AnsweredAssumed Answered

Handling Deleted Users

Question asked by Jesvin Joseph on Jul 13, 2018
Latest reply on Jul 13, 2018 by Edwin Mullie

Like • Show 0 Likes0
Comment • 3

We have configured the Attribute change rule to trigger termination requests, by adding the users to a local application (which in turn triggers the termination WF). The challenge we have now is that, it is not detecting the deleted users and the IS_DELETED attribute is not available in the rule condition.

If we go with the Provisioning-Termination rule (where IS_DELETED option is available), it is not allowing to add the users to the local application.

What could be the way to handle this ?

Version - 7.0 P05

Attachments

Termination Rule.PNG34.6 KB

No one else has this question

Outcomes

3 Replies

Edwin Mullie Jul 13, 2018 8:14 AM
Mark Correct
Correct Answer
Reason for the attribute rule not to trigger is because the user is deleted, I believe the attribute change rule ignores deleted users.

What is the use case you are trying to solve here? Why would you need to use a local application? And why would you need to run a specific termination WF?

Regards

Edwin
Like • Show 0 Likes0
Actions
- Jesvin Joseph @ Edwin Mullie on Jul 13, 2018 8:37 AM
  Mark Correct
  Correct Answer
  Hi Edwin,
  
  Because of some specific needs, like account locking,moving the user to a disabled OU and some other complicated requirements as part of termination, the only solution was to create local application and WF's for termination which includes multiple provisioning command nodes. Since the business is changing the process now, to delete the users from the source as part of termination, we are looking to see if the rule can be tweaked somehow to to achieve the requirement.
  Like • Show 0 Likes0
  Actions
  - Edwin Mullie @ Jesvin Joseph on Jul 13, 2018 9:14 AM
    Mark Correct
    Correct Answer
    I don’t think what your trying to do will work. I assume you are triggering on is_deleted because the entry is not in the HR feed anymore? I would trigger on is_terminated, that can be used in the different rules. However when a user is terminated you can’t add entitlements to that user, so adding a dummy entitlement will not work
    
    If you want to do everything at once I can see 2 solutions that might work:
    
    1. Use a termination rule to disable account and have some logic in the workflows for the specific applications where you require to do the move account, etc
    2. Have the dummy entitlement assigned when the user joins and use the attribute change rule to remove that entitlement when terminated and then do the things like move account, etc in the workflow of the dummy application.
    
    Option 2 would be de preferred option
    
    Other customers have used a 2 step approach where you disable the accounts first and then after X days do the things like move account, etc.
    
    This use case will be part of the JML recommended practices phase 2 we are currently working. The recommended practices can be found on www.rsa.com/iamrecommendedpractices<http://www.rsa.com/iamrecommendedpractices>
    
    regards
    
    Edwin
    Like • Show 1 Like1
    Actions