Prevent Modify Account Request for Inactive Accounts in ARS

[adriencosson]

Hi folks,

We need to implement the following for Access Request, and we are struggling with the last piece of configuration : 

• For Active Accounts : 
  • Enable to request for Modify Account Request : Achieved by turning the "Disable Modify Account" option OFF in endpoint
  • Enable to request for Disable Account Request : Achieved by adding "Disable" on State and Status Fields in endpoint
• For Inactive Accounts : 
  • Enable to request for Enable Account Request : Achieved by enabling "Show Inactive Accounts" in Global Config + adding "Enable" on State and Status Fields in endpoint
  • Prevent from doing Modify Account Request : To be achieved

Because "Show Inactive Accounts" in Global Config is enabled and Modify Account operation too in endpoint, is there a way to prevent Inactive Accounts for having "Modify Account" requests performed ?

[NM]

Hi @adriencosson , ootb it is not possible to restrict inactive user to raise a modify account request but as a workaround what can be done is you can create a dynamic attribute and auto populate the value of account is active and tick "hide in create"

[rushikeshvartak]

You can achieve using dynamic attributes 

https://forums.saviynt.com/t5/identity-governance/in-access-request-user-should-be-shown-entitlement...

for you query will be 

SELECT CASE WHEN a.status=  2 THEN 'You are not authorized to request Please select back button to remove application.' ELSE  'You are authorized to raise request for user.'  END AS id FROM users u,user_accounts ua ,accounts a WHERE u.userkey = '${user.id}' and ua.accountkey=a.accountkey and ua.userkey=u.userkey and a.endpointkey=10 

[adriencosson]

Ok @rushikeshvartak ,

So I need to make this attribute significantly visible to ensure end users do not submit the request.

Additional, we need to configure approval workflow to automatically reject the request if it gets submitted with message : 'You are not authorized...', correct ?

[rushikeshvartak]

• From End User perspective there should be clear message shown
• hence attribute should be visible to end user . why they are not able to submit request.

[adriencosson]

Hi @NM ,

If I understand correctly, your workaround is to remove the "Enable" from State and Status Fields and manage it through a dynamic attribute that would help updating the account status during a Modify Account request, right ?

However, whenever an account is Inactive, and you perform a "Modify Account" request, the system considers it as a "New Account" request.

Also, the "Update Account" won't get triggered for an Inactive account, hence we must trigger "Enable Account" at some point.

[NM]

Hi @adriencosson , nope we will still require enable in state field as at some point we need to enable it ..

So for inactive account if they try to modify the request we will have a dynamic attribute which is required and will be having SQL query to check if account is active then user can submit the request otherwise ..we can have that check in SQL as it is required it won't allow to submit request..

[adriencosson]

Got it @NM,

Then how can you prevent end users to submit access request if dynamic attribute does not match, since we cannot have "Validation Condition" for dynamic attribute in Endpoint ?

[NM]

@adriencosson, if DA is not automatically field with a value it won't allow inactive user to submit a request.

SQL query in DA will check user account in the same endpoint if it is active or not, if active populate a value otherwise not ..