SOD - Create Functions for entitlements with custom attributes

[wronzitti]

Hi,

We have a requirement for SOD for a suite of applications that are using a whitelist of allowed combinations of entitlements. 

Based on the value of a custom attribute in the entitlement, the whitelist is checked and validates the allowed combination. We need to perform and validate this at the access request stage.

We're trying to mimic a similar approach with SOD functiontality available in Saviynt. We noticed that SOD functions operates at the entitlement level, but it seems that only using the "entitlement value".

For example, this is a partial whitelist, allowing entitlements with value "Affirmer" to only be able to combined  with entitlements with value "FO", "other", etc. Any other combination not present in this table in not allowed.

Affirmer	Business Treasurer
Affirmer	FO
Affirmer	ICFLead
Affirmer	Other
Affirmer	ReadOnly
Affirmer	Requester

We are saving these values in "customattribute21" in each entitlement.

Is there a supported approach to mimic this SOD approach with Saviynt?

Thanks

[rushikeshvartak]

• SOD is only supported on entitlement values and not on customproperty

[wronzitti]

My understanding is that SOD functions are blacklists, the combination you create in the entitlements section is NOT allowed and triggers a SOD conflict .

Is there a way to use a whitelist approach, where the functions entitlement's conbination is the only possible/enabled ?

Thanks for you quick response. 

[rushikeshvartak]

No exclusion is not supported 

Please raise idea ticket https://ideas.saviynt.com/ideas/EIC-I-5011