How to auto-select a particular/main account for provisioning while requesting access to a multi-forest Active Directory source in Request Center?

[TheOneAMSheriff (Amar Sheriff)]

Lets say a multi-forest Active Directory connector has 2 forests for accounts and 1 forest for groups. When requesting entitlements(Not Access Profiles or Roles) from “Request Center” to the subjected source how can I tell ISC/SailPoint to provision to the main account, which could be in either of the 2 forests with accounts depending on an identity attribute?

[zachm117 (Zach Mullins)]

Hey Amar!

I don’t believe there is an easy way to do this currently. Entitlement requests have gotten a lot of changes recently, but unfortunately the do not currently have the multiple account options like Access Profiles.

IDN in general isn’t great at handling identities that have multiple accounts in one source.

The two options I can think of to help with this would be to either switch to using Access Profiles for access requests, or create a second AD source to filter on each account.

Switching to Access Profiles for these types of requests will let you use the Multiple Account Options to help determine which account to provision the access to.

Creating a second source would essentially split the accounts that the users have into 2 seperate sources. For example, if users have a domainA and a domainB account, one connector will just look for the domainA accounts and the other would look for the domainB accounts so users only have one account on each source. This would duplicate the entitlements in the entitlement catalog, but it would allow you to just make the domainA groups provisioned to the domainA accounts. It is fairly common to have multiple sources to support users having multiple accounts, we have 3 ourselves, in order to only have one account from a source linked to an identity, but it can get a bit messy.

Here are some other topics regarding having multiple AD sources that may be helpful.

2 Active Directory Source connectors?

Hello All - I have a use case where our admins have 2 AD accounts, one named and one for admin access. Admin AD account creation will be manual, however we want both accounts to be disabled upon termination and we do not want attributes synced to the admin accounts. It’s my understanding that attribute sync will apply to all correlated AD accounts. My idea is to setup a secondary Active Directory source, which will include the OU for the admin accounts, and exclude the OU on the primary Active…

Request Center : request role for user that have more than 2 accounts

My identity have more than one account in one my source. And i have another role that use an access profile base in this source. In Request center if i ask the role, it’s failed with error : "Your request failed beacause you have more than one account on the source mySOurceName. Any idea ?

Please let me know if this helps!

• Zach

[TheOneAMSheriff (Amar Sheriff)]

Hi Zach,

Appreciate your detailed insight. What you described is the exact issue, duplicating of entitlements when using two different sources. Since account selector in access profiles only work in case of automated provisioning, not “Request Center” I had to drop that.

The attempt to use segments to split the users visibility in Request Center hit a limitation as segments in ISC only filter access items for requester, but not for recipients like the Quicklink populations in IIQ. Perhaps going with the limitation of segment is my best bet. Thank you

[TheOneAMSheriff (Amar Sheriff)]

The solution finalized was to have two different sources with entitlements duplicated as @zachm117 mentioned about. Event Triggers can be used to auto deny/approve an approval request in case the account was selected incorrectly due to the duplication in entitlements. Segments was used to limit the visibility of entitlements but segments only apply to requesters, not recipients: Access Segmentation for Beneficiary | SailPoint Ideas Portal