IdentityNow Transforms - Lookup

[#1]

The transform documentation listed here is outdated and is nonger actively maintained. Please refer to https://developer.sailpoint.com/idn/docs/transforms for IdentityNow Transform documentation.

[gadiparthiv]

Hi @hari_patel 

Hope you're doing great.

We're planning to use this lookup transform, to format incoming data and pass it to downstream apps. Is there a limit on the size of the table we define in this transform (We may need to have 500-1000 rows in the table). Also, If there is a way of defining a table without size limit in IDN and having the transform do lookup from that table, I will follow that approach.

Thanks in advance.

[Abhinov]

@gadiparthiv I think we can.

In one of our use case we used around 2000+ rows.

-Abhinov

[neil_mcglennon]

SailPoint recommends keeping the table to be 100 entries or less. While there are technically no hard size constraints on the number of keys and values, the larger these objects are they more difficult to maintain and use, and larger tables can slow down transform fetching and calculation. 

We have seen customers have a 1000 or more.  Its not ideal, but it will work... slower.

[ethompson]

@neil_mcglennonDoes the lookup transform perform like a hash table or a switch statement? Also does it need to be loaded for each user or is it loaded one time then applied to all of the users?

[khalilgahbiche]

Hi @neil_mcglennon ,

I need to use this transform and check if the value is empty, otherwise I use default. It seems not to be working. Do you have any idea about how to do it ?

Thanks.

[Florian81]

Same here. I would also like to have empty-string "" or NULL or "empty_or_null" as an option. How do I do that? That doesn't seem like a far fetched feature.

[khalilgahbiche]

Hi @Florian81 ,

I finally used the « Static » type transform with the « firstValid » option. Basically, you specify your source attribute and, if not set, you can define a static value, and compare on it on the « value » attribute.

[Florian81]

Hi @khalilgahbiche 

Thank you for your insight. Seems like a feasible workaround. I would prefer though, if we had the option to do it "right" within the lookup-table.

my 2 cents

[khalilgahbiche]

@Florian81 ,

If you're interested, here's what I did : 

{
	"name": "<name_here>",
	"type": "static",
	"attributes": {
		"<attribute_name_here>": {
			"attributes": {
				"values": [
					{
						"attributes": {
							"sourceName": "<source_name_here>",
							"attributeName": "<attribute_name_here>"
						},
						"type": "accountAttribute"
					},
					"0"
				]
			},
			"type": "firstValid"
		},
		"value": "#if($<attribute_name_here>==0)#Value1{else}Value2#end"
	}
}

Keep me posted if you find how to do it with Lookup transform  

Thanks.

[Irshaad_Laher_WS]

@Florian81, @khalilgahbiche 

You can use a combination of first valid and lookup transforms.

You can use your first valid transform as your input into the lookup table, here is an example:

{
    "attributes": {
        "input": {
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "attributeName": "attribute1",
                                    "sourceName": "Source1"
                                },
                                "type": "accountAttribute"
                            },
                            "0"
                        ]
                    },
                    "type": "firstValid"
                }
                    ,
        "table": {
            "0": "Value 1",
            "default": "Value 2"
        }
    },
    "id": "Lookup with first valid input",
    "type": "lookup"
}

[khalilgahbiche]

Hi @Irshaad_Laher_WS ,

I'll definitely test it, and if it works, it'll be awesome

Thanks for sharing this.

[sureshkumar_p123]

Is there a possibility to use $input in default key in the table like "default": "$input".  I have tried and it is not considering the $input value whenever the $input returns other than the key in the table.

Any suggerstions?

[ethompson]

@sureshkumar_p123Can you define the logic for input in the default value? In the example below, the accountAttribute transform type can be changed to fit your use case.

{
  "attributes": {
    "table": {
      "default": {
        "type": "accountAttribute",
        "attributes": {
          "attributeName": "location",
          "sourceName": "PeopleSoft"
        }
      },
      "512": "Austin",
      "281": "Houston",
      "214": "Dallas",
      "210": "San Antonio"
    }
  },
  "type": "lookup",
  "name": "Test Lookup Transform"
}

[sureshkumar_p123]

@ethompson Thank you for sharing, I have tried with Identity attribute on default which gives an error (Lookup table has no entry for input) when there is a new value which is not part of lookup table.

I am expecting the transform to return the department value by default from identity attribute when table key is not matching. 

Here is the transform:

{
    "name": "Dept Transform",
    "type": "lookup",
    "attributes": {
        "input": {
            "type": "replaceAll",
            "attributes": {
                "input": {
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "name": "department"
                                },
                                "type": "identityAttribute"
                            },
                            "None"
                        ]
                    },
                    "type": "firstValid"
                },
                "table": {
                    "[ ]": ""
                }
            }
        },
        "table": {
            "IT": "IT Team",
            "ACC": "Accounting",
            "None": "",
            "Default": {
                "type": "identityAttribute",
                "attributes": {
                    "name": "department"
                }
            }
        }
    },
    "internal": false
}

[ethompson]

@sureshkumar_p123  Make sure default is all lowercase. Is this transform being used on an Identity or Account attribute? It is not recommended to use the identityAttribute type for other Identity Attributes due to its multi threaded nature. I would recommend using accountAttribute type directly or if there is a transform on the department attribute, using reference in that case.

[sureshkumar_p123]

@ethompson I have made the changes and it works perfectly. Thank you again!! Below is the transform for the reference.

{
    "name": "Dept Transform",
    "type": "lookup",
    "attributes": {
        "input": {
            "type": "replaceAll",
            "attributes": {
                "input": {
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "id": "Generate department"
                                },
                                "type": "reference"
                            },
                            "None"
                        ]
                    },
                    "type": "firstValid"
                },
                "table": {
                    "[ ]": ""
                }
            }
        },
        "table": {
            "IT": "IT Team",
            "ACC": "Accounting",
            "None": "",
            "default": {
                "attributes": {
                    "id": "Generate department"
                },
                "type": "reference"
            }
        }
    },
    "internal": false
}

[aakanksha]

@sureshkumar_p123 I have a similar requirement, to look for different attributes on the same source and do lookups based upon the first valid result. Wrote something but I am getting 403 forbidden. Can you please help here

{

    "attributes": {

        "input": {

            "attributes": {

                "values": [

                    {

                        "attributes": {

                            "sourceName": "HR",

                            "attributeName": "DEPARTMENT"

                        },

                        "type": "accountAttribute"

                    },

                    {

                        "attributes": {

                            "sourceName": "HR",

                            "attributeName": "DIVISION"

                        },

                        "type": "accountAttribute"

                    }

                ]

            },

            "type": "firstValid"

        },

        "table": {

            "DI-ABCD": "ACCS",

            "DI-LIBR": "LIBR",

            "DI-WERD": "WERD",

            "RC-ACFI": "ACFI",

            "RC-LYBR": "TEST",

            "RC-WERD": "WERK",

            "default": "default"

        }

    },

    "type": "lookup",

    "name": "deptcode Lookup Transform"

}

[sureshkumar_p123]

@aakanksha The transform looks good, seems issue is the credential to create a transform. Are you using Admin credential to create the transform?