Segregation of Duties Role
We are attempting to create a segregation of duties role to trap violations between two entitlements. However something must be missing or incorrect as all information is stating there are no violations. 1) I don't believe this is correct. 2) what collector should be used to trap this information? Any additional assistance would be appreciated as well.
thanks
We setup the below configuration within our DEV environment.
Our goal was ANY user which was added to the two entitlements which are not part of the TRADING team should set off a violation.
This makes us think that our understand of how violations is wrong OR that the function may be broken.
Our final goal we would like to implement (if we could get this working) is anyone added to any AD group without having used IAG should be a violation.
It looks like it may have worked at some point. We do not recall anything being changed.
Looking at the configuration and what your ultimate goal is … I believe they are quite different.
Your current rule configuration means that if any user is a member of both roles: FI--TRADE--TRADERS and FI--TRADE--IT--SUPPORT at the same time, then this is a violation. I'm not entirely sure how that would tie in with your requirement of users being added directly to AD groups without using the a change request process from our product.
If that is what you seek, then alternatively have a look at the "Unauthorized Change Detection” rule. This rule detects new access added to users that do not have a pending change request in the system for it then removes that access.
I lumped too much into one comment.
Let’s start with this one please highlighted in yellow.
When reviewing our screenshots which were sent over – the configuration as is – is not kicking off any violations. We believe that since we have it set to “any users” there would be a few violations. It seemed to work at one time, per the screenshot.
What are we missing or should be doing correctly to test if in fact we do have violations?
thanks
Well in your case it should be simple. Just make sure you run the Rule, then go to the members tab of both Roles referenced here and note down the members of each Role.
If you find any common members between the two Roles, just go the those User's access tabs and check to see if those entitlements are marked with violation icons.
If not, can you provide some screenshots of the access tabs of users that are member of both Roles yet do not show violations.
We have the Membership Rule set to ALL
Running a report pulls nothing.
Sorry I don't really understand that, but the membership rule has nothing to do with SoD violations. I'm also not sure what the report you run would really be querying … so as far as the rule violations go, try checking the common members on both Roles then check their access tabs. If the rule runs successfully, you should see the role entries marked with violations there.
Curious if any updates/comments on this please?
thanks
Sorry can you elaborate more on the problem? As far as I understood, correct me if I'm wrong, you setup a SoD rule to detect violations of user that have both entitlements, you ran the rule and it did not detect any violations even though you thing there are users that match this criteria?
If yes, can you send us some screenshots of the Rule configuration and examples of some users which have both entitlements.