Implemented the SOD for role conflicts.

[vermark]

Hi Team,

We have implemented the SOD for role conflicts.

Example - Let say we have two roles roleA and roleB. No user is allowed to have both roles assigned to them at the same time. If that is the case, it will be a sod policy violation.

To implement it, we have created two functions, function1 with name as roleA and function2 with name as roleB and added the underlying entitlements from roleA and roleB in function1 and function2 respectively.
Now when I remediated an open violation by removing one of the conflicting access a remove access task was generated, after that task was complete the underlying entitlement was removed from the target, but the role is not removed from user profile in Saviynt.

Please let us know how the role will be removed.

Also is there any other way to implement the sod for conflicting roles.

[ParitaSavla · Accepted solution]

You will have to remove the role manually by going to the user --> roles or going to the role --> users as the Role will not get removed in this case.

[vermark]

1. When the underlying enetitlements are removed by sod remediation, you cannot remove role manually also beacuse it becomes a placeholder type object and cannot be removed.

2. Removing roles manaully doesn't sounds like a solution to me. It should be fixed by Saviynt.

Also, i am open for suggestions if role sod's can be implemeneted in some other better way.

[ParitaSavla · Accepted solution]

The function name is just a logical representation and has no actual relation to the enterprise Role. Looks like there is only 1 ent under role a and 1 ent under role b. So remediating the SoD will only remove entA and not Role A. This is expected behavior. 

If you try removing role from user manually it should work because I have tested that scenario where in the entitlement ( belonging to the role) is removed from the account first, after which one can go ahead and remove the role from the user.

Another option would be to use actionable analytics for deprovision role which can be triggered once the sod is remediated and the entitlement task is complete. Please refer to the below example for actionable analytics and tweak the query as per use case

https://docs.saviyntcloud.com/bundle/EIC-Admin-v2021x/page/Content/Chapter17-EIC-Analytics/Configuri...

[vermark]

You got it right we have 1 ent under role a and 1 ent under role b. After remdetiation the entitlement got removed from user account but still we are not able to remove the role. 

We tried both  ways manually and through actionable analytics but still not working.

Is this something environment specific or any other issue? Pls suggest.

[rushikeshvartak]

You can make actionable report with Remove Role Action to remove role object. Yes it seems not fully furnished solution

[ParitaSavla]

It needs to be triaged on Freshdesk for logs as the expected behavior is outlined in the above response.

[Bharadwaj]

Hi, we have a similar requirement where we have more than one entitlement in each role. After we ran the detective SoD job, we do not see the option of remediating the complete role, but we see the option to remediate the respective entitlement only. 

We are using V 5.5 SP 3.17. Have we found a solution to this in the newer versions v2023.01 or do we still need to rely on the Actionable Analytics workaround solution? 

Please let me know.

Thanks.

[vermark]

We are using the analytics report for this

select distinct u.username, r.role_name
, ru.accountkey as acctKey, at.userkey as userKey, re.ROLEKEY as roleKey, 'Deprovision Role' as Default_Action_For_Analytics
from arstasks at
join role_entitlements re on re.ENTITLEMENT_VALUEKEY = at.ENTITLEMENT_VALUEKEY
join role_user_account ru on ru.USERKEY = at.userkey and ru.rolekey = re.rolekey
join users u on u.userkey = at.userkey
join roles r on r.rolekey = re.rolekey
where at.comments = 'Task Created as part of SOD remediation'
and at.status = 3