Bundle Profile relationship table(Entitlement - Role relationship)

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Hi All,

Looking for your help!
We have an entitlement, which is a part of role. Entitlement is visible inside role. Associated Roles are not visible in the SailPoint IdentityIQ UI when viewing entitlements, despite entitlement is a part of the role. This relationship does not exist inside the Bundle-profile relationship table.

Kindly share the root cause and work around.

2

Hello Anubhav. First, please confirm whether the entitlement is directly defined in that role’s own profile or comes through a required, permitted, or inherited role. The Associated Roles tab only shows roles that directly provision the entitlement. If the entitlement is inherited through another role in the hierarchy, the parent role will not appear there.

If it is directly defined in the role profile, you can check and rebuild the relationship from the IIQ console:

rolerelationship show -role_name 'Your Role Name'
rolerelationship index build -role_name 'Your Role Name'
rolerelationship show -role_name 'Your Role Name'

Pay attention to the status in the output. ENT_NOTFOUND means the referenced entitlement cannot be resolved, while APP_NOTFOUND means the application cannot be found. Either status indicates that the role profile cannot be resolved correctly and can explain why the association is not displayed in the UI.

You can also run the Role-Entitlement Associations task from Setup > Tasks to rebuild all associations at once.

If the association still does not appear, export the Bundle XML and verify that the profile references the correct application, schema attribute, and exact entitlement value. If the corresponding ManagedAttribute no longer exists, run the appropriate account or group aggregation so IIQ can recreate it, then rebuild the relationship. If the entitlement has been retired, remove it from the role profile instead.

3

Thanks harish, Entitlement is directly defined in the role profile.
After all the defined process above, Role still does not appear in Entitlement

4

Since rebuilding did not fix it, could you try running it with the Bundle ID and share the complete output?

rolerelationship index build -role_name <Bundle_ID>
rolerelationship show -role_name <Bundle_ID>

The status column in the show output will tell us whether IIQ can resolve the entitlement or not. If it shows ENT_NOTFOUND or APP_NOTFOUND, the profile references something IIQ cannot match. If it shows OK but the Associated Roles tab is still empty, the issue is on the UI side.

Could you also share your IIQ version and patch level, and a sanitized copy of the Bundle profile XML?

5

how can we check using the bundle_profile_relation table in DB.

6

Sure. You can try checking it with this read-only query:

SELECT
    b.name AS role_name,
    sb.name AS source_role_name,
    a.name AS application_name,
    bpr.*
FROM spt_bundle_profile_relation bpr
LEFT JOIN spt_bundle b ON b.id = bpr.bundle_id
LEFT JOIN spt_bundle sb ON sb.id = bpr.source_bundle_id
LEFT JOIN spt_application a ON a.id = bpr.source_application
WHERE bpr.bundle_id = '<BUNDLE_ID>';

Check for a row matching the exact application, attribute, and entitlement value in the role profile. If no matching row exists, the relationship was not created. If it exists but the Associated Roles tab is still empty, please share the row and your IIQ version and patch level.

Use the query only for verification. Do not update the table directly.

7

That is the actual problem, Entitlement is not returning from Bundle profile relation table.
So some of entitlement. I am using version 8.4

Is there any other way around to check this data using any other IIQ table?

8

You can verify the role profile from spt_profile and spt_profile_constraints:

SELECT
    b.name AS role_name,
    p.id AS profile_id,
    pc.elt AS profile_constraint
FROM spt_bundle b
JOIN spt_profile p ON p.bundle_id = b.id
JOIN spt_profile_constraints pc ON pc.profile = p.id
WHERE b.id = '<BUNDLE_ID>';

Check whether profile_constraint contains the entitlement value. These tables store the actual role profile definition, while spt_bundle_profile_relation is the generated association index used by Associated Roles. There is no other table that replaces it for this relationship.

If the entitlement exists here but is still missing from spt_bundle_profile_relation after rebuilding, could you share the task result and your exact 8.4 patch level?

9

Thank you Harish for sharing the solution, this solution is working for fetching using DB