AnsweredAssumed Answered

How does the system decide between account vs user changes

Question asked by William May on Jul 12, 2018
Latest reply on Jul 23, 2018 by William May

Like • Show 0 Likes0
Comment • 10

Can someone explain to me how the system decides to create an account change vs a user change?

For example, on the PV_CHANGE_REQUEST_DETAIL table, some changes are listed as Type = RemoveAppRoleFromAccount and some are listed as RemoveUserFromAppRole.

Mostafa Helmy

Jul 13, 2018 7:27 AM

Correct Answer

There are two conditions where a change would be Account Change:

You have set "Entitlements require accounts" to "Yes" under the Directory/Application Request configuration of the entitlements requested.
Starting v7.0.1 and above, if the affected user has more than one account in the Directory/Application of the entitlements requested.

As for the difference between both:

User Changes

The user does not requrie having an account to request the entitlement.
During verification, the product does not care from which path did the user get entitlement.

Account Changes

The user must have an account for a change to be of this type.
During verification, it is very specific that the user must get the requested entitlement through the Account mentioned in the change item details.

For example: User U1 has two accounts A1, A2. If the change request Change Item says Add A1 to Group G1, then it will only verify if A1 gets the Group ... not A2 even though both are owned by the same user.

See the reply in context

No one else had this question

Outcomes

10 Replies

Zoltan Izsak Jul 13, 2018 3:49 AM
Mark Correct
Correct Answer
If you have checked 'entitlement needs an account' on application then the system will add entitlement to an account or if there is none then in first step create an account.
If the checkbox is unchecked then the user will be granted with the entitlement.
Like • Show 0 Likes0
Actions
- Marek Lotocki @ Zoltan Izsak on Jul 13, 2018 5:56 AM
  Mark Correct
  Correct Answer
  I think that @William May as what is the difference between user changes and account changes - not account creation - am I right William?
  Like • Show 0 Likes0
  Actions
  - William May @ Marek Lotocki on Jul 17, 2018 12:33 PM
    Mark Correct
    Correct Answer
    That's correct. Currently my implementation is not handling account creation or add access requests.
    Like • Show 0 Likes0
    Actions
Mostafa Helmy Jul 13, 2018 7:27 AM
Unmark Correct
Correct Answer
There are two conditions where a change would be Account Change:
1. You have set "Entitlements require accounts" to "Yes" under the Directory/Application Request configuration of the entitlements requested.
2. Starting v7.0.1 and above, if the affected user has more than one account in the Directory/Application of the entitlements requested.
As for the difference between both:

User Changes
1. The user does not requrie having an account to request the entitlement.
2. During verification, the product does not care from which path did the user get entitlement.
Account Changes
1. The user must have an account for a change to be of this type.
2. During verification, it is very specific that the user must get the requested entitlement through the Account mentioned in the change item details.
For example: User U1 has two accounts A1, A2. If the change request Change Item says Add A1 to Group G1, then it will only verify if A1 gets the Group ... not A2 even though both are owned by the same user.
1 person found this helpful
Like • Show 1 Like1
Actions
- William May @ Mostafa Helmy on Jul 17, 2018 12:34 PM
  Mark Correct
  Correct Answer
  Thanks Mostafa, this is great info. Did I miss this in the admin guide or is this just your general knowledge? Curious where these things are documented.
  Like • Show 0 Likes0
  Actions
- William May @ Mostafa Helmy on Jul 17, 2018 2:14 PM
  Mark Correct
  Correct Answer
  I just did a little testing and I have a couple follow-up questions...
  I cannot update the business source to require accounts since I am not doing access request. I get the following error: ""Entitlements Require Account" cannot be set to YES if there are no account templates with a valid "Name" pending account parameter."
  Even without changing the above parameter, I am getting different results depending on the input process. In one instance, I am remediating an SOD rule violation, and in another I am selecting "Revoke" from a User Access Review definition result. However, the SOD initiated revoke creates a user change, while the UAR creates an account change. I am testing with the same approle from the same business source. The settings on fulfillment nodes in the request workflows are the same between the two sources, so the fulfillment workflow is exactly the same. The only variable is the user, and the user's tested have only one account in the source directory.
  I even went as far to do a negative test where I took a user with two accounts in the source directory and processed a revoke in the UAR and the SOD violation remediation and it still seem consistent that UAR produces remove approle from account and SOD remediation produces remove user from approle.
  
  Seems as if I'm still missing a piece of the puzzle.
  Like • Show 0 Likes0
  Actions
  - Boris Lekumovich @ William May on Jul 17, 2018 11:12 PM
    Mark Correct
    Correct Answer
    What version are you on?
    Like • Show 0 Likes0
    Actions
    - William May @ Boris Lekumovich on Jul 23, 2018 2:57 PM
      Mark Correct
      Correct Answer
      7.0.2 P07
      Like • Show 0 Likes0
      Actions
  - Mostafa Helmy @ William May on Jul 18, 2018 6:22 AM
    Mark Correct
    Correct Answer
    I don't think any place explicitly explains this, its more of general knowledge as you say. I have also never tested these scenarios with SoD rules, but I guess it may be historic that SoD rule violation would always be a User Changes, since SoDs work on a User level.
    
    If a user has a toxic entitlement combination, we wouldn't care from which account he has it. The main concern would be that the user does not have that entitlement at all anymore ...
    
    However I guess this could potentially create problems for AFX in fulfillment phase if the user has more than one account. Would have to test it to validate the behavior ...
    Like • Show 0 Likes0
    Actions
  - Becca Collins @ William May on Jul 18, 2018 11:21 AM
    Mark Correct
    Correct Answer
    You have to create an account template and assign it to the business source before you can set Entitlement Requires Account to be Yes.
    Like • Show 0 Likes0
    Actions