Hi All, I want to form an User Access Review that will show direct entitlements those are explicitly granted. But review results have shown not all entitlements, there are missing ones when I have checked from the database. I am putting attachments below. Any comments to this subject? Thanks, Adem |
Review Properties;
Review Result: 9 rows data came;
In Database, there are 11 rows of data why 2 of them not be shown in review results?
I put attachments, can you check ?
Thanks.
Have you tried this option?
yes I have tried, nothing changed.
The user access review will show only the authorizations which are assigned to a user or to an account and the account is mapped to a user.
Are the missing authorizations assigned to someone?
Yes they are assigned to these accounts in blue color.
It's not clear whether the screenshot is a representation in RSA G&L or in some end point.
In RSA G&L, under user's Access tab, do you see those authorizations?
Can you share a relevant screenshot (similar to one I pasted below) ?
First account that should have had UNLIMITED TABLESPACE entitlement here but not listed below
there isn't entitlement type like ent
Similarly, second one that should have had CBMS.CBMS entitlement here but not listed below
there isn't entitlement type like ent
In user review, you can only review what is assigned to users. So if the missing entitlements (CBMS.CBMS and UNLIMITED TABLESPACE) are not assigned to a user they will not appear in user review items.
If that account should have one those entitlements assigned to it, I suggest you review your collector configuration and review the collection results/raw data. Maybe they are being rejected due to some reason.
Hi Boris,
The account should have these entitlements assigned to it, I have checked what you have asked for,
-It is found the collector query result
-It is found in the collection result
-It is in raw data
But user's access tab it is not found, also in review list, how can we proceed?
In the access tab of the user, check if you see the entitlement under All tab (screenshot below)
In All tab, it is found, but should it be in Directly entitled tab?
It might granted as part of the DBA app role.
Click on the DBA app role, under Sub-Components section, do you see that entitlement?
Yes, it is found
As the highlighted entitlement (in your screenshot) is part of an application role, it will not be visible to the reviewer in a user access review.
The reviewer will see only the granted app role (DBA) and not the granular entitlements which construct the actual authorizations of the app role.
Hi Boris,
This explanation makes sense, but our query that brought account-entitlement had the data of UNLIMITED TABLESPACE for TCNBOZA.. account. It looked like directly entitled, but you have said that it is under also the DBA approle, so no need to be shown in review.
I'm a bit confused. My conclusions are based on the provided information.
What is the behavior you expect to see?
Yes, I am also confused, first I provided with my screenshots and query results, account has a direct entitlement called UNLIMITED TABLESPACE, then we found that account has approle called DBA, and then approle DBA also had UNLIMITED TABLESPACE entitlement, so entitlement type is both direct and via approle
You haven't specified the expected behavior.
Do you expect to see UNLIMITED TABLESPACE under user's access? If yes, then why (as it's granted by DBA app role)?
To test the collector configuration, add a new account (map it to another user) with only UNLIMITED TABLESPACE entitlement.
Collect the information and check if now you see that entitlement under user's access.
Hi Boris,
I am answering on the behalf of Adem.
I have done the tests you suggested. There is no problem, the data I have created is coming to both review, database and user's access,
but I have questions for you for the other datas that should come to the review but they couldn't due to our query below. Can you check the query maybe the criterias not bring directly entitled ones?
*Oneflow Application Id for the XXXX
Account-(Direct)Entitlement Query:
SELECT taa.name AS UserId,
te.resource_name AS ResourceName,
te.action_name AS Action,
SUBSTR(te.resource_name,1,INSTR(te.resource_name,'.')-1) AS Owner,
te.cas3 AS ObjectType
FROM
t_av_explodeduserentitlements tae,
t_entitlements te, t_av_accounts taa,
t_applications tap, t_master_enterprise_users
WHERE tae.deletion_date is null
AND te.deletion_date is null
AND taa.deletion_date is null
AND tae.entitlement_type = 'ent'
AND tae.entitled_type = 'account'
AND tae.entitlement_derived_from_type = 'explicit'
AND tae.entitled_derived_from_type ='explicit'
AND tae.entitled_source_type='explicit'
AND tae.entitled_id = taa.id
AND tae.entitlement_id = te.id
AND tap.id = tae.application_id
and t_master_enterprise_users.user_id = taa.name
AND tap.cas1 IS NOT NULL
AND tap.cas1 IN ('XXXX')
AND tap.is_deleted = 'FALSE'
order by taa.name ;
Query brings that data:
When we check user's access ALL tab, UNLIMITED TABLESPACE is found both via approle DBA and itself
Directly Entitled Tab no entitlement UNLIMITED TABLESPACE (So our query is wrong ??Shouldn't have it come here and review ??)
Thanks.
Tilsim, as a test, can you remove the DBA role from TCNBOZACI.... account and see if the User Access tab updates to show the Direct Entitlement of Unlimited Tablespace? Also what version of Aveksa are you running. I am thinking of an old support case I submitted where I had this same issue and RSA came back saying that if a user has a directly assigned entitlement that was also granted via App Role, the Direct Ent would not show in a review by design. This was on 6.8 or 6.9 through, so may have been "fixed" since then... Just sounds very familiar.
I knew this sounded familiar - I had the same issue in 2015. Here is the response from RSA at the time. I happen to disagree with their position, but they have confirmed this is the intended design of the product:
-----Original Message-----
From: RSA_Customer_Support [mailto:caseupdate@rsa.com]
Sent: Thursday, October 08, 2015 11:46 AM
To: May, William J
Cc: Lindberg, David
Subject: RE: AMERIPRISE FINANCIAL | Support Case # 00731669 | Missing entitlement [ ref:_00D70IwPy._500701 [ ref:_00D70IwPy._500701PHxAE:ref ]
It's important to contextualize this from the perspective of the reviewer. In the event that a user has the same item both directly and indirectly and we showed this item in review, if the reviewer chose to revoke it for business reasons the access would not actually be being removed. The user would still have said access indirectly, even though the intention of the reviewer is to have it removed all together.
So let's say a manager of a technical team who is not inherently technical them self was in-charge of performing this review. Seeing an item in the review indicates that it can be acted on, so he removes the item and now assumes the access will no longer be present. However, due to the duplicated access through the app-role, this user still has this access however the manager believes it has been removed. It is situations like this that we work to circumvent by not presenting indirects to reviewers. Access is correctly reflected in the product, however we restrict the ability to basically make decisions that will not achieve what the user expects they will achieve.
Thank you
Brett Blakeney
Principal Support Engineer
RSA - Aveksa Technical Support
Hi Brett,
I've discussed this with my leadership and we are all in agreement that we should never preclude a manager from seeing direct entitlements that are assigned to the user. I understand your comments about simplifying the end user experience, however, we never want to hide direct access in a review. We can address the complexity through training and education.
It's also worth mentioning that this is not only being hidden in reviews. When you navigate to the Users tab, and go to the Access tab of the user, you are still unable to see the entitlement when "Directly entitled" is selected.
Can you let me know if a configuration option or other solution exists that would give me my expected results? My leader will be meeting with Product Development next week at the CAB in Chicago, and is prepared to bring this to the board for the discussion if there isn't a solution, so if you could let me know by Tuesday, I'd greatly appreciate it.
Bill
Thank you for the info you gave,
I have made the test below;
First I added to the user an entitlement,
It was shown in UserAccess Directly Entitled Section and Review Result
Then I added an approle to the user that includes this entitlement
Ran the review, but review began to show neither this entitlement nor this approle because of the duplication
This design is still same in 7.0... version also.
I can't see the pictures. Are they available in your browser?