Change in the review behavior while using "Include group memberships that are entitlements of their assigned global roles" option in RSA Identity Governance and Lifecycle
2 years ago
Originally Published: 2016-11-03
Article Number
000042282
Applies To
RSA Product Set: RSA Identity Governance and Lifecycle (G&L)
RSA Version/Condition: 7.0
 
Issue
A user has access to a group entitlement and a global role is created including that group entitlement, app-role and entitlements. While generating the user access review including the user and the global role, the review item includes both the group entitlement and the global role. This behavior is expected only when the "Include group memberships that are entitlements of their assigned global roles" option is checked in the Contents tab of the review definition. However, if this option is checked, the review item should show a separate activity for the group entitlement but this is working in the opposite way. Instead of including the group entitlement it excludes the group entitlement in the review item.

As an example,
  1. Add a group entitlement to a user.
  2. Create a global role include the user, group entitlement and few other entitlements.
  3. Create a review definition and uncheck the Include group memberships that are entitlements of their assigned global roles option under the Contents tab.
User-added image
  1. Run the review and the group is listed in the Unassigned Items tab, though the same group is present in the global role.
User-added image
  1. Now edit the review definition and check Include group memberships that are entitlements of their assigned global roles in the Content tab.
User-added image
  1. Run the review and the group is not listed in the review items under the Unassigned Items tab.
User-added image

 
Cause
The UI option to include or exclude indirect groups is working backwards.
Resolution
Upgrading to Version 7.0.1 will fix this issue.
 
Don't see what you're looking for?