Role Detection based on assigned entitlement

[sunilsaurabh]

Let say we create a new Role (call it RoleA) that is composed of 2 entitlements called ent1 and ent2.

At Role creation, some users might already have that combination of 2 entitlements, or might have only 1 and then the 2nd one is given via AccessRequest.

Question: is there a way within Saviynt to "detect" that these users should be assign RoleA? Some other products do have this notion of "detected" role (in opposition to role "assigned" within the IAM product).

[rushikeshvartak · Accepted solution]

Currently its not supported OOTB. Please submit idea ticket for feature request.

You can implement this using analytics report as workaround. 

[sunilsaurabh]

Hi Rushikesh,

I hope you are doing well!

Could you please provide more information about workaround. Please provide query if you have done it in past?

Regards,

Sunil Saurabh

[rushikeshvartak]

•  
• find account having entitlement
• find entitlement is part of which all roles 
• based on above information you can mention which is possible role user can have

[sunilsaurabh · Accepted solution]

Hi @rushikeshvartak ,

I have created the analytics. Thanks for your help. However wondering what action should i chose to assign role to user based on data, because not able to find suitable action in it. Could you please suggest. There are other option to upload the role assignment.

Query to find the missing role assignment if user has all the entitlement assigned from role  :

select t1.role_name as Role_Name,t2.username as username, t2.endpointname,t2.accName,t2.accountkey,t1.rolekey,t2.userkey from(
select r.role_name,a.accountkey,re1.rolekey,ua.userkey, GROUP_CONCAT(distinct ev.entitlement_value ORDER BY ev.entitlement_value) AS valueset from roles r,role_entitlements re1, entitlement_values ev,users u,user_accounts ua, accounts a,endpoints e, entitlement_types et, account_entitlements1 ae where ev.entitlementtypekey = et.entitlementtypekey and re1.ROLEKEY = r.ROLEKEY and u.userkey = ua.userkey and ua.accountkey = a.accountkey and re1.ENTITLEMENT_VALUEKEY = ev.ENTITLEMENT_VALUEKEY and a.endpointKey = e.endpointKey and et.endpointKey = e.endpointKey and ae.ENTITLEMENT_VALUEKEY = ev.ENTITLEMENT_VALUEKEY and ae.accountkey = ua.accountkey GROUP BY r.role_name)t1
JOIN(

select u.username,e.endpointname,a.name as accName,a.accountkey,r.rolekey,ua.userkey, GROUP_CONCAT(distinct ev.entitlement_value ORDER BY ev.entitlement_value) AS valueset from roles r,role_entitlements re1, entitlement_values ev,users u,user_accounts ua, accounts a,endpoints e, entitlement_types et, account_entitlements1 ae where ev.entitlementtypekey = et.entitlementtypekey and re1.ROLEKEY = r.ROLEKEY and u.userkey = ua.userkey and ua.accountkey = a.accountkey and re1.ENTITLEMENT_VALUEKEY = ev.ENTITLEMENT_VALUEKEY and a.endpointKey = e.endpointKey and et.endpointKey = e.endpointKey and ae.ENTITLEMENT_VALUEKEY = ev.ENTITLEMENT_VALUEKEY and ae.accountkey = ua.accountkey GROUP BY u.username) t2 ON (t1.valueset = t2.valueset or FIND_IN_SET(t1.valueset, t2.valueset) > 0 ) and not exists (select 1 from role_user_account rua where (rua.accountkey = t2.accountkey or rua.userkey = t2.userkey ) and t1.rolekey = rua.rolekey )

Regards

Sunil

[rushikeshvartak]

Is it working or do u still need help

[sunilsaurabh]

Hey @rushikeshvartak 

We have found manual way to assign role to user through Upload Role association.  Do we have any automated process?

Another thing is if upload through Upload Role association then Account_key is not getting updated in Role_user_account table, However if we add user through ADD User feature from role'a action. then it is getting updated. Any Idea?

I appreciate your response, it really helpful.

Kind regards

Sunil

[rushikeshvartak]

Thats known limitations hence use ars - multi user file upload