Entitlement Type Query

[Abhishek0406]

Requirement:
We need to hide 3 AD groups from requestable entitlements for enduser sav role but display them to specific L1/L2/L3 SAV Role.

How do I achieve it?

If I use a query in "Config for Requestable Entitlement in ARS".

Then it will implement to all identities. Can we expand the query to surpass the restriction on Sav Roles?
can anyone help?

[rushikeshvartak · Accepted solution]

• Create dynamic attribute which will print yes or no if user have L2/L3 
• If yes, then show additional elements by storing yes flag on Entitlement Custom Property 

[Abhishek0406]

HI @rushikeshvartak 
Your recommendation worked. Attaching queries so that others could also get help.

Here is the query used in dynamic attribute to match Sav role of Requestor

Dynamic Attribute name: IsAdmin

select

    id

from

    (

        select

            case

                when sr.ROLENAME in (

                    'ROLE_ADMIN',

                    'ROLE_ADMIN_L1',

                    'ROLE_ADMIN_L2'

                ) then 'Yes'

                else 'No'

            end as id

        from

            users u

            left join user_savroles us on us.USERKEY = u.userkey

            left join savroles sr on sr.ROLEKEY = us.ROLEKEY

        where

            u.userkey = '${requestor}'

            and sr.ROLENAME in (

                'ROLE_ADMIN',

                'ROLE_ADMIN_L1',

                'ROLE_ADMIN_L2'

            )

        union

        select

            "No" as id

    ) isAdmin

limit

    1

Config for Requestable Entitlement in ARS:

ev.status = 1 and (ev.customproperty38 like '%${IsAdmin}%' or ev.customproperty38 is null)