WorkGroup to access specific report

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

Version 8.2

Share all details related to your problem, including any error messages you may have received.

Hello all
We need to create a group for some users with the right to access the Intelligence MENU → Report and see/run a two specific report .
Is it possible ? to create a workgroups that allows the use to run and see one report ?

Thank you

2

Hi Ricardo,
I would suggest to read this document

https://community.sailpoint.com/t5/Technical-White-Papers/Using-Capabilities-SPRights-to-Control-Visibility-of-Reports-and/ta-p/78744

In short you have to define your SPRIGHT which will grant access to the report. Then you have to build your new capability which would containt this spright and finaly you can assign this capability to the workgroup.

1 Like
3

You probably want to assign the FullAccessReport SPRight, in addition to whatever report SPRights you’ve created, to your Capability. And assign that Capability to the Workgroup. Here is an example of what at capability would look like:

 <Capability name="SomeCustomCapability" displayName="Some Custom Capability">

    <Description>This is a custom capability which I am using as an example...</Description>

    <RightRefs>

      <!-- Access to the report pages. -->
      <Reference class="sailpoint.object.SPRight" name="FullAccessReport" />


      <!-- Access other custom reports. -->
      <Reference class="sailpoint.object.SPRight" name="SomeCustomReport" />

          ...
2 Likes
4

Hello
I have something like


-- Capabilities
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Capability PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Capability created="1718892965540" displayName="capability_XYZ" name="capability_XYZ">
  <Description>capability_desc_auditor</Description>
  <RightRefs>
    <Reference class="sailpoint.object.SPRight" name="FullAccessReport"/>
    <Reference class="sailpoint.object.SPRight" name="Report_access"
  </RightRefs>
</Capability>



--SPRIGHT
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE SPRight PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<SPRight created="1718892965509" displayName="Report_access" modified="1721040964043" name="Report_access">
  <Description>Report_access</Description>
//something here ??
</SPRight>

In the SPRight I should add the report name ?

5

No - it’s something you need to add into your report,

<RequiredRights>
    <Reference class="sailpoint.object.SPRight"  name="NameOfYourSPRight"/>
</RequiredRights>
6

Hello
where can I do it ?

7

Into the report task definition.

8

Hello
Only appears the Report result but there is any way to allow the user to run It ?

9

If you add it properly to task definition it should work. I believe the easiest way would be if you could paste here your spright, capability, workgroup and report definitions. So we can take a look and find mistake.

10 
--workgroup
 <Capabilities>
    <Reference class="sailpoint.object.Capability" name="Capability_Risk"/>
  </Capabilities>

--Capabilities
<RightRefs>
    <Reference class="sailpoint.object.SPRight" name="FullAccessReport"/>
    <Reference class="sailpoint.object.SPRight" name="FullAccessRisk2"/>
  </RightRefs>

--SPRight
<SPRight created="1718892965509" displayName="right_cgd_report" modified="1721050338351" name="FullAccessRisk2">
  <Description>FullAccessRisk2</Description>
</SPRight>


--TaskDefinition
<RequiredRights>
    <Reference class="sailpoint.object.SPRight" name="FullAccessRisk2"/>
  </RequiredRights>
11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.