Multiple access requests for same role and future start date

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hello,

An access req was submitted with a future start date of 7/27.

image
image482×540 9.03 KB

Meanwhile ANOTHER req. was submitted with an immediate start date. The req. went through and access was provisioned.

image
image571×561 8.99 KB

A couple of questions:

  1. Shouldn’t ISC have cancelled this 2nd req?

  2. What happens on 7/27? Will ISC then cancel it? Probably but it should have not allowed the 2nd req in the first place. Seems like a major bug

2

Hi @mario_rod,

ISC Provisioning engine includes the following steps :

image
image1600×822 148 KB

During the Expansion & Filtering step, ISC checks whether the identity already has the requested access. If it does, the access is ignored and excluded from provisioning.

Therefore, on 7/27, provisioning will be initiated, but the access should be ignored and not provisioned again.

3

thanks @baoussounda

That’s what I thought (ISC would cancel it on 7/27). So I guess even though the role was successfully “assigned”, ISC only cancels a req when it tries to provision (expansion & filtering phase), not when the actual req is made?

Is there a way to cancel this future dated assignment? I tried pulling the assignments with /identities/v1/:identityId/role-assignments?roleId=********** and it only returned the current assignment that was already provisioned. There’s no trace of the future dated one

4

Hi @mario_rod,

As described here : New Capability: Start Date in Access Requests - Announcements / Product News - SailPoint Developer Community

image
image685×845 94 KB

There are steps describing how to change the start date of an already submitted request.

Also, in the “Date Change through Re-Request” section, it is mentioned that once you submit a new request for the same access, the request with the shorter duration is processed, so the other requests are ignored.

Thanks.