Saviynt unveils its cutting-edge Intelligence Suite products to revolutionize Identity Security!
Click HERE to see how Saviynt Intelligence is transforming the industry.
Saviynt Copilot Icon

SoD approver is getting all entitlements even though it doesn't have a violation

IAM
Regular Contributor
Regular Contributor

For some reason, if there is an SoD violation, after it goes through manager approval, even the entitlements that have not caused an SoD violation is going to the SoD approvers. Why is that? This is causing issues because the SoD approver is rejecting these entitlements because they are not the approvers of that entitlement but it's still going to them because of the SoD violation for a different entitlement.

 

IAM_1-1709141510940.png

As you can see here, the top entitlement was the only SoD violation

IAM_2-1709141685603.png

 

But it was still sent to SOD Owner Task for approval

IAM_3-1709141746398.png

 

6 REPLIES 6

rushikeshvartak
All-Star
All-Star

If request contains sod it will route to SoD Approval Group its expected behaviour


Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.

IAM
Regular Contributor
Regular Contributor

All entitlements? Even entitlements that did not trigger the SoD violation?

If you particular entitlements causing sod to be routed then use if else block

SODViolation.get('High') > 0 
SODViolation.get('low') > 0


Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.

IAM
Regular Contributor
Regular Contributor

Thank you Rushikesh.

Are you saying to remove this from my if else block:

SOD != null and SOD gt 0

 

And instead add this (I have the OR so that I can get all violations):

SODViolation.get('High') > 0  or SODViolation.get('low') > 0

 

"SOD != null and SOD gt 0" isn't already filtering the entitlements with the SOD violation?

Sod variable just check if request have sod or not. Sod violation variable check type of sod


Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.

IAM
Regular Contributor
Regular Contributor

SODViolation.get allows me to filter out the entitlements that do and dont have an SOD violation? That will solve my problem if I can filter the entitlements rather than just to check if request has an SOD or not.