Max End Date for specific entitlements only

[BGMarouene]

Hi All,

We have a requirement to get the start and the end date displayed (optional) for all of the entitlements and enforce the MaxEnd Date for some entitlements only (based on risk value for example).  

We succeeded to get the first part (displaying the start and the end date for all of the entitlements) by setting "ENDDATEREQUIRED": "0" in Config JSON for Request Dates and enabling "Ask For Start Date End Date While Request".

Our problem is with the second part now,

1- If we add "DEFAULTTIMEFRAMEHRS": "X", "MAXTIMEFRAMEHRS": "X" inConfig JSON for Request Dates, max end date becomes applied for all of the entitlements.

2- If we add "and ev.risk = 3" in Entitlement Filter Query for Request Start/End Date then the start and the end date is displayed for entitlements having risk 3 only (entitlements with risk different than 3 will not get the start and the end date displayed at all).

Is there a way to get the start and end date displayed for all of the entitlements and enforce a max end date for few of them ?

Thanks.

[rushikeshvartak · Accepted solution]

• Currently its supported for all entitlements matching condition defined at endpoint level
• 
• Please submit idea ticket for this enhancement For any desired improvements or enhancements to this process, Saviynt encourages you to submit your proposal through Saviynt's Ideas Portal at https://ideas.saviynt.com/ideas/
  
  Your valuable input is crucial to shaping the evolution of Saviynt systems.
  
  Please notify us once the idea ticket has been created.

[BGMarouene]

Hi,

Thanks for you reply !

As MAXTIMEFRAMEHRS is configured at the entitlement type level, is there a way to get a specific entitlement type for the entitlements that we want to enforce the MaxEnd Date for them ?

Thanks.

[rushikeshvartak]

• This can be configured under each entitlement Type.

[yogesh2]

will remove access task be created automatically on the revocation date? or do I need to run a job to create the remove access tasks when entitlement is about to expire?

[NM]

Hi @yogesh2 , yes remove access task gets created automatically on the end date.

But you have to schedule a job enterpriserolemanagment which will automatically take care of the revoke access.

[rushikeshvartak]

Tasks created on same date but will process in future you can check task future date in startdate column in arstasks table

[yogesh2]

I have enabled the configuration on the entitlement type and I am able to set the end date for each entitlement during request: 

But revoke access tasks are not getting created and neither I can see start time and end time on assigned entitlements:

I have also scheduled EnterpriseRoleManagementJob:

Is there some config I'm missing?

[NM]

Hi @yogesh2 was these entitlement assigned from saviynt??

Share request screenshot.

[yogesh2]

yes these were requested from Saviynt and assigned by Saviynt as well

[rushikeshvartak]

There are 2 configurations for same.

• 1 Global Config - Create Task if Start date less than
  • In your case keep 10 minutes. 
•  
• 
• 2 Job  -EnterpriseRoleManagementJob - Already Scheduled 

[NM]

Hi @BGMarouene , currently it is not supported to have different max end date for entitlement.

What you can do is handle it in workflow in the if else condition for a specific entitlement. If dates exceed a particular period reject the access.

[BGMarouene]

Is there a way to customise the error message that will be returned to the user in this case ? Just so that he understands that his access request has been rejected coz the end date exceeded the end date we want ? 

[Raghu]

@BGMarouene  it wont support filter criteria query condition level , need to raise idea.

[aidanryan]

@BGMarouene Was there ever an idea posted? 

[rushikeshvartak]

Yes i have already raised idea around this

https://ideas.saviynt.com/ideas/EIC-I-4633

[aidanryan]

@rushikeshvartak Thank you, voted for it!