Need Help with Preventive SOD Entitlement Policy

IdentityIQ (IIQ) IIQ Discussion and Questions
1

I’m trying to create a policy in IIQ 8.5 to prevent a user from requesting access to an entitlement if they already have a related entitlement.

So, I have 5 entitlements (active directory groups) - Entitlement A, B, C, D and E. If a user has any one of those 5 entitlements, they should not be able to request another of them.

I have a preventive SOD Entitlement policy where in the First Entitlement Set, I have all 5 entitlements.
And the Second Entitlement Set also has all 5 entitlements.

I was thinking that if the user is requesting an entitlement from the First Set, and they already have access to something in the Second Set, the policy violation would be triggered. But if the user does not have any access and is requesting access to one of the entitlements, it would allow them to request access.

But what I’m seeing is that if a user has none of the entitlements and they try to request any one of them, they get an error that they are in violation of the policy. Why? They don’t have any access yet. What do I need to change to allow users to request these entitlements?

Any info is appreciated. Thanks!

2

Hi @karen_delucia - this is because the requested entitlement is in both sets. In order to fix this, would need to create separate 1-to-many sets (i.e. entitlement A on left and entitlements B,C,D,E on the right), or use an advanced policy.

3

Hi @karen_delucia - it is because you have the same entitlement on both sides of the policy rule. So IIQ sees that as requesting Entitlement A will conflict with Entitlement A. What you can do is create 5 policies, one for each entitlement, for the conflicts, put the remaining 4. This should allow the requests.

4

@robert-hails - we have impeccable timing :slight_smile:

5

Blaming Spider-Man GIF

6

Hi @karen_delucia ,

For entitlement SOD policy, you can create set (for 5 entitlements) as below –>

  1. A vs B, C, D, E
  2. B vs C, D, E
  3. C vs D, E
  4. D vs E
7

Thanks everyone for your replies. I think deep down I knew that but was hoping it wasn’t so! :smiley: I’ll split it up into 5 separate rules and expect that will work.

Thanks!