Clone of ROLE_ADMIN does not provide access to the list of security systems and endpoints

[krecpond]

We have a requirement to provide admin access in PROD to engineering team based on approved requests. A SAV role ROLE_ADMIN_RESTRICTED has been created and replicated on SAV4SAV endpoint as an entitlement. This role was copied from ROLE_ADMIN.

The role has the exact same set of feature access, webservice accesses and configuration on the Create Request Home Option tab and the analytics tab.

However, users from engineering team assigned to this role are not able to see the list of security systems and endpoints.

Why is this happening when the SAV role is a copy of the ROLE_ADMIN SAV role?

[dgandhi]

Assign this newly created Sav Role in the connection as Default Sav Role. Once it is assigned in the connection , it should work.

[krecpond]

Unfortunately this solution will not work because part of the support team requires ROLE_ADMIN as persistent access and is also configured on all the connection objects. This role is equivalent to the ROLE_ADMIN except that the users in this role will be removed in 24 hrs from the time they are provisioned. This is like an emergency / "need-basis" account for engineering to perform deployments and triage P1 functionality / process issues in IGA.

Is there a viable solution for this requirement?

[krecpond]

One more gap that I noticed with this role is that I am unable to manage membership to other SAV roles using this role. How can I overcome this issue?

[krecpond]

Yet another gap is the ability to view the list of policies - User update rules, technical rules, organization rules, etc.

[naveenss]

Hi @krecpond , for the users having custom sav role to view the policies, the user should be assigned as a rule owner.

[krecpond]

So basically the product is not capable of scaling up to use custom admin SAV roles. I think we will just need to use the OOTB ROLE_ADMIN and make sure that the user is removed from it when the use of the role is done by engineering in PROD. I was doing a feature parity comparison to migrate this from IIQ to Saviynt and looks like Saviynt does not support this feature.