We have configured a Provisioning - Termination rule, to trigger CR's for users getting terminated. But the rule generates CR's whenever a user is terminated or deleted from the system. Under the Rule Processing summary, It is looking for both terminated and deleted users. Is this a default functionality of this rule.?
V7.0 P05
Sorry for the necro post - I can copy this into a new thread if that's more appropriate.
Mostafa Helmy, we just implemented this rule and what confuses me is why we are checking both Is_Terminated and Is_Deleted since Is_Deleted automatically sets Is_Terminated, which in turn is picked by the rule.
The issue that this is causing is that we are getting duplicate requests - once when Is_Terminated is set and again once Is_Deleted is set. We don't just hard delete terminated users from our Identity source. They are in a terminated status for a period of time and then they are removed from the feed.
Occasionally they will just get hard deleted (in cases of bad upstream data or HR Processing), but that use case is covered by the fact that setting Is_Deleted also sets Is_Terminated.
I'm not sure what valid use case exists for triggering the rule twice for one user.
Note: On version 7.0.2, the Admin guide only mentions the Is_Terminated event:
"Upon detecting that a user’s Is Terminated attribute value is Yes, it initiates one or more actions you specify to delete and disable accounts (immediately or after a particular number of days) and the entitlements the users had prior to their termination."
Our workaround will be to put a user filter where Termination Date > sysdate-3, but it would be nice if the rule only considered the single flag, unless I'm overlooking some use case.
Thanks,
Bill & Prateek Bhatnagar
I guess I misunderstood the problem initially. I do agree with you that I believe a terminated user should only be picked up by the rule ones. If the user is already terminated then gets deleted while already being terminated, then I too believe this user should not be picked up again by the rule and have another duplicate termination request.
I can't say for sure if this is the product design or not, so I would recommend logging a case with RSA support to check why this happens and whether this is expected or not.
Yes that is the default behavior since a deleted user will also be marked as terminated. A user cannot be marked deleted without also being marked terminated automatically by the system.
If you want to exclude deleted users from the termination rule (even though from a best practices perspective I don't think you would want to be doing that), try changing the user filter you have for that rule.
First of all you do not need to add the filter is_terminated = 1 since that is the rule's implicit filter. Try changing it to is_deleted=0 instead and test it.