SAP-Concur leaver process requirement

[nandiniks]

HI All,

We have integrated the SAP-Concur application. Now below is the user case.

1. We need to implement the leaver process when user LCS=terminated, then his concur account should be disabled and all his permissions should be removed.

How can we achieve this use case? What type of rule to be deployed?

Please pour in suggestions.
Nandini

[GOKUL_ANANTH_M]

Hi @nandiniks ,

We have many ways. But I suggest these two ways.

The first Way is,

I believe you can utilise workflows in this scenario. Design the workflow as follows: when the user enters a specific LCS state that denotes their departure (using an Identity Attribute Change trigger), retrieve all of their roles, entitlements, and access profiles. Then, using loops, remove their access and using the “Get and Manage Accounts” action to disable the user.

The second way is,

1. Go to Provisioning tab in Identity Profile and create LCS state. In which, you can configure this.
2. Select the state → Configure Changes → Disable Account → Select the account → select the identity state → save.
3. Enable the state.
4. Go to workflows,
   Identity Attribute Changed trigger →
   $.changes[?(@.attribute == "cloudLifecycleState" && @.newValue == "terminated")]
5. Using “Get Access” → get all his roles, entitlements and access profiles.
6. Using “Manage Access” → remove all his access
7. End

[nandiniks]

HI Gokul,
Thank you so much, I did added the source in mappings of the identity profile-workday, the accounts disablement worked straight however, the permissions/roles are not removed.
How would we achieve the role removal when workflows are not enabled in identitynow.

[phil_awlings (Phil Rawlings)]

Hi @nandiniks,
Set the LCS=terminated to disable the concur account (under the provisioning tab), and make all of the entitlements RBAC to the active state.
That will achieve what you are looking for

[nandiniks]

Hi Phil,
Thank you for your reply. Request you more details on “make all of the entitlements RBAC to the active state”.
This will help us achieving what is required.

[phil_awlings (Phil Rawlings)]

Hi @nandiniks,

Assuming that the permissions are bundle under entitlements, create a concur role and set the first criteria to the following. This will ensure that only active assignments get the permissions:

[nandiniks]

Than you Phil, but do we have any way to implement rule or something. As we donot follow RBAC model currently.

[phil_awlings (Phil Rawlings)]

If you want to create a rule rather than a role, this guide will help you:
Web Services After Operation Rule | SailPoint Developer Community