The CompoundFilter object is used in several places within IdentityIQ to select or filter data. An example of its use is in policy rules in the the advanced policies. Another example is in assignment rules for roles. The CompoundFilter is a wrapper for a filter definition, but doesn't do any filtering itself.
Filters in IdentityIQ are used for searching and for filtering. The way these filters are used is different for searching and filtering. While searching, only searchable attributes can be used. In case of an identity that is most of the standard attributes (name, id, correlated, assigned roles, detected roles, etc.) and identity or link extended attributes marked as searchable. If non-searchable attributes would be used the search would either take very long, since the data is not indexed, or result in an error. This also means that while searching one cannot search for account attribute values, since these are not indexed as part of the identity.
When filtering, IdentityIQ iterates over a list of objects, like Identities, and any readable attribute can be extracted and compared. Any matching object will be returned. In this case the filter can look at object attributes, but also at attributes of nested objects, like a link within an identity.
A CompoundFilter, when represented as XML starts with <CompoundFilter> and ends with </CompoundFilter>.
<CompoundFilter>
<!-- filter definition goes here -->
</CompoundFilter>
A CompoundFilter can contain a simple filter using a Filter object or a complex filter using a CompositeFilter object. Filters and CompositeFilters are explained in detail below. The simplest form of a CompoundFilter would look as follows.
<CompoundFilter>
<Filter operation="EQ" property="attribute" value="value"/>
</CompoundFilter>
If the filter refers to application links (account attributes), a section with application references can be added:
<CompoundFilter>
<Applications>
<Reference class="sailpoint.object.Application" name="LDAP"/>
</Applications>
<!-- filter definition goes here -->
</CompoundFilter>
Filters refer to these applications using a number and colon as a prefix for the attribute. The number is the ordinal number of the application in the list, starting with 0. In the example LDAP is referred to as 0:, a second application as 1:., the next as 2:, etc.
<CompoundFilter>
<Applications>
<Reference class="sailpoint.object.Application" name="LDAP"/>
</Applications>
<Filter operation="EQ" property="0:memberOf" value="cn=myGroup, ou=groups, dc=example, dc=com"/>
</CompoundFilter>
Instead of using the numerical references, it is also possible to use the name of the application.
<CompoundFilter>
<Filter operation="EQ" property="LDAP:memberOf" value="cn=myGroup, ou=groups, dc=example, dc=com"/>
</CompoundFilter>
The best reason for using a reference is that, when saved, IdentityIQ will automatically fill in the id of the application. Whenever the name of the application changes, the reference stays intact. When using a name for the prefix, this relation is lost and the filter will no longer work.
Filter tags can have the following attributes and values. Only the most commonly used are mentioned here.
Attribute | Value | Explanation |
---|---|---|
operation | EQ | Checks whether the property is equal to the specified value. This operation is used for text strings and numeric values. |
NE | Checks whether the property is unequal to the specified value. This operation is used for text strings and numeric values. | |
LT | Checks whether the property is less than the specified value. This operation is used for text strings and numeric values. | |
GT | Checks whether the property is greater than the specified value. This operation is used for text strings and numeric values. | |
LE | Checks whether the property is less than or equal to the specified value. This operation is used for text strings and numeric values. | |
GE | Checks whether the property is greater than or equal to the specified value. This operation is used for text strings and numeric values. | |
IN |
Checks whether the string or numeric property is in the specified list. Example:
|
|
CONTAINS_ALL |
Checks whether the list type (multi-valued) property contains all of the values specified in the <Value> tag. Example:
|
|
LIKE | Checks whether the property's value is like the string specified as value. This operation is used together with the matchMode attribute. | |
NOTNULL | Matches if the specified property has any value. | |
ISNULL | Matches if the specified property has no value. | |
ISEMPTY | Matches if the specified multi-valued property (list type) has no items or is null. | |
JOIN |
See below (joinProperty). Example:
|
|
matchMode | ANYWHERE | Combined with operation LIKE this mode will test for the value anywhere in the value of the property. The attribute matchMode has no meaning with other operations. |
START | Combined with operation LIKE this mode will test whether the value of the property starts with the specified value. | |
END | Combined with operation LIKE this mode will test whether the value of the property end with the specified value. | |
EXACT | This mode will make the operation LIKE behave like EQ and test for an exact match of value and property. | |
ignoreCase | true or false |
Set to true to compare string values case insensitively. The default is false. Example:
|
property | The identity attribute or, when prefixed with an application name or reference number, account attribute to be matched. Note that filtering account attributes will not work in search operations. | |
value |
The value to be matched. This attribute can only be used for string, numeric and boolean values. For other types of values, the <Value> tag needs to be used. For example for lists, this would look like:
|
|
joinProperty | The joinProperty attribute is used with operation JOIN and specifies the object type and property to match the property's value. Example:
|
The CompositeFilter is used to combine Filter and other CompositeFilter objects using a logical and or or operation, or to negate the contained Filter's result. The operation to apply is specified by the operation attribute.
Operation | Explanation |
---|---|
AND |
Apply a logical and on the included Filters or CompositeFilters. A match is found if all included Filters and/or CompositeFilters match.
|
OR |
Apply a logical or on the included Filters or CompositeFilters. A match is found if any of the included Filters and/or CompositeFilters matches.
|
NOT |
Apply a logical not on the included Filter or CompositeFilter (only one!). A match is found if the included Filter or CompositeFilter does not match.
|
More examples are presented in Examples of XML for a CompoundFilter in the UI.
Also see:
I just did some testing regarding this "Method" (application reference). It's there a way for this method to consider all the application's accounts ? Seems like IIQ only analyse the first application account.
Hi Everyone,
I am trying to set up Compound Filter, and I am having issue with the application name. Please help.
<CompoundFilter>
<CompositeFilter operation="OR">
<Filter operation="NOTNULL" property="aaccount"/>
<Filter operation="EQ" property="links.application.name" value="DUO"/>
</CompositeFilter>
</CompoundFilter>
Thanks.
Is "aaccount" an identity attribute?
Otherwise you need to reference your application first..
<CompoundFilter>
<Applications>
<Reference class="sailpoint.object.Application" name="DUO"/>
</Applications>
<CompositeFilter operation="AND">
<Filter operation="NOTNULL" property="0:aacount"/>
</CompositeFilter>
</CompoundFilter>
Hi hcharlebois,
Thank you for your respond.
Yes "aacount" is identity attribute, and when I just filter the identity attribute is working but the "link.appliction.name" filter is not working.
What I am try to do is to check if the user has aacount or has application "DUO"
You need link collection to use the application.name proprety
<Filter operation="COLLECTION_CONDITION" property="links">
<CollectionCondition>
<CompositeFilter operation="AND">
<Filter operation="EQ" property="application.name" value="DUO"/>
</CompositeFilter>
</CollectionCondition>
Thank you, that works.
Just for info if you want to test on boolean by example inactive it's like that:
<Filter operation="EQ" property="inactive">
<Value>
<Boolean></Boolean>
</Value>
</Filter>
if you put <Filter operation="EQ" property="inactive" value="false"/> it will not work.
Can we setup compound filter in Rule? if yes any example.