Filters are NIM's "workhorse" feature. All steps in the Initial setup exist, essentially, only to enable filters. Almost everything you do in NIM is accomplished using filters.

To get started, Create a filter.

A filter applies logical criteria to narrow down your current Vault contents. A filter's output represents a dynamic subset of data in the vault. Then, a filter's output becomes the input of a single provisioning function in a target system via Mappings, or the input for Roles.

In other words, filters in conjunction with mappings and roles define the soll differentials that drive NIM's provisioning process (see Soll-ist engine). In this way, you progressively build up logic to automate your organization's entire provisioning lifecycle.

For example, you could create a filter X that returns all users with an account in system Y, but no account in system Z. (This filter would likely use with no logic.) You could then assign this filter to a mapping function that creates users in system Z. This filter might initially return 25 users. The first time the mapping is executed, accounts for those 25 users will be created in system Z. On subsequent mapping executions, the filter will return empty results, and the mapping will do nothing—until more users are added to system Y. And so on.

This example illustrates the "dynamic" nature of filters. A filter's configuration remains constant. Only its output varies—dynamically—with its input. Thus, filters are the basis of NIM's Soll-ist engine. All of this is possible due to the universal format of the data stored in the vault.

Although mappings and roles are the most important ways in which filters are used, they are not the only ways. Filters are also used with name & password generators and other objects which require data from the vault.


NIM's filters operate on the same basic principles as queries in SQL.

Invalid filters

Invalid filters are underlined in red:


These filters return invalid output until you reconfigure them. Until then, other objects that use them (e.g., mappings) will fail.

To help debug an invalid filter, use the Validation tools.


If all your filters are marked as invalid, your license key may be expired. See License.