IT role is not assigned

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Hi everyone,

We have created a business role with a match list and configured it role. We have added an AD entitlement to the IT role and created a provisioning policy to update the Msds-cloudextension attribute 20 with a fixed value.

Issue is

It role is not assigned to user and value is not getting updated in AD but we can see provisioning transaction in admin console that value is committed

2

Please check if any work items are pending.

3

There is no workitems

4

Please share the provisioning policy and provisioning transactions so we can analyze the issue

1 Like
5

I have created a provisioning policy directly in IT role by choosing policy

8

Role.docx (3.2 KB)

9

Hi @sureshbommareddy98,

The issue is likely to be caused by the constraint defined inside the IT Role profile:

<Filter operation="CONTAINS_ALL" property="memberOf">
  <Value>
    <List>
      <String>CN=Research,OU=Distribution,OU=Groups,OU=Enterprise Services,DC=usi,DC=com</String>
    </List>
  </Value>
</Filter>

This condition checks whether the user is already a member of the “Research” AD group. If the user is not in that group, the constraint fails. As a result, the IT Role is not assigned to the user, and the provisioning form that updates the msDS-cloudExtensionAttribute20 attribute is not triggered.

Even though you see a provisioning transaction marked as “committed” in the Admin Console, it just means that SailPoint successfully created and queued the provisioning plan. It does not necessarily mean the change was executed in the target system. If the IT Role wasn’t assigned due to the failed constraint, the provisioning steps inside that role would not be executed.

To fix this:

  1. Remove or relax the ‘memberOf’ constraint in the IT Role so that it can be assigned even if the user is not already in the AD group. This will ensure that the attribute update happens as expected.
  2. Alternatively, if the constraint is still required, make sure the user is added to the AD group before this role is evaluated.

Hope this helps!

10

Hi @sureshbommareddy98
Once try to create the provisioning policy directly in the Business role and inherit the IT role within it.

11

I have removed memberof and ran the refresh task but it not getting detected

12

@sureshbommareddy98

try, i am suspecting some camel case issue.

 <Filter ignoreCase="true" operation="CONTAINS_ALL" property="memberOf">
          <Value>
            <List>
              <String>CN=Research,OU=Distribution,OU=Groups,OU=Enterprise Services,DC=usi,DC=com</String>
            </List>
          </Value>
        </Filter>
13

I have tried but no luck

14

Test by manually assigning the it Role . For this go to Global Settings >Role Configuration>IT Roles >No manual assignment uncheck and try to request this role