AnsweredAssumed Answered

Application roles not assigned to users

Question asked by Olivier Cheron on Feb 9, 2017
Latest reply on Feb 15, 2017 by Olivier Cheron

Like • Show 0 Likes0
Comment • 5

I'm currently evaluating RSA Identity G&L and when I compare two scenarios I followed, the result is unexpected.

I would appreciate if someone with more experience could confirm if this is a bug or intended behaviour.

I have an application configured both for account/app-role collection and AFX fulfillment.
I checked "Entitlements Require Account" so that assigning app-roles create an account.

In scenario #1: I collect existing accounts and app-roles, then I map them manually to users.

As a result, the account and app-roles are visible in the user details (user "Access" tab, where I can add more entitlements).

In scenario #2: I add one or several app-roles to a user with no prior account in this application, and launch the change request. After approval and fulfillment, the account is created by AFX and app-roles are also assigned in the target application. After account+entitlement collection, the fulfillment is verified and the change request complete.

In the user "Access" tab, the account becomes visible, but not app-roles. The app-roles are linked to the account but not to the user.

I find this result surprising: I would really expect entitlements added in this tab to become visible at the same location.

Does this look like a bug?
I'm using 7.0.1 P02.

Boris Lekumovich

Feb 12, 2017 9:19 PM

Correct Answer

It seems that what is required is sort of a "refresh" to the account user mapping.

Under the Accounts section (in application settings), I've removed the existing mapping (the account became orphan) and then assigned the account back to the user.

Following that action I can now see under the Access tab the relevant application role as well.

Not sure whether it's a bug or works as design.

If you don't get an answer here, consider opening a support ticket.

Consider using an alternative approach to account creation, for example: create a form type Create Account

It can look something like this:

The change request looks like this:

After the changes are provisioned and collected, the new account will appear as orphan account.

Here is the form configuration:

See the reply in context

No one else had this question

Outcomes

Apeksha Anand Shetty

Feb 9, 2017 10:57 PM

Hello Olivier,

Both the scenarios should give the same behaviour. Approles from accounts should be visible under user access tab.

Are you checking this under Directly Entitled or All tab for User Access?

Is this your test environment?

Actions

Boris Lekumovich

Feb 10, 2017 1:34 AM

I believe the you don't see the app roles because the collected account was not mapped to the user.

In Access tab, click on the account which was created and check if the account collector is Local User Mapping or something else (screenshot below)

In your account collector, check the User Resolution Rules section.

Actions

Olivier Cheron Feb 10, 2017 5:51 AM

Yes this is a test environment and I looked both Directly entitled and All in User Access.

On my system the account is mapped to the user, with Local User Mapping as Account Collector. I should have mentioned my account collector does not collect user mappings: I want to manage mappings locally in Identity G&L, not in the target system. I don't have User Resolution Rules.

So this scenario is really about using the user mapping created from the Change Request when the collection runs. Do you think this is possible?

Actions

Boris Lekumovich

@ Olivier Cheron on Feb 12, 2017 9:19 PM

It seems that what is required is sort of a "refresh" to the account user mapping.

Under the Accounts section (in application settings), I've removed the existing mapping (the account became orphan) and then assigned the account back to the user.

Following that action I can now see under the Access tab the relevant application role as well.

Not sure whether it's a bug or works as design.

If you don't get an answer here, consider opening a support ticket.

Consider using an alternative approach to account creation, for example: create a form type Create Account

It can look something like this:

The change request looks like this:

After the changes are provisioned and collected, the new account will appear as orphan account.

Here is the form configuration:

Actions

Olivier Cheron @ Boris Lekumovich on Feb 15, 2017 11:10 AM

Thanks, it's good to know there is an alternative provisioning feature besides account changes.

However this solution is less appealing because:

created accounts are orphans
there is no verification step after provisioning
the execution order chosen for both provisioning commands seems unpredictable

"Refreshing" manually or collecting the account user mappings does work but then I lose the automatic dependency between accounts and entitlements that "Entitlements Require Account" is supposed give.

So I’ll try to open a support ticket and post the result.

Actions

5 Replies

Apeksha Anand Shetty Feb 9, 2017 10:57 PM
Mark Correct
Correct Answer
Hello Olivier,

Both the scenarios should give the same behaviour. Approles from accounts should be visible under user access tab.
Are you checking this under Directly Entitled or All tab for User Access?

Is this your test environment?
Like • Show 0 Likes0
Actions
Boris Lekumovich Feb 10, 2017 1:34 AM
Mark Correct
Correct Answer
I believe the you don't see the app roles because the collected account was not mapped to the user.
In Access tab, click on the account which was created and check if the account collector is Local User Mapping or something else (screenshot below)
In your account collector, check the User Resolution Rules section.
Like • Show 0 Likes0
Actions
Olivier Cheron Feb 10, 2017 5:51 AM
Mark Correct
Correct Answer
Yes this is a test environment and I looked both Directly entitled and All in User Access.

On my system the account is mapped to the user, with Local User Mapping as Account Collector. I should have mentioned my account collector does not collect user mappings: I want to manage mappings locally in Identity G&L, not in the target system. I don't have User Resolution Rules.

So this scenario is really about using the user mapping created from the Change Request when the collection runs. Do you think this is possible?
Like • Show 0 Likes0
Actions
- Boris Lekumovich @ Olivier Cheron on Feb 12, 2017 9:19 PM
  Unmark Correct
  Correct Answer
  It seems that what is required is sort of a "refresh" to the account user mapping.
  Under the Accounts section (in application settings), I've removed the existing mapping (the account became orphan) and then assigned the account back to the user.
  Following that action I can now see under the Access tab the relevant application role as well.
  Not sure whether it's a bug or works as design.
  If you don't get an answer here, consider opening a support ticket.
  
  Consider using an alternative approach to account creation, for example: create a form type Create Account
  
  It can look something like this:
  
  The change request looks like this:
  
  After the changes are provisioned and collected, the new account will appear as orphan account.
  
  Here is the form configuration:
  Like • Show 0 Likes0
  Actions
  - Olivier Cheron @ Boris Lekumovich on Feb 15, 2017 11:10 AM
    Mark Correct
    Correct Answer
    Thanks, it's good to know there is an alternative provisioning feature besides account changes.
    
    However this solution is less appealing because:
    created accounts are orphans
    there is no verification step after provisioning
    the execution order chosen for both provisioning commands seems unpredictable
    
    "Refreshing" manually or collecting the account user mappings does work but then I lose the automatic dependency between accounts and entitlements that "Entitlements Require Account" is supposed give.
    
    So I’ll try to open a support ticket and post the result.
    Like • Show 0 Likes0
    Actions

Application roles not assigned to users

Outcomes

Related Content

Recommended Content

Incoming Links