Our team has been assigned a custom user level with Access Profile management permissions.
We are able to access the Access Profile and navigate to the Access Requests configuration. However, when we try to save the configuration, we receive a 403 Forbidden error.
We noticed that the Timeout field, which is mandatory, is currently blank. Previously, it was populated with the default value.
We also tried manually entering the value in the Timeout field, but we still receive the same Forbidden error.
Could anyone confirm if there are any additional permissions/capabilities required for a custom user level to save the Access Requests configuration for an Access Profile?
In order to update Access Request configuration you will need to add the Access Request Administrator User Level as well. Make sure you test after waiting for few minutes once you add the User Level and ideally try to login again.
Even though you are updating it from Access Profile page but it updates the access request config so its expecting additional permissions(userlevel).
check the exact failing payload endpoint or error message.
And in order to resolve this issue the Tenant Admin should provide you the custom user levels which should have the below user levels:
idn:access-request-config:read
idn:access-request-config:update
Hello Surya. I tested this in my demo tenant with a Custom User Level containing Access Profiles Management and was able to reproduce the same Forbidden error when saving the Access Requests configuration.
I then added Access Request Administrator to the same test user, signed out and back in, and the save worked successfully.
So, based on my testing, Access Profiles Management alone does not appear to be sufficient for saving the Access Requests configuration, even though the documentation lists Create and Manage permissions for Access Profiles. I also do not see any other documented Custom User Level permission specifically for this operation.
If granting Access Request Administrator is acceptable for your use case, this should resolve the issue. If you need to keep the user limited to Access Profile management, I would raise this with SailPoint Support to confirm whether a more granular permission is available.
I would say that based on your testing, there is likely a disconnect between the Documentation of that User-level, or it is a bug with how the Access Profile Management user-level is implemented.
With your testing @SuryaKiran or @punna0001 , were you able to Create and/or Delete an Access Profile with just the Access Profile Management user-level?
Yes, I am able to create and manage Access Profiles with the Access Profile Management user level. The issue is only when saving the Access Requests configuration, we get Forbidden error, although the configuration actually gets saved. Even after manually entering the timeout value, we still see the same error.
Ok, so then the documentation is correct, since you can manage the Access Profiles.
The disconnect seems to be with updating the Access Request with the updated configurations. Did you provide your users with any User Level permissions that would allow them access to the Access Requests, outside of the Access Request Administrator that was mentioned above?
I would not expect that a user with the user Levels to manage Access Profiles to be able to make changes to the Access Requests, even though they can use the profiles. That seems to be a clear delineation of the finite roles. What is unknown to me is why in your case the users can access the Access Request configuration with those permissions and what the reasonings for why (If you did not provide them with additional permissions.) I think we’ll need @jeremy_southerland or @JKistler or someone else from SailPoint to weigh in on that.
