Hide entitlement from the remove access page

[gabs1 (Gab S.)]

Hi community,
I’m struggling with something: I would like to remove completely the visibility of entitlement from the Remove option of the access page. I know that I can block the request using the quicklink rules, but it will be nice to completly hide the entitlements… I’m on the 8.1p6 very soon to 8.3p3 and one of the reason that i want to block it is that when an end user click on the Remove it takes several minutes before the entitlments list are displayed. Also this is causing some confusion for the "non tech " people.

[Remold (Remold Krol)]

Hi Gabriele,

I would adjust the QuickLink settings for the ‘affected’ population.

Follow these steps:

• Go to Gear → Global Settings
• Open/Click: Quicklink Populations
• Open/Click the affected population
• Go to QuickLinks
  
• Click on Configure for the ‘Request Access’ line:
  
  
• Disable Options: ‘Request Entitlements’ and ‘Allow remove requests for entitlements’
  
• Click Save
• Click Save (at the bottom of the screen)

Note: Make sure the Quicklink config for all related populations is adjusted. IdentityIQ combines the settings of all populations the identity is part of, where the combination is based on addition of settings.

Hopefully this will speed up the ‘Access Request’-page since entitlements should not be loaded.

Using QuickLink populations leaves the option for other populations (like HelpDesk and Admins) open to request entitlements (and have them wait the extra 2 minutes )

– Remold

[Remold (Remold Krol)]

Hi Gabriele,

When I read:

@gabs1

it takes several minutes

I directly think of an indexing issue in the database. Normal queries should not take longer than a few seconds (almost all in just a a few 10’s milliseconds. A Full Table Scan can take way longer up to minutes.

It might be a good idea to sit with a DBA and look at the queries and the duration of these queries. I know MSSQL and Oracle DBAs have very good tooling to identity a long duration SQL query and normally very good knowledge on investigating slow database responses (The main drive of being an DBA is to deliver mega amounts of data as fast as possible).

In the past I have reduced minutes of waiting to less than 1 second by adding just a single index.

Another issue I faced is a changed session language in Oracle (see also sorting and NLS_LANGUAGE) to change the sort order for all searches. If there is a mismatch between the language (sort order) used to create the index and the language of the session, each query to the database will result in a full table scan.

– Remold

[gabs1 (Gab S.)]

Hi,
thanks, I’m already using those settings. The end user can’t start an entitlement remove request, but they are still visible there.
What I found out is that if an entitlement is part of a role is not displayed , so is displaying all the others entitlements the we aggregate but are not used in any roles… (Mainly this is happening for Active Directory).

Gabriele.

[Remold (Remold Krol)]

As far as I am aware there is no default way to not show entitlements from the remove request (other than including them in an ITR).

I advice you to sit with a DBA to see if there is an SQL query which takes long to complete. As a database should complete queries based on milliseconds and not on minutes.

(A link for MSSQL: Troubleshoot slow-running queries - SQL Server | Microsoft Learn
for Oracle: How to Investigate Slow or Hanging Database Performance Issues )

– Remold

[gabs1 (Gab S.)]

Thank you so much for your help!
I’m already working with the DBA to understand better what is happening :).

[Jarin_James]

Hi @gabs1

Delighted that @Remold from our Ambassador team provided assistance! Kindly mark his last response as the solution to benefit others seeking answers and fostering our Developer Community.