Multiple entries of roleassignment for the same role under preference

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.3

There is a role “XYZ”, which is having multiple entries in the preferences column of the identity table which as result shows multiple records for the same role in the identity UI.
I checked the entries of “XYZ” in the spt_identity_assigned_roles and found only 1 entry.
Note:
In the identity preference, the assignment ids are different and the assigned by field is showing “Scheduler” and “RequestHandler” for multiple entries.

Any inputs to understand the difference between the spt_identity_assigned_roles and identity preference is highly appreciated.

2

@soswain It looks like users get these roles multiple times and during remove it was not cleanup properly.

check this link if you have some code to manage role removal.

How to remove (de-assign) a role from identity via the API - Compass (sailpoint.com)

Preferences contains more than roles. it contains attribute assignment also. if you heard about sticky assignment that also you need to handle during leaver.

Let me post some links that might help.

Role Management in IdentityIQ - Compass (sailpoint.com)

What’s sticky AttributeAssignment and how to delete it? - Compass (sailpoint.com)

Solved: Re: How to remove attributeAssignments by leaver workflow? - Compass (sailpoint.com)

These sticky assignment is really bad when refresh run and it will again assign that role.

3

@pravin_ranjan
Thank you for your inputs.
Here, the scenario is very unlikely related to sticky roleassignments or attribute assignments.
We are having multiple ways to provision a role using LCM Provisioning workflow. In an ideal scenario, if role is being provisioned more than once, the provisioner filtered the role (as the role already exists). In my scenario, the same role is being assigned multiple times by “Scheduler” and “RequestHandler” and we are seeing duplicate entries for the same role in the identity preferences attribute, which results in showing multiple rows for the same assigned role in Identity UI.

Point to be noted: There is only one entry for the role in spt_identity_assigned_roles table, which is correct.

Now, I am unable to understand, why there are multiple entries for the same roles as assignedRole in the identity preference attribute.

Any ideas or suggestions to fix this?

Thanks.

4

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.