Remove access from workflow

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi Team,

I am trying to build a simple workflow to remove access upon changing of identity attributes. But I am getting strange error.

Below are the screenshots of my workflow. Can someone please let me know what I am doing wrong.

image
image863Ă—729 26 KB

image
image1471Ă—711 44.4 KB

image
image1392Ă—467 26.5 KB

image
image1455Ă—713 46.4 KB

image
image1496Ă—662 75.3 KB

Thanks in advance,
Abhinov

2

Hi Abhinov,

It’s not readily apparent from the UI, but you cannot revoke entitlements at this time. The underlying API that supports the Manage Access action currently has this limitation as well.

The Manage Access will eventually support entitlement revocation, but I don’t have a clear timeline on when that will be.

3

Hi Colin,

Thank you for the quick response. I tried to revoke only roles and I still have same error.

Can you please let me know if we can remove roles only?

Thanks,
Abhinov

4

Yes, you should be able to remove roles. Are you able to share the details of your failed workflow?

5

Colin,

Below is the error.

image
image1736Ă—746 86.8 KB

In previous step you can see I only added to remove roles.

image
image1578Ă—671 62.1 KB

image
image1040Ă—653 20.4 KB

There is only one role for this user and its granted by request but I am getting error while revoking.

Can you please let me know what I am doing wrong here?

Below is the final response.

{
  "body": {
    "requestType": "REVOKE_ACCESS",
    "requestedFor": "2c918084831e4642018334798bb76982",
    "requestedItems": [
      {
        "id": "c431688e145a4900997ee4223a6f320f",
        "name": "JC-Default",
        "type": "ROLE"
      }
    ]
  },
  "identities": "2c918084831e4642018334798bb76982",
  "method": "POST",
  "path": "rats-v3/access-requests-v3",
  "requestedItems": [
    {
      "id": "c431688e145a4900997ee4223a6f320f",
      "name": "JC-Default",
      "type": "ROLE"
    }
  ],
  "service": "rats"
}

Thanks,
Abhinov

6

Can you try something? In Request Access Removal, select the identity from the dropdown rather than choosing from a variable. See if that works.

7

Hi Colin,

I selected the identity and still same issue.

I tried to remove the access using “Manage access” => “Remove access” instead of “Request access removal” workflow. Its working fine.

I think there is some issue with “Request access removal”.

Thanks,
Abhinov

8

Agreed. This should work, but the Manage Access action is sending a bad payload to the API. Have you created a support ticket yet? That’s the best way to get this to engineering. You’ll want to link to this conversation in your ticket as well as provide details about your workflow, the inputs, and the outputs.

9

Hi Colin,

“Manage Access” is working fine. We have issue with “Request Access Removal”. Sure I will raise a support ticket for this and link this conversation.

Thanks,
Abhinov

10

@Abhinov7 ,

“Request Access Removal” is going to be phased out in favor of “Manage Access”. Please try to use “Manage Access” first to see if that fixes your problem.

1 Like
11

Hi @colin_mckibben,

I’m experiencing kind of same issue with “Manage Access” for Remove Access scenario.

Get Access (only fetching roles):

image
image1274Ă—794 43.1 KB

Manage Access (Remove Access):

image
image1362Ă—777 47.4 KB

Once I run the workflow, I am getting the below error on “Manage Access” step -

image
image722Ă—740 27.6 KB

Am I missing something?
Appreciate your help, thanks!

12

Does the identity currently have both roles? There is a quirk with the access request API, which Manage Access is based on, where it will fail if you attempt to revoke a role that doesn’t exist on the identity.

13

Yes, both the roles are assigned to the user. I’m fetching roles in the workflow step “Get Access” just before “Manage Access”.

14

How are the roles configured? Do they allow access requests?

image
image2542Ă—1207 185 KB

15

Yes, access requests are already enabled for those 2 roles.

Just curious if you have tried the same and how’s it working on your side?

16

I’m out of ideas at this point. There might be some other configuration in your tenant that is preventing this from working. Have you opened a support ticket yet?

17

Hi @gauravsajwan1 ,

Please make sure these are not birthright roles. If they are assigned based on membership criteria and user is still satisfying the membership then we cannot remove such roles from workflow.

Thanks,
Abhinov

18

Hi @Abhinov7 - these roles are requestable and not assigned as birth right.

@colin_mckibben - haven’t yet, will do!

19

Hi, I read the workflow documentation and it’s mentioned there how the structure for input JSON should be like for “Manage Access” -

image
image1411Ă—723 46 KB

In my case, input JSON looks different (doesn’t have “access items” in it) -
image

I will definitely raise this with SP Support team, but just curious if this is happening only with me or some role misconfig or expected behavior with Manage Access step for Remove action?

Would appreciate if it’s possible for you to run a test and share how’s it looking at your side?
TIA!

20

I don’t think it has to do with the workflow config. The error suggests that the payload is being sent correctly from the workflow, but IdentityNow can’t process the request because one of those roles can’t be removed for some reason. Try running the submit access request API endpoint to revoke those roles and see what you get. Maybe you can narrow it down to a single role that is causing the issue.

1 Like