Delegation to Person who is being attested

Hello Identity Manager Community,

I ran into the following situation:

'Person A' delegates an attestation for a ADSAccountInADSGroup-object to 'Person B'.

'Person B's entitlement /group membership is being attested by the attestation and the Person-Object is set as 'related object 3' / 'ObjectKey3' on the AttestationObject.

'Person B' is now able to attest his own entitlement / group membership, even though the ConfigParm 'QER\Attestation\PersonToAttestNoDecide' is set.

This only seems to happen if you use a single-delegation, as a deputy delegation causes the expected behaviour. (Not delegating the objects, that attest the person thats being delegated to)

Is there a way to prevent this?

In kind regards,
Daniel

0 Markus Weiss-Ehlers 7 months ago

Can you please clarify the use case for me? With single delegation, do you refer to a delegation during the approval of the attestation?
Cancel
Up 0 Down

Reply

Verify Answer

Cancel
0 Daniel Dornhof 7 months ago in reply to Markus Weiss-Ehlers

Yes, im talking about the delegation during the approval of the attestation case.
Currently this can be delegated to the target of the attestation, which is not wished for.
Cancel
Up 0 Down

Reply

Verify Answer

Cancel