Manage user access role sorting

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

8.5

Is there a way to change the sorting for roles in manage user access and can we assign a filter to the roles based on login user attribute(like if attribute value is true visible x set of roles and if false then y set of roles) any suggestions please?

2

@lsaipriya26 You can use Scope Feature in IdentityIQ.

Scopes - SailPoint IdentityIQ

3

Hello Saipriya,

For the sorting part, I don’t think there is a normal OOTB admin setting in IIQ 8.5 to change the role sort order in Manage User Access. The better supported approach is to make the roles easier to search/filter, for example by using a good naming convention or searchable extended role attributes.

For the second part, yes, you can handle this through Quicklink Populations.

Create separate Quicklink Populations based on the logged-in user/requester attribute, for example:

attribute = true → population A
attribute = false → population B

Then in each population, configure What can members request? → Roles and use a rule/filter to return only the allowed roles for that population.

That way, users with true will only see/request one set of roles, and users with false will only see/request the other set. This is better than only hiding roles in the UI, because it controls what the requester is actually allowed to request.

4

Sorry if i am asking irrelevant questions(beginner to sailpoint) but here i am not able to see quicklink related to Manage user access which sailpoints provided OOTB quicklink, so that i can add populations to that as suggested

5

You don’t configure this from the Manage User Access page directly. You configure it from: Global Settings > Quicklink Populations

Open the required population, then go to the Quicklinks tab and enable/configure the Manage User Access quicklink for that population.

Then under What can members request? > Roles, you can add the rule/filter to control which roles that population can request.

So the flow is: Create population based on requester attribute → configure Manage User Access quicklink → restrict requestable roles for that population

If you don’t see Manage User Access in the Quicklinks tab, then I would check whether Lifecycle Manager is enabled/configured properly and whether you have enough admin access to edit Quicklink Populations.

6

Thank you will check on this

7

@lsaipriya26 You need to use RequestObjectSelector rule in your quicklink. Here you can return the filter with role names, if the attribute value in user is true, otherwise return different filter.

Sample Rule:

import sailpoint.api.ScopeService;
import sailpoint.object.Identity;
import sailpoint.object.Scope;
import sailpoint.object.QueryOptions;
import sailpoint.object.QueryInfo;
import sailpoint.object.Filter;
ScopeService scopeService = new ScopeService(context);
QueryInfo scopeQueryInfo;
if (requestee == null) {
scopeQueryInfo = new QueryInfo(new QueryOptions());
} else {
scopeQueryInfo = scopeService.getAssignedScopeQueryInfo(requestee);
}
Filter requestable = Filter.eq("requestable",true);
Filter assignedScope = scopeQueryInfo.getFilter();
Filter f = Filter.and(requestable, assignedScope);
QueryInfo finalQueryInfo = new QueryInfo(f, false);
return finalQueryInfo;