How could we make User groups to be able to request for specific applications?

[KasperT]

We have Application and Entitlement owner user groups and those should be able to request for specific applications for any user with the Request for others feature. 

We are using Access queries in endpoints to limit visibility. We are not able to use requestor and requestee attributes as we are using enhanced catalog. 

Is there a way that we can bypass the Access queries for these user groups or something to make this work?

[dgandhi]

What is the query that you are trying?

[KasperT]

The query it self is not the issue here and it can be different in different endpoints. We need to bypass it for the group members so they can request for all users regardless if they meet the access query requirements or not. 

[adriencosson]

Hi @KasperT ,

I had a similar issue. As written in the below post, the "requestor" dynamic variable is not accessible in Access Query unless you set the "Enhanced Application Request" is set to "No".

You can find a working query there.

https://forums.saviynt.com/t5/identity-governance/access-query-restriction-based-on-requestor-sav-ro...

Let us know if you need guidance on how to write the query for user groups.

[KasperT]

Thanks but this does not help here. As I said in the post we are using the enhanced catalog and I am aware that we can set it to "No" but that does not help with the issue.

[adriencosson]

@KasperT, Sure I totally understand your issue.

Unfortunately as of now the requestor / requestee dynamic variables are not exposed in Access Query when using Enhanced Application request.

I have brought this up as an idea to Saviynt here that you can upvote  : https://ideas.saviynt.com/ideas/EIC-I-4916 

[DixshantValecha]

Hi @KasperT,

 upvote  : https://ideas.saviynt.com/ideas/EIC-I-4916