Suggestion in mover scenario for enterprise role

[TheSaviyntBoy]

Hi,

We have a requirement where we need to assign the AD groups according to the title of the employee(RBAC Model). We have created enterprise roles matching the titles and giving the roles dynamically in the technical roles while joining.

There are also conflicting titles: like the title names are same but the departments are different and the entitlements to assign are also different. To tackle this, only for the conflicting titles we used a CP5 to concat title - department and created the roles with the same names too.

We are facing issue when its mover scenario. The new roles are getting added according to the title but the previous roles aren't getting removed. What can be causing this issue?

Here is the tech rule:

[NM]

Hi @TheSaviyntBoy , please check if this config is ticked in global configuration 

Config Name: For Remove Birthright Task check if Access is Assigned From Rule

If not enable it and give it a try

[TheSaviyntBoy]

Hi @NM, I don't see any checkbox or config with that name in global configuration. 

Maybe the label is changed? Searching for it as well. 

[NM]

Hi @TheSaviyntBoy , check under roles tab

[TheSaviyntBoy]

Hi @NM, am I missing something?

[NM]

@TheSaviyntBoy , check under rules tab of global configuration once.

[TheSaviyntBoy]

Hi @NM, nothing related was found. 

[rushikeshvartak]

Please share logs

[stalluri]

@TheSaviyntBoy 

• Check if the assignedFromRule,assignedFromRole  and assignedFromRoles populated for the user account under accounts_entitlement1 table. (validate the data for few user, if the association are correctly populated. Where current assigned entitlement and previous have values present in the table for above-listed attributes)
• If they are not present, try running the retrofit job to populate those values.

1. https://docs.saviyntcloud.com/bundle/EIC-Admin-v24x/page/Content/Chapter05-Policies/Repairing-Rule-U...
2. https://docs.saviyntcloud.com/bundle/EIC-Admin-v24x/page/Content/Chapter02-Identity-Repository/Repai...

• After running these jobs, check if the association are getting populated. If they a populated then on the next run if the condition fails it will add access and remove access if condition fails.
• If the issue still persists check with Saviynt support team if indexes are present for the accounts_entitlement1 table.
• They can provide you some workarounds and solutions to populate those values.

[vvnibm2002]

Hi @TheSaviyntBoy - Did this issue get resolved? If so, can you please share the resolution because I am running into a similar issue with the roles configured in Saviynt.

[indra_hema_95]

Hi @vvnibm2002 He is actually from my team. To make it clear it didn't solve. We had multiple calls with Saviynt and we showcased this to them but no resolution we got. In our environment. 

Basically internally for the role which supposed to remove, for that associated entitlement remove access task is getting generated and completed but from user to role association it is not removing, means at the UI level it still shows the old role. 

What we also observed was if by any chance any of the user attributes get's updated again (which is nothing to do with roles) then the old role is getting removed.

Regards,

Indra 

[rushikeshvartak]

Old roles never gets removed this is current product limitation

[indra_hema_95]

Hi @rushikeshvartak ok, but from IAM perspective this is not right correct?

Regards,

Indra

[rushikeshvartak]

This is not expected and idea is already raised 

https://ideas.saviynt.com/ideas/EIC-I-5078

https://ideas.saviynt.com/ideas/EIC-I-2392

[vvnibm2002]

Thanks Indra. This is exactly what I am also seeing in v24.2 and v24.5. When the issue was first reported in v24.2, we were asked to upgrade to v24.5. But the issue still remains in v24.5. The end result is that Saviynt shows that the user accumulates roles during the various moves that the user makes in the organization. Another use case that is impacting is that the enterprise roles are not getting deprovisioned by the user update rule when statuskey = 0 even though there is an option configured in the user update rule to deprovision the role. One behavior of Saviynt that I noticed is that any actions configured after "Deprovision Role" are not being executed by Saviynt and therefore Deprovision Role has to be the last action to be configured in the user update rule. This issue was observed in v24.2 for which the upgrade was done to v24.5 but the issue still persists.

[indra_hema_95]

@vvnibm2002 Yes correct. The ideas already raised it seems, which is shared by Rushi. Please open that and take a look and give the vote, so that this gets accepted by Saviynt to do the fix.

Regards,

Indra

[rushikeshvartak]

Share to Saviynt team and work with CSM to prioritize