Hi all,
I have a requirement to limit a certifier from revoking all the available roles from a user during a certification.
How can I achieve this?
Thanks in advance
@rishavghoshacc You can introduce a boolean extended attribute on entitlements, and only mark it true for those which needs to be part of certification. Now while launching certification you can use this attribute to include only those entitlements on which you need a review.
@neel193 Thats not the requirement.
The certification will always have all the roles that a user has. We only need to prevent the certifier from removing all the roles as we do not want a user with no roles.
If you want to stop the certifier the moment they try to revoke the last remaining role, use the Certification Item Completion Rule. This fires when each individual item decision is saved.
The certificationItemCompletion rule is specified in the System Configuration XML. It is applied to every
certification, so it runs every time a certification item is completed on any certification of any type. Specify it in
the SystemConfiguration attributes map with this entry:
This rule cannot be written through the UI Rule Editor; it must be written in XML and imported into the system.
Implement a CertificationEntityCompletion rule that returns an error when every Bundle item on the entity has a Remediated decision.
Add it as certificationEntityCompletionRule on the CertificationDefinition.
And certification should not have Process Revokes Immediately enabled.
@rishavghoshacc this is not a straightforward decision. There could be reviews spread across multiple reviewers. It will complicate the logic of checking across multiple reviews within the certification campaign and then block it. And how do you determine which one to leave.
Can you explain the rationale behind this requirement?
Is it for specific application or all roles of the user across multiple applications?
When I had such requirement , it was for specific application where user could not exist without any role
So I asked app team to create a “no -access “ role that didn’t provide any access
And in before provisioning rule for that application, I would detect if all role are removed for that application and then add this “no-access” role
This would work irrespective of what triggered the role removal-certification or access request etc
If you want you can make it work only for certification