Privilige Access under entitlement type?

[ejeong]

Can anyone explain me what's use case of this feature? And how to configure it?

[dgandhi · Accepted solution]

Details provided here:

https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter02-Identity-Repository/Viewi...

Privileges: Privileges are granular permissions defined on an entitlement. While requesting access for the entitlement through the access request system, users can add these privileges available for the entitlements. As an administrator, you can configure privileges at an entitlement type level so these would be available for each entitlement on the entitlement type group, for request.

Privileges are optional and are only meant for those applications whose access requires control of granular permissions for the users.

As an administrator, you can define more granular permissions on entitlement for an application and allow users to request these granular permissions when they request the entitlement.

For example, consider an application (Cloud Storage Application) that has entitlement types (Finance, Resources, and Projects), and the administrator wants to allow users to have specific granular access to the entitlements within these entitlement types. This granular access can be Read, Write, etc. permissions for the files within each of the (entitlement types) Finance, Resources, and Projects.

The administrator can create privileges (attribute type: boolean) as Read and Write under the Entitlement Types (Finance, Resources, and Projects), so the users can have granular access (privileges) Read and Write while requesting access to the entitlements.

https://forums.saviynt.com/t5/privileged-access-management/use-of-privileges-in-entitlement-type/m-p...

[dgandhi]

Example Screenshot:

[ejeong]

@dgandhi 

Can you show me how to configure this in connection level?

[dgandhi]

This will be configured at the entitlement type? Are you asking what needs to be passed in the connection json?

[ejeong]

@dgandhi 

let's assume we want to use this for DB access - Write or Ready

How to define provision entitlement A - Read only in Add Access JSON? 

How to import account/ entitlement and making sure this account is member of Entitlement A with READ permission only? 

I want to understand how it works

[Manu269]

Thanks @ejeong 

I was also looking for the same information. 

How this fine grained access will look for recon or provisioning?

@dgandhi Please add more inputs.

[prashantChauhan]

Hi @ejeong 

Please check the below forum post. It should give you the clarification on this. 

https://forums.saviynt.com/t5/privileged-access-management/use-of-privileges-in-entitlement-type/m-p...

Thanks.

[ejeong]

@prashantChauhan this doc isn't explaning about provisioning

[ejeong]

Also I want to know if this is supported in REST connector now...

[prashantChauhan]

@ejeong While provisioning for an entitlement having the Privilege attribute, there will be another button will be shown next to the selected entitlement which can be seen in the below screenshot. It will assign the requested entitlement along with the privilege value if supported by the target application after running the WSretry job.

And No, we currently do not support privileges in the REST connector.