Role Expansion Behavior for deleted applications from User Profile

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Hi All,

I have a situation where SailPoint is trying to remove entitlements for deleted application. Is there a way to stop it?

Below is complete scenario:-

After 60 days of termination, we delete AD and Okta applications from Users profile and after 180 days we remove roles (which contains Ad and Okta entitlements) from users profile with scheduled events.
When role removal action takes place, it tries to remove AD and Okta entitlement which fails as applications are already deleted after 60 days.

My expectation is SailPoint should filter entitlements on role expansion if application does not exist with user profile. But it is not happening. Isn’t it SailPoint OOTB behavior.

Please respond

2

Hi @deepakkumar511 ,

I believe if there is no Link and Entitlement is attached with Identity then Sailpoint should not create Deprovisioning for already removed link.

I would recommend to raise a support case for this.

However i would wait for what others have to say on this.

1 Like
3

Hello Deepak, Welcome to the SailPoint Developer Community!
Have you made sure that the links to the application as well as entitlement assignment to the apps have all been removed on the identity object after the removal of the user account on Ad and Okta? Ideally this should be filtered out if there is no link to the application.

1 Like
4

Yes, I don’t see any okta/AD entitlement reference in identity xml.

5

Then as Dheeraj mentioned, i think you can raise a support ticket.

6

Hi Just validated an user xml from production with the help of ops guy and I see entitlement references under

<Exceptions>
  <EntitlementGroup>
</Exceptions>

tag.
Is there a way to clean these at the time of account deletion?

Thanks in advance

7

HI @Deepak,

I guess you can create a custom task and do below :

  1. Get list of all the assigned roles for the user.
  2. Run a loop per role and extract the Role Profile.
  3. Check the Role Profile application Link exist to user then ok, else check if Identity Exception has that profile Name. If Yes remove it from the Identity Object and save it.
  4. Schedue the task to run daily so that any such identities would be cleaned-up
8

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.