IGL Roles and auto-assignment of entitlements
Hello, we have an interesting situation. Right now, we have roles set up for all employees to gain access in our Oracle EBS suite as part of their birthright access when they join the company. The entitlements in these roles are correctly being assigned automatically in Oracle.
We have also developed separate roles for our role-based provisioning initiative that has Oracle EBS entitlements in it, however we do not want these entitlements to be automatically assigned to the employees that fit the membership criteria. Rather, we would like the newly developed roles to assign a manual task while still allowing the birthright entitlements for new employees to be automatically granted via the Oracle EBS Connector.
Is this easily possible?
- Community Thread
- Forum Thread
- Identity G&L
- Identity Governance & Lifecycle
- Role Management
- RSA Identity
- RSA Identity G&L
- RSA Identity Governance & Lifecycle
- RSA Identity Governance and Lifecycle
- RSA IGL
i might be confused, however could you not:
1. have a role for the birthright access you need, which is auto applied as per the joiner process.
2. you have another role, which end users need to manually request access for?
so if you split it out into 2 separate roles, would that work?
It's possible but how easy is it to implement depends on how familiar you are with the workflows.
Basically, you will need to create a decision tree inside the fulfillment workflow for Oracle EBS where you choose the path i.e. AFX[Automated fulfillment] or MF [Manual fulfillment] depending on how the CR was created or other criteria based on your use-case for decision node.
If you are asking about conditional provisioning of entitlements comming from the same directory/application with a valid and working AFX connector mapped to that directory/application where you want some entitlements to be provisioned via AFX while other to have a manual activity assigned, then I believe Dipendra's approach is the way to go.
On a side note, are you able to divide the entitlements requiring manual fulfillment and move them to a "new" business source that will have the manual activities workflow set for fulfillment & won't have a connector bound to it?