Terminated users are not displayed while manually mapping accounts in RSA Identity Governance & Lifecycle 7.1.0
Originally Published: 2019-02-12
Article Number
Applies To
RSA Version/Condition: 7.1.0+
Issue
Cause
In RSA Identity Governance & Lifecycle 7.0.2, it was possible to view as well as add terminated users to an account as follows:
However this poses a security threat as the terminated users will still have access to the application(s) via mapped accounts.
Resolution
Terminated and/or deleted users should not have access to the system and their respective account mappings should be removed from the source system to prevent any possible security issues. This cleanup is essential as these users will still be collected if they exist in the source system.
In an RSA Identity Governance & Lifecycle 7.1.0 system, terminated users will neither be displayed nor returned in the search results to avoid adding them to the accounts and hence prevent the security risk.
If you specifically search for a terminated user, the user will not be returned. In the example below xyz is a terminated user.
Searching for xyz will not return a result, as shown below:
