Access Profiles and Entitlements overlap

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hello everyone,

I’m trying to configure an application where entitlements overlap across multiple Access Profiles and I’m running into an unwanted behavior in IdentityNow.

Context
I have multiple Access Profiles configured, for example:

  • AP1: E1, E2, E3

  • AP2: E1, E2

Issue
When a user is assigned AP1, IdentityNow automatically detects that the user also has the entitlements that make up AP2 and ends up assigning AP2 to the user as well.

This is not the desired behavior. During a certification campaign, the user will then appear with both AP1 and AP2, even though AP2 may be completely unrelated from a business perspective for that user.

image
image3124×3244 278 KB

Has anyone experienced this behavior or found a way to prevent this automatic assignment of overlapping Access Profiles?

Kind regards,

2

@davidtrn Hello,

Have you tried using requestable roles instead of APs?

Role1: E1,E2,E3

Role2: E1,E2

That would seem like a potential workaround for this.

3

Hi @davidtrn
Check if this helps : Overlapping Access Profiles

4

I would always say it’s best to model APs on the function being enabled in the application and keep the “business” modelling as roles. So, in your case AP1 has Ent1 and Ent2, AP2 has Ent3. Role1 has AP1 and AP2, Role2 has AP1.

5

Thanks all for your inputs.

We wanted to use Access Profiles because :

  • The UX is better as they can be added to “Applications”
  • It’s easier to manage certification (through API/workflow) as we can just filter on the source.id

But seems like going with the Roles is the only solution.