I have a boolean attribute on a user object - let's call it
userHasAppAccess that I want to set in Workflow.

The attribute is being set in code in Data Item Mapping on a Workflow
Entity Provisioning activity, and the value of the attribute will depend
on the user's co attribute.
Taking Mexico as an example, country data is stored in a different
hierarchy that contains objects of type aux class ABCCountry so Mexico
will be here
ou=MX,ou=LA,ou=Location,ou=Services,o=ABC

The two attributes of interest on those objects are description and
countryHasAppAccess.
Description contains the country name which is the same as the co
attribute on the user, and countryHasAppAccess will determine the value
of userHasAppAccess on the user object.

I can pull the user's country (co attribute) with this
userCountry =
IDVault.get(flowdata.get('Start/App_Request/TargetUserDN') , 'abcuser',
'co')


and I can get the countryhasAppAccess with this
if ( IDVault.get("ou=MX,ou=LA,ou=Location,ou=Services,o =ABC" ,
'ABCCountry', 'countryHasAppAccess') == "TRUE")

The missing link is getting the country DN (required by IDVault.get) by
searching the Location OU for an ABCCountry object whose description is
"Mexico".

I've tried a couple of things, including trying to call a global query
from within the workflow activity, but so far no luck.
Any help much appreciated.