• State Verified Answer
  • Replies 7 replies
  • Subscribers 94 subscribers
  • Views 4200 views
  • Users 0 members are here
Options
Related

Indirect Assignments of System Entitlements to Business Roles by System Roles

Frank Kuehn
over 3 years ago

Hi,

I observe a strange behaviour on indirect assignments of System Entitlements to Business Roles (OrgHasUNSGroupB) in One Identity Manager 8.1.2 compared to the old system as 6.1.4

Szenario:

1. Create a System Role (ESet)

2. Create and Assign a System Entitlement to this System Role (ESetHasEntitlement -> UNSGroupB)

3. Create and Assign a Busines Role to the System Role (OrgHasESet)

In both versions the Role Class (OrgRoot) does not allow an assignment of System Entitlements, neither direct nor indirect.

My Observation:

In 6.1.4 the System Entitlement was assigned to the Business Role which was assigned to the System Role with the System Entitlement Assignment (OrgHasUNSGroupBTotal Entry with viInherite = 2 indirect)

In 8.1.2 there is no System Entitlement assignment to the Business Role at all. I had expected an OrgHasUNSGroupB Entry with XOrigin = Indirect assignment

Does the system behaviour has changed in 8.1.2 compared to 6.1.4 or did I missed something, maybe a config parameter I didn't noticed?

The configuration looks good to me (also in comparison to to the old 6.1.4 system).

Any helpful answers are welcome. Many Thanks.

Parents
  • 0 over 3 years ago

    Hi,

    What exactly do you mean by "there is no System Entitlement assignment to the Business Role at all"?

    Do you mean you are unable to assign a system entitlement directly to the Business Role or the users assigned to the Business Role are not receiving the system entitlement?

    I just ran through your scenario and it works for me.

    Have you reviewed the role assignments for the role class itself?  Tasks | Configure role assignments.

    Trevor

  • 0 over 3 years ago in reply to Trevor Pike

    Hi,

    I mean that there is no entry in the Table OrgHasUNSGroupB for the given Org and UNSGroupB.

    In your walk-through, did you allowed your role class to assign system entitlements ("groups" in 8.x) ?

    In my scenario role assignments are NOT allowed for system entitlements / groups.

    To avoid side effects, we don't want to open up the entire role class for UNS.

    If this was a bug in 6.1.4 and it's no longer working in 8.x then we may have to allow these assignments.

     

    Frank

Reply
  • 0 over 3 years ago in reply to Trevor Pike

    Hi,

    I mean that there is no entry in the Table OrgHasUNSGroupB for the given Org and UNSGroupB.

    In your walk-through, did you allowed your role class to assign system entitlements ("groups" in 8.x) ?

    In my scenario role assignments are NOT allowed for system entitlements / groups.

    To avoid side effects, we don't want to open up the entire role class for UNS.

    If this was a bug in 6.1.4 and it's no longer working in 8.x then we may have to allow these assignments.

     

    Frank

Children