Assign SAV Role as an Entitlement in Enterprise Role

[dvillalta]

Hey all

We have a requirement of assigning a SAV Role for PAM to several users but the assignment needs to be done based in a specific Enterprise Role, preferably if the SAV Role can be inside the Enterprise Role as an Entitlement

Regarding this, I can add the SAV Role as an Entitlement inside a specific Enterprise Role without any issues

The thing is that, once this is done, if I try to add a user to the Enterprise Role the request gets immediately rejected without a reason message, if I remove the SAV Role from the Enterprise Role I can add users without any issues

I've checked the configuration for the SAV4SAV connection as well as the configuration for the Enterprise Roles, and I don't see anything out of place

Basically the question is, can this (assign a SAV Role as an Entitlement inside an Enterprise Role) be done? If it is, what could be causing the user add to be automatically rejected without any error message?

If it is not possible I would guess my only other option would be an actionable analytic, but would prefer if possible to be done the way stated in this post

Thanks

[dgandhi]

Is there any workflow attached for Role Request? Can you check that once?

[rushikeshvartak]

Please check workflow logic , workflow is defined at global configuration.

[dvillalta]

Hey @rushikeshvartak, @dgandhi 

There is a workflow but it is configured as auto approve everything since this is our DEV environment

The other option I found to perform this is make use of Entitlement mapping, therefore I created an AD group and mapped the SAV Role to it, then added the AD group to the Role as an entitlement

By performing this I can add users to the role without any issues, but it looks like the SAV Role is not being assigned to the user (if I go into the SAV Role>Users I don't see the users being added)

The SAV Role itself has a workflow that is set to auto approve everything as well in SAV Role>ROLE_SAV_PAMENDUSER>Workflow

[rushikeshvartak]

• Does Sav role entitlement is active ?
• Can you share logs

[dvillalta]

It is active and I have some users with that role assigned directly from the SAV Roles page as we're performing some PAM testing, these users appear as assigned users under the SAV Role and they can make use f the PAM sections

The users assigned via Enterprise Role do not appear as assigned nor have access to the PAM section, these also applies for the users that have the entitlement that has been mapped to the SAV Role, they do not appear in the users list, nor can access the PAM sections

I can attach logs, but will be able to do it until tomorrow morning ET

[rushikeshvartak]

Check Provisioning connection is working for saviynt app and automated provisioning is enabled

[dvillalta]

@rushikeshvartak 

Sav4Sav connection is working correctly, instant provisioning as well as automated provisioning are enabled in the Security System for Sav4Sav

[rushikeshvartak]

Please share logs

[dvillalta · Accepted solution]

So, after a lot of tinkering and digging around in configurations, I've found what caused the behavior

Inside the endpoint for the SAV4SAV>Entitlement Type it looks like for the SAVRole type the request option was set to None, I modified the option to make use of the None(Create Task) and this appears to have resolved the issue

Now I'm able to add the SAVRole as an Entitlement to the Enterprise Role via Entitlement mapping (as stated posts above) and the request for said SAVRole gets correctly created and assigned, and I see the users correctly listed inside the SAVRole users section

So for anyone having the same issue, make sure to have an auto approve workflow inside the specific SAVRole, perform an entitlement mapping, and check the SAV4SAV>Entitlement Type>Request Option to be set as None(Create Task), this would allow to add a SAVRole as an entitlement inside an Enterprise Role

[rushikeshvartak]

This is standard behavior any entitlement types entitlement added under role should have request option either Dropdown / table/ none (create task) instead of None.

This is not limited to sav4sav

Please click the 'Accept As Solution' button on the reply (or replies) that best answered your original question. @dvillalta