A completed change request to remove Aveksa Application/Directory entitlements from a user does not remove the access from the user in RSA Identity Governance & Lifecycle

[#1]

Article Number

000038365

Applies To

RSA Product Set: RSA Identity Governance & Lifecycle
RSA Version/Condition: 7.0.x, 7.1.x, 7.2.x
 

Issue

A change request to remove an Aveksa Application or Directory entitlement shows as completed yet the access still shows on the user's access tab (Users < Users < {user name} > Access tab.)

In the following example, a request to remove the Aveksa Application: Exceptions Manager entitlement from a user was completed but the access was not removed from the user.
 

Image description

 

Image description

 

Cause

When a user is assigned to an Application or a Directory as a Business Owner, Technical Owner, or Violation Manager, they are automatically assigned the required Aveksa Application/Directory entitlement(s) for these roles. This issue occurs if the required entitlement(s) is removed from the user without removing them as the Business Owner, Technical Owner, or Violation Manager of the Application/Directory.

The fact that the change request shows the access has been removed when it has not been removed has been reported in engineering ticket ACM-103280.
 

Resolution

The proper way to remove this type of access from a user is to reassign their role as a Business Owner, Technical Owner, or Violation Manager to another user.  It does not make sense to remove the access directly since the user requires this access to be a Business Owner, Technical Owner, or Violation Manager.

This issue is being investigated by the Engineering team in order to provide a permanent resolution in a future release.
 

Workaround

To remove the Aveksa applilcation access associated with the Business Owner, Technical Owner, and Violation Manager roles, determine which Application/Directory to which the user is assigned as one of these roles and reassign the role to another user. 

For example, to resolve the example presented in this RSA Knowledge Base Article:
 

1. Navigate to Users > Users > {user name} > Access tab
2. Click on the i icon for the Application : Exceptions Manager entitlement.
3. In the pop-up dialog box, click on the Security Scope drop-down.
4. Note the Name(s) listed. These are the Applications and/or Directories to which the user is assigned as a Violation Manager.

Image description

 

5. Navigate to Resources > Applications/Directories > {Application name} > Edit.
6. Scroll to the bottom  of the page.
7. Click on Violation Manager and change the existing Violation Manager to a different user.
8. Click OK > OK to save your changes.

Image description

 

9. Navigate to the Users > Users > {user name} > Access tab and note that the Application:Exceptions Manager entitlement has been removed. If the user has no other Aveksa entitlements, the Aveksa application account associated with that user is also removed.