JDBC - automatic Role provisioning

IdentityIQ (IIQ) IIQ Discussion and Questions
, , ,
1

Which IIQ version are you inquiring about?

Version 8.4

Share all details related to your problem, including any error messages you may have received.

Dear community,

We have implemented automatic Role provisioning, based on some attributes. users will be provisioned with roles.
We are facing issue in provisioning when user move from one role to another (roles having common entitlements).

Role 1 - Entitlements : ABC, XYZ, PQR
Role 2 - Entitlements : XYZ, DEF

If user have Role 1 with entitlements (ABC, XYZ, PQR) and if he moves to Role 2 only ‘DEF’ is getting added to user profile.
User should have XYZ, DEF, instead he is having only ‘DEF’.

In the provisioning plan only add entitlement value ‘DEF’ is coming.

What changes need to be done, so user can have XYZ, DEF when moved from Role1 to Role2

2

Hi @sbabu2024 ,

This is expected. Since the entitlement XYZ is already assigned to the user, provisioningPlan filters it out as no action is needed to add the entitlement again. But XYZ entitlement shouldn’t be supposed to be removed in this case though Role 1 is removed since Role 2 also grants it.

If you are looking to verify the filtered requests, you can do so with the provisioningPlan object using below method:

provisioningPlan.getFiltered()

Regards,
Uday Kilambi

1 Like
3

Hi @sbabu2024,

try to mark Refresh assigned, detected roles and promote additional entitlements
Provision assignments and unmark
Disable deprovisioning of deassigned roles in the refresh task.

With this configuration SP send every detected change

1 Like
4

Hi @sbabu2024,

Can you confirm if during Role removal the access “DEF” is being removed from user’s access list?

If yes, then can you try running the refresh on the user with below two option checked.

  • Refresh assigned,detected roles and promote additional entitlements
  • Provision assignments

Also try to see if there is any deprovisioning request for XYZ either from logs or from admin consol and what the source for the same.

Thanks

1 Like
5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.