How to Achieve Realtime Provisioning of Access

[prashantChauhan]

Use Case

Consider a scenario where a retail organization uses a Database System where access to modify (update, delete, truncate, insert e.t.c is considered to be of high risk). Therefore firefighter roles are implemented which gives you write permissions for a half-hour time frame(default time frame). The task is to insert some 1k new orders into the system without which orders cannot be taken out for delivery. Given your query execution might take some time, it is very important to use each minute out of those 30. Therefore, if you have to wait for scheduled jobs, say 15 minutes, you lose half of the time waiting for your access and you might not be able to complete your activity in the next 15 minutes. Achieving real-time provisioning is very crucial in such scenarios.

Pre-requisites

NA

Applicable Version(s)

All

Solution

Achieving real-time provisioning of access involves two factors:

a. Instant creation of tasks as soon as the request is submitted

b. Instant fulfillment/provisioning of access as soon as the task is created

How to achieve instant creation of tasks?

In the case of role-based entitlement tasks creation(or tasks for standalone entitlements where startdate is present), one of the two can happen

1. If the start date for the role is less than when the request is marked completed (all approvals are in place) then the tasks are created as soon as the request is marked completed 
2. If the start date is greater than when the request is marked completed (future date) then there is a need to run EnterpriseRoleManagementJob(this job creates tasks for all the future start date entitlements) to create the tasks for role entitlements.

To achieve instant creation of tasks, there is a config available in Global configurations(Tasks->Settings) as below-

This config enables you to have tasks created even in case startdate is a future date. You can specify the time difference between current date and role start date till which you want to create tasks without running the EnterpriseRoleManagementJob. This especially helps you  in case of firefighter access where the access granted is time bound and even a minute is crucial  . If your EnterpriseRoleManagementJob is scheduled for every 15 mins , you do not have to wait for another 15 minutes for tasks creation , but you can have those created as soon as the request is approved

NOTE – Maximum time difference allowed in the product in 15 mins . You can leave this config as blank in case you do not want to create role entitlement tasks without EnterpriseRoleManagementJob job.

Instant creation of tasks can be achieved with Enterprise roles and Application Roles as well . Enterprise Roles and Application roles also exhibit same technical behavior as firefighter role where you provide start date and end date . However , you might not have default time frame added in case of these type of roles but you can come across time bound scenarios where end users have explicitly selected a time difference of half hour or one hour between start date and end date. 

How to achieve fulfillment/provisioning of tasks?

To achieve real-time provisioning we have a config 'Instant Provisioning' under the security system which instantly provisions the access once you have the tasks created without losing time. Enable the below config to achieve the same.

Real-time provisioning can be achieved with Enterprise roles and Application Roles as well. Enterprise Roles and Application roles also exhibit the same technical behavior as firefighter roles where you provide a start date and end date. However, you might not have a default time frame added in case of these types of roles but you can come across time-bound scenarios where end users have explicitly selected a time difference of half an hour or one hour between the start date and end date. 

References

https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter13-Access-Requests/ars-set-u...