Manage Accounts -> Forwarding for Identity Administrator

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.4p3

Share all details about your problem, including any error messages you may have received.

*I have requirement to set forwarding rights for a helpdesk team, where they can set forwarding onbehalf. I have granted “IdentityAdministrator” capability for the user, and they can be able to set forwarding for others using Identities->Identity Warehouse. But when trying via Manage Access->ManageAccounts and clicking on forwarding option getting error as “*The logged in user is not authorized to update the forwarding preference of the selected user”

In “IdentityAdministrator” capability, i can see the “SetIdentityForwarding” SPRights is part of it.

Why forwarding is not working from the manage account?

2

can you Exact go to the QuickLink Population (Dynamic Scope) tied to the “Manage Accounts” QuickLink, and add/expand its population definition so it includes the identities the helpdesk team needs to set forwarding for (or assign the helpdesk capability to a Dynamic Scope whose population covers those users). Once the target identities fall within that authorized population, the forwarding option in Manage Accounts will work — the SPRight alone isn’t sufficient for that entry point.

3

All configurations are already in place, the quick link population is configured with membership as “IdentityAdministrator” capability and enabled “Manage Accounts” quicklink and helpdesk team assigned with “IdentityAdministrator” capability.

And the users with capability can view the forwarding options as well.

4

Dig further on the issue and i can see while click the Forwarding, it calls rest service.

http://localhost/identityiq/ui/rest/quickLinks/Manage%20Accounts/identities/0a73f59c9ab514d2819ac4380440039f/forwardInfo

In forwardInfo method, this.authorizeForwarding(identity) call expecting “quickLink.LCM_ACTION_EDIT_IDENTITY” and “SetIdentityForwarding”.

But the helpdesk team users has only “SetIdentityForwarding” rights not the quicklink.

To cross check, added the “Edit Identity” to the same quicklink population and now the helpdesk team users can forward successfuly.



@GET
@Path("forwardInfo")
public Response getForwardInfo() throws GeneralException {
JoinPoint var3 = Factory.makeJP(ajc$tjp_13, this, this);

	try {
		ajc$sailpoint_tools_TracingAspect$localAspectOf().traceMethodEntry(var3);

		Response var10000;
		Response var4;
		label16 : {
			try {
				Identity identity = this.getIdentity();
				this.authorizeForwarding(identity);
				

ForwardingService service = new ForwardingService(this.getLoggedInUser(), identity,
						this.getContext(), this);
				var10000 = Response.ok(service.getForwardInfo()).build();
			} catch (UnauthorizedAccessException var7) {
				Message e = new Message("ui_identity_unauthorized_forward", new Object[0]);
				var10000 = var4 = Response.status(Status.BAD_REQUEST)
						.entity(e.getLocalizedMessage(this.getLocale(), this.getUserTimeZone())).build();
				break label16;
			}

			var4 = var10000;
		}

		Response var5 = var10000;
		ajc$sailpoint_tools_TracingAspect$localAspectOf().traceMethodExit(var3, var5);
		return var4;
	} catch (Throwable var8) {
		ajc$sailpoint_tools_TracingAspect$localAspectOf().traceMethodThrow(var3, var8);


		throw var8;
	}
}

private void authorizeForwarding(Identity identity) throws UnauthorizedAccessException, GeneralException {
	JoinPoint var2 = Factory.makeJP(ajc$tjp_14, this, this, identity);

	try {
		ajc$sailpoint_tools_TracingAspect$localAspectOf().traceMethodEntry(var2);
		this.authorize(
				new Authorizer[]{(new LcmRequestAuthorizer(identity)).setAction(QuickLink.LCM_ACTION_EDIT_IDENTITY),
						new RightAuthorizer(new String[]{"SetIdentityForwarding"})});
		Object var4 = null;
		ajc$sailpoint_tools_TracingAspect$localAspectOf().traceMethodExit(var2, var4);
	} catch (Throwable var6) {
		ajc$sailpoint_tools_TracingAspect$localAspectOf().traceMethodThrow(var2, var6);
		throw var6;
	}
}
5

@Sampath_Kumar , Good catch! It looks like the Manage Accounts forwarding endpoint also requires the Edit Identity QuickLink authorization in addition to SetIdentityForwarding.