Nesting local and collected roles in RSA Identity Governance & Lifecycle
Originally Published: 2020-03-10
Last Modified: 2023-10-06
Article Number
000049673
Applies To
RSA Product Set: RSA Identity Governance & Lifecycle
RSA Version/Condition: 7.0.x, 7.1.x, 7.2.0
 
Issue
One of the strengths of the RSA Identity Governance and Lifecycle offering is the ability to model groupings of user access using our local role management solution. This provides the capability of combining different types of entitlements (access) that are collected from various end points. These local roles, whether they are defined as business, technical or global roles, allow you to customize the necessary access that is required for different jobs in an organization. These become the building blocks of access by allowing you to combine various local roles that will fully define the access needed for your user population.

A local role is different from a collected role. A collected role, like other collected information, is access obtained from an endpoint which maintains that information externally from our system. Like any collected items, a collected global role is suitable to use as an entitlement in a local role. However, the opposite is not true. A potential problem can occur when a user attempts to add a local role as an entitlement to a collected role. The endpoint that maintains the collected role definition does not know anything about our internal (local) roles – which contain entitlements from a number of other types and sources, including other local roles and local entitlements. This makes provisioning of the information difficult, if not impossible, and extremely confusing.
 
Resolution
At this time, there are areas of the RSA Identity Governance & Lifecycle application which inadvertently allow the addition of local roles to collected roles. This is not intentional, and RSA plans to remove that capability in future releases.

Related Articles

Trending Articles

Don't see what you're looking for?