Different Provisioning Plan based on conditions

Lifecycle & Governance
,
1

Hi,

I am working on implementing a very complex source in our environment, and there are two different account requirements. Some users have an email and would just easily be provisioned in that source with the email attribute set with their own.

For the majority of users, they do not have email. However an email address is required in the source so they get an email to set their password initially. To solve this, those accounts would have their email set to their manager’s.

Is there a way to create different CREATE provisioning plans based on this requirement? Or to possible tie a provisioning plan to a specific role or access profile?

2

Hi  @John_Hall

The following transform can be applied to the Create Profile’s password attribute:

{
  "id": "7158ad5c-16c9-4670-8d26-e3f4ecc09865",
  "name": "Test Email Gen",
  "type": "conditional",
  "attributes": {
    "expression": "$email eq No_Email",
    "positiveCondition": "$managerEmail",
    "negativeCondition": "$email",
    "email": {
      "attributes": {
        "values": [
          {
            "attributes": {
              "sourceName": "Workday Delimited File",
              "attributeName": "Email"
            },
            "type": "accountAttribute"
          },
          "No_Email"
        ]
      },
      "type": "firstValid"
    },
    "managerEmail": {
      "attributes": {
        "values": [
          {
            "attributes": {
              "name": "Cloud Services Deployment Utility",
              "operation": "getReferenceIdentityAttribute",
              "uid": "manager",
              "attributeName": "email"
            },
            "type": "rule"
          }
        ]
      },
      "type": "firstValid"
    }
  },
  "internal": false
}

Abhinav Mishra.

3

Hi Abhinav, this is exactly what I needed, very much appreciated!

For the sake of anyone else in a similar boat, we provision every account with an email address attribute even if they don’t actually get licensed in Office 365. So I took the code you provided and made it work with our set up.

{
            "name": "Email",
            "transform": {
                "type": "conditional",
                "attributes": {
                    "expression": "$ldap eq $ldapCheck",
                    "positiveCondition": "$managerEmail",
                    "negativeCondition": "$email",
                    "email": {
                        "attributes": {
                            "type": "identityAttribute",
                            "attributes": {
                                "name": "email"
                            }
                        }
                    },
                    "ldap": {
                        "type": "identityAttribute",
                        "attributes": {
                            "name": "mawmldap"
                        }
                    },
                    "ldapCheck": {
                        "attributes": {
                            "value": "OU=Non365"
                        },
                        "type": "static"
                    },
                    "managerEmail": {
                        "type": "identityAttribute",
                        "attributes": {
                            "name": "managerEmail"
                        }
                    }
                }
            }

Pretty much what I did was take the LDAP path of the active directory account and split it by comma delimeter using a transform in the identity profile. This gives me the attribute in this code “mawmldap”. It then uses the conditional you provided to check if it is equal to “OU=Non365” and sets the email attribute there.

Hope this helps anyone else, and thank you for your help!