Does Identity refresh tries to grant access though identities are active or inactive? for example if xyz identity have abc access, does identity refresh attempts to grant abc access? if does this can be tamed out some how?
From what I have been able to understand from my experience with ISC. The Identity Refresh triggers attribute sync and the Role Engine. As for your question if would add entitlements based on users being added to Roles that they now meet the criteria for. The primary function of the Identity Refresh is to ensure that the downstream system are in sync with ISC.
For example if a admin removes group A from a user but group A is part of a role that a user is being added to it will indeed readd group A to the user.
Hence that is what we wrongly assuming it is attempting to read group A again?
The ISC Identity Refresh is the same task as IIQ Identity Refresh. With some options enabled.
So imagine that yes , if the Identity has the ROLE XYZ but it didnt have the access that the role carry , ISC will give the access. Even create the account to give the access.
Best
in simple let say why in the first case it is attempting to grant access, though they have already? do we need to imagine downstream data sync?
If the user have the access it should not try to grant it. One thing in mind is , if you remove the granted role, the access will be removed.
But yes , he will try to make a " data sync"
1 Like
Hi @shaffusailpoint,
When you say that the user has xyz access, has the access been aggregated to ISC yet.? If the user has the role corresponding to access xyz, but the aggregation has not occurred (in a case where the access was granted outside of ISC), The system could assume that the access has not been granted yet and could retry provisioning.
Note that the Identity refresh process does not read the data from the target systems.It just processes the data (Roles, Attribute syncs etc) which is already there in ISC.
You might need to recheck if you able to see the entitlements aggregated back matches the access assigned by the role.
The symptoms you described could be due to the close-loop did not happened / incorrectly aggregated hence ISC will thought the access has not granted, it will continuously attempt to create.
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.