Identity Refresh Task Options for RBAC

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

8.5

Share all details about your problem, including any error messages you may have received.

We have RBAC model for provisioning Roles to Identities.

We have options checked in the Refresh Task:

  1. Provision assignments
  2. Synchronized attributes
  3. Process events
  4. Refresh assigned, detected roles, and promote additional entitlements
  5. Refresh Identity Attributes
  6. Check Active Policies
  7. Process Events
  8. Enable Partitioning

Do we know if there will be any issues/challenges while running the Refresh Task with all these options checked for RBAC. (We also have Full and Delta Refresh Task definitions)

2

For RBAC, You can utilize the below options that helps in Role assignment and Access assignment based on that role. For RBAC, create a different Refresh task and not utilize every option in a single refresh task.

  1. Provision assignments
  2. Refresh assigned, detected roles, and promote additional entitlements
3

You can keep Partitioning ENabled option checked as it will help to share the load on the server.

4

Hi @nihar_chaware Sometimes its better to divide the role of Identity refresh task into multiple tasks when you need to enable all these options.

You need to use your own understanding and divide those accordingly.
eg: You can have a separate task created for attribute synchronization etc

5

Running full refresh ( i am assuming you mean refresh for all identities here) with all these option can be very heavy operation and some time redundant as well.

Out of all those option, “provision assignment” is most heavy since it involves provisioning to target.

are you already running full refresh with all these option and facing any issue or just asking in general?

6

@nihar_chaware If you have lot of bundles then it makes sense to split identity refresh with different options. Like this:

  1. Refresh attributes:
    1. Refresh Identity Attributes
    2. Refresh manager status
    3. Check Policies
  2. Role Refresh related:
    1. Refresh assigned, detected roles, and promote additional entitlements
    2. Provision assignments
  3. Events Execution: Process Events
  4. Synchronize Attributes

We did this for one of the project, as they had close to 5k roles and keeping all options together used to take ~8-10 hours to complete. Make sure you have partitioning enabled. In case you have delta refresh, you can also try to have all options but this depends on the overall execution timings at your time.