Search Expressions

Definition

Search Expressions are a domain-specific language for searching objects (Managed Objects, Reporting collections…) or expressing constraints on them.

A Search Expression combines Property Expressions (e.g. firstName LIKE 'John*') and Functions with Logical Operators (AND, OR, NOT)

securityOrganization <<= 'Finance' AND hasRoleMatching(role IN ('sap_user', 'sap_admin'))

Property Expression

A Property Expression expresses a constraint on a single object property. For Managed Objects, these properties are the Object Attributes.

A Property Expression consists of a Property, an Operator, and one or more Values — for example, firstName = 'John'.

Expression operators

The table below lists all the available operators.

Dotted Property Paths

You can express constraints on referenced objects with dotted property paths manager.firstName

For example, for Manage Objects, manager.firstName = 'John' matches all the identities whose manager’s first name is John.

Logical Operators

Use the logical operators AND, OR and NOT to combine Search Expressions, including other logical expressions.
For example: (firstName = 'John' OR firstName = 'Jane') AND lastName = 'Doe'

The Empty Expression

The Empty Expression () is a special Expression matching everything. Its negation NOT () matches nothing.

Search Expression Functions

Search Expression Functions accept one or more Search Expressions as arguments. They are built-in tools for scenarios that a simple Search Expression cannot express:

• Search identities that have at least one Role Assignment matching a criterion: hasRoleMatching(role = 'someRole' AND status = 'ASSIGNED')

• Search identities that have a Security Organization matching a criterion: hasSecurityOrganizationMatching(id BELOW_OR_EQUALS 'europe' AND NOT (id BELOW_OR_EQUALS 'france'))

• Search identities that violate an SoD rule, or Role Assignments involved in an SoD violation: hasSodViolationMatching(rule = 'someSodRule')

• Search objects that have at least one risk facet row matching a dependency: hasRiskFacetMatching(dependencies EQUALS objectKind:objectId:Attribute)

• Role Request engine: find assignable Roles based on Role Request Policies.

• Object Recertification metadata: find the recertifications of an object: hasRecertificationMetadataMatching(recertifiedAt IN LAST 'P3M')

• Etc.

Usage

UI

In the user portal, Search Expressions are one of the two ways to search objects, alongside full-text search.

You can enter them graphically for simple expressions, or with a text DSL for complex cases:

Text DSL

Depending on the configuration, you can enter Search Expressions as plain text:

securityOrganization <<= 'Finance' AND hasRoleMatching(role IN ('sap_user', 'sap_admin'))

Property Expressions

Write Property Expressions as <property name> <operator> <value>:

firstName = 'John'

Syntax rules:

• The property name can be a single property (firstName) or a dotted property path (manager.securityOrganization.type).

• Quote property names with double quotes (") if they don’t start with a Latin letter or an underscore, or if they contain characters other than Latin letters and numbers, for example, "some \"weird\" property".

• Operators are the Formula Operators listed in the table above.

• Use parentheses for the IN and NOT IN operators, for example, firstName IN ('John', 'Jane').

• Use AND as the separator for the BETWEEN operator: enabledFrom BETWEEN '2022-01-01T00:00:00Z' AND '2023-01-01T00:00:00Z'.

• Quote string values with single quotes ('), for example, 'John \'Johnny\' Doe'.

• Write Date and Date & Time values as ISO 8601 strings, for example, '2022-11-04' or '2022-11-04T07:30:43Z'.

• Write numbers with the dot (.) as the decimal separator, for example, -42 or +43.756.

Operator Expressions

You can combine arbitrary Search Expressions with the AND, OR, and NOT operators, and with parentheses:

(securityOrganization <<= 'Finance' OR securityOrganization <<= 'Sales') AND hasRoleMatching(role IN ('sap_user', 'sap_admin'))

Functions

Global rules

Write Function Expressions as <function name>(<argument1>, <argument2>,...):

Syntax rules:

• Function names follow the same quoting rules as Property names

• Function arguments are always Search Expressions, separated by commas (,)

hasRoleMatching

The hasRoleMatching function searches identities that have at least one Role Assignment matching a criterion.
The arguments are the RoleAssignment attributes: role, identity, source, parentAssignment, …

hasRoleMatching(role = 'someRole' AND status = 'ASSIGNED')

You can also search identities that have one of several specific roles:

hasRoleMatching(role IN ('sap_user', 'sap_admin'))

hasSodViolationMatching

The hasSodViolationMatching function searches identities that have at least one SoD violation matching the given Search Expression, or Role Assignments involved in at least one such violation.
The arguments are the SodViolation attributes: rule, policy, mode, roleAssignment1, identity, …

hasSodViolationMatching(rule = 'someSodRule')

hasDistinctRoleMatching

The hasDistinctRoleMatching function searches identities that have at least two Role Assignments matching the given Search Expressions.
The arguments are the RoleAssignment attributes: role, identity, source, parentAssignment, …

hasDistinctRoleMatching(role = 'FG3751', status='NORMAL')

hasRiskFacetMatching

The hasRiskFacetMatching function allows to search objects having at least one risk facet row matching the sub-expression.

The arguments are : risk value, dependency ...

hasRiskFacetMatching(dependencies IN objectKind:objectId:Attribute)

XML configuration

Search Expressions appear in the Configuration mostly in Scopes:

• Features: Feature Scope, Search widgets, Reporting Widgets,…

• Policies

• Reference Attributes

• …

They use the dedicated search namespace.

Property Expressions

<search:Prop op="EQUALS" name="enabled">
    <value>true</value>
</search:Prop>

<search:Prop op="IN" name="firstName">
    <value>John</value>
    <value>Jane</value>
</search:Prop>

In the context of Dynamic Scopes, the value element can contain Groovy code:

<search:Prop op="EQUALS" name="manager">
    <value script="true">OBJECT.id</value>
</search:Prop>

For more information, see Scopes.

Logical Expressions

<search:And>
    <search:Prop op="EQUALS" name="lastName">
        <value>Doe</value>
    </search:Prop>
    <search:Prop op="EQUALS" name="firstName">
        <value>John</value>
    </search:Prop>
</search:And>

<search:Or>
    <search:Prop op="EQUALS" name="firstName">
        <value>Jane</value>
    </search:Prop>
    <search:Prop op="EQUALS" name="firstName">
        <value>John</value>
    </search:Prop>
</search:Or>

<search:Not>
    <search:Prop op="EQUALS" name="manager.firstName">
        <value>John</value>
    </search:Prop>
</search:Not>

Empty Expression

<search:Empty/>

Functions

<search:Func name="hasRoleMatching">
    <search:And>
        <search:Prop op="EQUALS" name="status">
            <value>ASSIGNED</value>
        </search:Prop>
        <search:Prop op="EQUALS" name="role.application">
            <value>o365</value>
        </search:Prop>
    </search:And>
</search:Func>

{
	"expression": {
		"func": "hasSodViolationMatching",
		"args": [
			{
				"prop": "rule",
				"op": "EQUALS",
				"values": [
					"Jira_Deskare_SodRule"
				]
			}
		]
	},
	"sort": [
	],
	"options": [
	]
}

{
	"expression": {
		"func": "hasDistinctRoleMatching",
		"args": [
			{
				"func": "roleMatches",
				"args": [
					{
						"func": "hasResourceMatching",
						"args": [
							{
								"prop": "id",
								"op": "EQUALS",
								"values": [
									"APP_MDS60891"
								]
							}
						]
					}
				]
			},
			{
				"func": "roleMatches",
				"args": [
					{
						"func": "hasResourceMatching",
						"args": [
							{
								"prop": "id",
								"op": "EQUALS",
								"values": [
									"APP_ELR32906"
								]
							}
						]
					}
				]
			}
		]
	},
	"sort": [
	],
	"options": [
	]
}

{
  "expression": {
    "func": "hasRiskFacetMatching",
    "args": [{
      "op": "EQUALS",
      "prop": "dependencies",
      "values": ["ORGANIZATION:QH5400:organizationName"]
    }]
  }
}

Groovy Rules

A groovy DSL is available to easily construct Search Expressions:

def emptyExpression = expr {}
def firstNameAndLastNameConstraint = expr {firstName.eq("John") & lastName.eq("Doe")}
def hasO365Role = expr {hasRoleMatching(status.eq(RoleAssignmentStatus.ASSIGNED) & prop("role.application").eq("o365"))}

For more information, see Rules and Actions API.

Special builtin attributes

Some builtin attributes, especially on Identities are not of a simple type (String, Integer, …). This section explains how to search on them

Identity Rights

To match Identities that have a Right Grant, use a Property Expression with the EQUALS or IN operator on the rights Attribute. The Property Expression value must be a String of the form <right name>:<right target>:<right privilege> where you can omit each part:

• Match all identities that have a specific right, with any target or privilege:

  rights = 'app.o365.access'
  

• Match all identities that have a specific right on a specific target, with any privilege:

  rights = 'user.manager:France'
  

• Match all identities that have a specific right on any target, with a specific privilege:

  rights = 'feat.user-card-read::2'
  

• Match all identities that have a specific right on a specific target with a specific privilege:

  rights = 'app.sap.sales:France:1000000'
  

Identity Roles

You can also match identities by criteria on their Role Assignments, with the hasRoleMatching function. For example:

hasRoleMatching(status = 'ASSIGNED' AND "role.application" = 'o365')

This expression matches all identities that have at least one Role Assignment whose status is ASSIGNED and whose Role matches application = 'o365'.

Role Assignment Dimensions

To match Role Assignments that have certain dimension values, use a Property Expression with the CONTAINS operator on the dimensions property. The value is the JSON serialization of the dimension values to match:

dimensions CONTAINS '{"dim1": "foo", "dim2": ["bar", "baz"]}'

This expression matches all Role Assignments where:

• dimension dim1 equals foo, and

• dimension dim2 contains at least bar and baz, in any order.

Read Next

Rules

Scope

Execution Plan