoint’s Cloud Services Deployment Utility rule. It allows you to easily get the identity attribute of another user from within a given identity’s calculation. As a convenience feature, the transform allows you to use “manager” as a referential lookup to the target identity.

Want the manager’s employee number, email, phone and other details listed easily on the profile?? so easy now!!!

And so many more added.. Do review the full list here and see what can benefit you from removing rules and going down the transform path

Goodbye CSV… Welcome NELM!!!

This has been long time coming and an ask from many clients. We wanted to have a UI interface to be able to create non employees like contractors etc directly inside IDN (as a source). These type of records might not generally come from an HR source and are maintained directly in AD or other such places. Thus, we have got a new type of source called NELM (Non Employee Lifecycle Management) which has a UI interface where you can enter them. 

Currently its a two step release focusing on API based release happening over the weekend in the production orgs (already in your sandbox). Read more about it in this article.

You can

  • Have multiple sources – how about designing each via type like service account, contractors or say via departments? 
  • Approver for each creation – as above you can assign approvers per type or department and segregate.
  • Custom schema as per your liking
  • Manage these users as normal LCS and business rules like any other source.

Note: There is currently a launch limit of 20 NELM sources per org and 1000 identities per source. Also up-to 10 custom schema attributes. So take that into consideration of your design. I would see this lifted or eased in future as this is used more by customers.

Here is a screenshot of how it looks while creating a user for the source. 

 

A lot is currently via API but in a few months we will have more coming in UI.

You should start testing and possibly convert your csv sources and manual uploads of such users to a nice UI interface with better auditing and management. 

Let me know if any questions.

Edit: Documentation is live!!!

 

Terminology Comparison: MIM vs SailPoint IDN

So I’ve been learning SailPoint IdentityNow (IDN) and I am rattling my brains trying to match what I know about MIM and make sense in my brain and relate to the terms and how they are the same/similar but have different names in each product.

I have done up a little comparison table showing the most common things I have understood till date and tried to put it in words the way they are termed differently in MIM and IDN.

I am not an expert in either and not saying they are essentially correct or which product is better than other (btw there is no right answer to that – each have clear pros and cons depending on what you want in a product) but just trying to bridge the gap on understanding what they are in each.

MIMSailPoint IDN
Data TypeHas various like integer, string etc.Everything is defined as string essentially.
ConnectionDirect via MA which has config parameters.Done via a VA (Virtual Appliance) which is a lightweight custom Linux VM deployed at customer side (think of it as a secure tunnel from cloud IDN to your network).
Management Agents (MA)Individual connectors connected to sources.Called a Source - Downstream or upstream.
Connector Space (CS)Staging area for data in a connector.Shows up in the Accounts tab in the Source.
DisconnectorsObjects which had not connected to MV.Called "Uncorrelated Accounts" under the import data tab of the source.
Metaverse (MV)Where all the identities are connected to each MA and the fullest form of it in essence.Identity List which has links to all the sources.
Projection & ProvisioningEach MA has the rules and mappings to project a CS into MV and to the external source as well.Each Identity Profile has a mapping against a source and also provisioning rules. Sources which have an Identity Profile are also called Authoritative Source and ones which't don't are called Non-Authoritative.
Join RulesRules which join CS objects to MV based on defined criteria.Called "Correlation" in the Source where we define those criteria.
GroupsAD or MIM GroupsCalled Entitlements. It doesn't show groups as MIM does i.e. Group Management is not a thing. You do User Management with entitlements i.e. group membership.
ImportImporting objects from a connector to CS.Called "Account Aggregation" or "Entitlement Aggregation" which brings in the data.
AD Password Sync from DCDone via PCNSDone via PWI (Password Interceptor)
AD WriteDirect via ADMANeeds a domain joined computer with IQService installed.
Automation of logicSets / MPR and Workflows in MIM Portal.Does it via Access Profiles , Roles and Identity Profiles in IDN Portal.
Advance RulesDone via Workflows and other advanced methods like MIMWAL etc.Called Rules written in JAVA/BeanShell wrapped with XML.
Under the hood configLot of config is exported and modified in XML.Extensive API access mainly giving JSON outputs with few XML as well.

Feel free to correct me where I am wrong and / or if you want me to add something else or explain something more in details, do reach out.

Hopefully it made sense to someone!!!