000034789 - RSA Identity Governance and Lifecycle 7.0.1 rule pre-processing taking longer time to complete

Document created by RSA Customer Support Employee on Apr 12, 2017Last modified by RSA Customer Support Employee on Apr 12, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000034789
Applies ToRSA Product Set: RSA Identity Governance and Lifecycle
RSA Version/Condition: 7.0.1
 
IssueAfter every collector run finishes ,rule pre-processing is kicked off . If you have many Segregation Of Duties(SOD) rules configured in your application ,you will see considerate increase in the amount of time it takes in the pre-processing run as compared to lower versions.
In the AWR report you will find below query taking longest time:
 
SELECT COUNT(*) AS y0_ from V_COMMON_SOD_RULE_ENTS this_ WHERE this_."RULE_ID"=:1
CauseThe cause for longer runs is that  after pre-processing, the SOD rule is spending time in detecting if there are any common entitlements.
Resolution
 
WorkaroundIn RSA Identity Governance and Lifecycle 7.0.1 we have a configuration setting that would bypass this check.
The screenshot below is the configuration setting on Rules > Configuration page that you need to enable this functionality.
 
User-added image

After enabling this feature, you will see the rule pre-processing completing in less time.
NotesEnabling this option will allow common entitlements in a segregation of duties (SoD) rule.
NOTE: Normally, when the system processes an SoD rule that has common entitlements, it flags the rule as invalid. When this option is selected, processing the rule does not change the status of the rule. However, deselecting this setting may result in the system flagging SoD rules with common entitlements as invalid when an administrator modifies the rule and the system processes the rule."
 

Attachments

    Outcomes