Specify different scope for the various Request tiles within Saviynt

[Community_User]

Originally posted on June 12 2020 at 11:27 UTC

Saviynt allows controlling for whom a user can request access for. This is controlled via "Whom to Request" option in the SAV Role. This option control access to below mentioned tile -

- RequestAccessforOthers

- RequestAccessOthersMultiUser

- UpdateUserRequest

- ViewExistingAccess

- OneClickDisableUser

Up until the 5.5 base version, the system applied the same scope to all the tiles. If you say request access for your direct reports then this will be applied to all the tiles mentioned above.

From 5.5 SP2 onwards there is an ability to specify the scope specific for each of the tile. Saviynt has introduced an HQL based advance config which allows you to specify the scope for each of the tiles.

Here is a sample of the advance config -

[ {"for":"RequestAccessforOthers,RequestAccessOthersMultiUser,UpdateUserRequest","query":"select a from Users a where a.id < 100000"},

{"for":"ViewExistingAccess","query":"select a from Users a where a.id='${users.id}'"},

{"for":"OneClickDisableUser","query":"select a from Users a where a.id='${users.id}' or a.manager='${users.id}'"}

]

Refer to the attached document for the details.

[Community_User · Accepted solution]

Originally posted on June 13 2020 at 04:35 UTC

Thanks Nitin.

[Community_User]

Originally posted on May 4 2021 at 07:21 UTC

Hi Nitin,

Can we use advance filter to restrict users from scope in Delegates and Modify Approvers? I used something like this below:-

[{"for":"RequestAccessforOthers,RequestAccessOthersMultiUser,UpdateUserRequest,RequestEnterpriseRoles,ViewExistingAccess,CreateDelegates,ModifyApprovers","query":"select a from Users a where a.username not in ('admin','SaviyntSupportAgent1','SaviyntSupportAgent2','SaviyntSupportAgent3','systemadmin')"}]

But in the create delegates screen, I am still seeing admin users. Any pointers will help here?

Regards,

Yashpal