Best Practices: Provisioning Multi-Valued Attributes

Overview

During provisioning or when creating new accounts, sometimes you need to set multi-valued attributes. For example, if you are creating an LDAP account, you might need to set a value of an 'objectclass' attribute to contain multiple values pertaining to the class(es) of the user account you are creating.

IdentityNow has native support for multi-valued account attributes at provisioning time, and this is a nice alternative to having to implement rules to generate multi-valued array lists. This document illustrates how you might configure this feature for your implementation.

In order to configure multi-valued account attributes, you need to leverage the Source Provisioning Policies APIs, as it requires some advanced configuration settings which are not currently available in the IdentityNow user interface.

Note: This document assumes you are familiar with updating source account profiles via REST API.

Configuration

First, make an account profile attribute multi-valued by adding the following:

"multi": true,

This enables the attribute to be defined as a multi-valued attribute, which is essentially a list, or array, of string values.

Second, set the mapping or transform to return a delimited list of values. This can be done many ways, including concat transforms, generator rules, or even just static transforms. For example, here is a static transform which returns a list of two values, User and Person, which are delimited by a comma. You can use other (non-comma) delimiters as well.

"transform": { "attributes": { "value": "User,Person" }, "type": "static"},

Last, inform the account profile attribute how to parse the delimited list of values. This is done by specifying a cloudDelimiter property in the attributes section of the account profile attribute, as follows:

"attributes": { "cloudDelimiter": ","},

Putting these steps together, your account profile attribute might look something like this:

{ "attributes": { "cloudDelimiter": ","}, "isRequired": false, "multi": true, "name": "objectclass", "transform": { "attributes": { "value": "User,Person" }, "type": "static"}, "type": "string"}

This example takes the value of "User,Person" and converts it to a multi-valued list of "User" and "Person."

Troubleshooting

If your multi-valued account attributes are not working as expected, verify the configuration via Source Provisioning Policies REST APIs:

• Verify multi is present and set to true.
• Verify transform is present and returning a delimited-list of values.
• Verify attributes is present and contains a cloudDelimiter representing the character delimiting the values returned from transform.