CompoundFilter

[#1]

• Introduction
• Search versus filter
• Basic syntax
• Filter
• CompositeFilter
• Examples
• Further reading

Introduction

The CompoundFilter object is used in several places within IdentityIQ to select or filter data. An example of its use is in policy rules in the the advanced policies. Another example is in assignment rules for roles. The CompoundFilter is a wrapper for a filter definition, but doesn't do any filtering itself.

Search versus filter

Filters in IdentityIQ are used for searching and for filtering. The way these filters are used is different for searching and filtering. While searching, only searchable attributes can be used. In case of an identity that is most of the standard attributes (name, id, correlated, assigned roles, detected roles, etc.) and identity or link extended attributes marked as searchable. If non-searchable attributes would be used the search would either take very long, since the data is not indexed, or result in an error. This also means that while searching one cannot search for account attribute values, since these are not indexed as part of the identity.

When filtering, IdentityIQ iterates over a list of objects, like Identities, and any readable attribute can be extracted and compared. Any matching object will be returned. In this case the filter can look at object attributes, but also at attributes of nested objects, like a link within an identity.

Basic syntax

A CompoundFilter, when represented as XML starts with <CompoundFilter> and ends with </CompoundFilter>.

<CompoundFilter>
  <!-- filter definition goes here -->
</CompoundFilter>

A CompoundFilter can contain a simple filter using a Filter object or a complex filter using a CompositeFilter object. Filters and CompositeFilters are explained in detail below. The simplest form of a CompoundFilter would look as follows.

<CompoundFilter>
  <Filter operation="EQ" property="attribute" value="value"/>
</CompoundFilter>

If the filter refers to application links (account attributes), a section with application references can be added:

<CompoundFilter>
  <Applications>
    <Reference class="sailpoint.object.Application" name="LDAP"/>
  </Applications>
  <!-- filter definition goes here -->
</CompoundFilter>

Filters refer to these applications using a number and colon as a prefix for the attribute. The number is the ordinal number of the application in the list, starting with 0. In the example LDAP is referred to as 0:, a second application as 1:., the next as 2:, etc.

<CompoundFilter>
  <Applications>
    <Reference class="sailpoint.object.Application" name="LDAP"/>
  </Applications>
  <Filter operation="EQ" property="0:memberOf" value="cn=myGroup, ou=groups, dc=example, dc=com"/>
</CompoundFilter>

Instead of using the numerical references, it is also possible to use the name of the application.

<CompoundFilter>
  <Filter operation="EQ" property="LDAP:memberOf" value="cn=myGroup, ou=groups, dc=example, dc=com"/>
</CompoundFilter>

The best reason for using a reference is that, when saved, IdentityIQ will automatically fill in the id of the application. Whenever the name of the application changes, the reference stays intact. When using a name for the prefix, this relation is lost and the filter will no longer work.

Filter

Filter tags can have the following attributes and values. Only the most commonly used are mentioned here.

Attribute	Value	Explanation
operation	EQ	Checks whether the property is equal to the specified value. This operation is used for text strings and numeric values.
	NE	Checks whether the property is unequal to the specified value. This operation is used for text strings and numeric values.
	LT	Checks whether the property is less than the specified value. This operation is used for text strings and numeric values.
	GT	Checks whether the property is greater than the specified value. This operation is used for text strings and numeric values.
	LE	Checks whether the property is less than or equal to the specified value. This operation is used for text strings and numeric values.
	GE	Checks whether the property is greater than or equal to the specified value. This operation is used for text strings and numeric values.
	IN	Checks whether the string or numeric property is in the specified list. Example: <Filter operation="IN" property="0:teamcode"> <Value> <List> <String>t101</String> <String>t102</String> </List> </Value> </Filter>
	CONTAINS_ALL	Checks whether the list type (multi-valued) property contains all of the values specified in the <Value> tag. Example: <Filter operation="CONTAINS_ALL" property="teams"> <Value> <List> <String>t101</String> <String>t102</String> </List> </Value> </Filter>
	LIKE	Checks whether the property's value is like the string specified as value. This operation is used together with the matchMode attribute.
	NOTNULL	Matches if the specified property has any value.
	ISNULL	Matches if the specified property has no value.
	ISEMPTY	Matches if the specified multi-valued property (list type) has no items or is null.
	JOIN	See below (joinProperty). Example: <Filter operation="JOIN" property="id" joinProperty="ManagedAttribute.owner.id"/>
matchMode	ANYWHERE	Combined with operation LIKE this mode will test for  the value anywhere in the value of the property. The attribute matchMode has no meaning with other operations.
	START	Combined with operation LIKE this mode will test whether the value of the property starts with the specified value.
	END	Combined with operation LIKE this mode will test whether the value of the property end with the specified value.
	EXACT	This mode will make the operation LIKE behave like EQ and test for an exact match of value and property.
ignoreCase	true or false	Set to true to compare string values case insensitively. The default is false. Example: <Filter operation="EQ" ignoreCase="true" property="department" value="HR"/>
property		The identity attribute or, when prefixed with an application name or reference number, account attribute to be matched. Note that filtering account attributes will not work in search operations.
value		The value to be matched. This attribute can only be used for string, numeric and boolean values. For other types of values, the <Value> tag needs to be used. For example for lists, this would look like: <Value> <List> <String>A</String> <String>B</String> </List> </Value>
joinProperty		The joinProperty attribute is used with operation JOIN and specifies the object type and property to match the property's value. Example: <Filter operation="JOIN" property="id" joinProperty="ManagedAttribute.owner.id"/>

CompositeFilter

The CompositeFilter is used to combine Filter and other CompositeFilter objects using a logical and or or operation, or to negate the contained Filter's result. The operation to apply is specified by the operation attribute.

Operation	Explanation
AND	Apply a logical and on the included Filters or CompositeFilters. A match is found if all included Filters and/or CompositeFilters match. <CompositeFilter operation="AND"> <Filter operation="EQ" property="0:memberOf" value="cn=myFirstGroup, ou=groups, dc=example, dc=com"/> <Filter operation="EQ" property="0:memberOf" value="cn=mySecondGroup, ou=groups, dc=example, dc=com"/> </CompositeFilter>
OR	Apply a logical or on the included Filters or CompositeFilters. A match is found if any of the included Filters and/or  CompositeFilters matches. <CompositeFilter operation="OR"> <Filter operation="EQ" property="0:memberOf" value="cn=myFirstGroup, ou=groups, dc=example, dc=com"/> <Filter operation="EQ" property="0:memberOf" value="cn=mySecondGroup, ou=groups, dc=example, dc=com"/> </CompositeFilter>
NOT	Apply a logical not on the included Filter or CompositeFilter (only one!). A match is found if the included Filter or CompositeFilter does not match. <CompositeFilter operation="NOT"> <Filter operation="EQ" property="0:memberOf" value="cn=myGroup, ou=groups, dc=example, dc=com"/> </CompositeFilter>

Examples

More examples are presented in Examples of XML for a CompoundFilter in the UI.

Further reading

Also see:

• Filters and Filter Strings
• IdentitySelectors in the IdentityIQ User Interface​
• DTD Information​

[hcharlebois]

I just did some testing regarding this "Method" (application reference). It's there a way for this method to consider all the application's accounts ? Seems like IIQ only analyse the first application account.

[hiui]

Hi Everyone,

I am trying to set up Compound Filter, and I am having issue with the application name.  Please help.

<CompoundFilter>
<CompositeFilter operation="OR">
<Filter operation="NOTNULL" property="aaccount"/>
<Filter operation="EQ" property="links.application.name" value="DUO"/>
</CompositeFilter>
</CompoundFilter>

Thanks.

[hcharlebois]

Is "aaccount" an identity attribute?

Otherwise you need to reference your application first..

<CompoundFilter>
  <Applications>
    <Reference class="sailpoint.object.Application" name="DUO"/>
  </Applications>
  <CompositeFilter operation="AND">
    <Filter operation="NOTNULL" property="0:aacount"/>

</CompositeFilter>
</CompoundFilter>

[hiui]

Hi hcharlebois,

Thank you for your respond.

Yes "aacount" is identity attribute, and when I just filter the identity attribute is working but the "link.appliction.name" filter is not working.

What I am try to do is to check if the user has aacount or has application "DUO"

[hcharlebois]

You need link collection to use the application.name proprety

<Filter operation="COLLECTION_CONDITION" property="links">

<CollectionCondition>

<CompositeFilter operation="AND">

<Filter operation="EQ" property="application.name" value="DUO"/>

</CompositeFilter>

</CollectionCondition>

[hiui]

Thank you, that works.

[superjb]

Just for info if you want to test on boolean by example inactive it's like that:

<Filter operation="EQ" property="inactive">
<Value>
<Boolean></Boolean>
</Value>
</Filter>

if you put <Filter operation="EQ" property="inactive"  value="false"/> it will not work.

[swapniljadhav]

Can we setup compound filter in Rule? if yes any example.