AnsweredAssumed Answered

Application name attributes are absent in approval form table fields when AD group membership to be approved

Question asked by Volodymyr Melnyk on Feb 12, 2019
Latest reply on Feb 14, 2019 by Volodymyr Melnyk

Like • Show 0 Likes0
Comment • 3

Dears,

We faced with an issue that there is no field(attribute) Application Name taken as attribute of AD group in approvals. As a result an approver sees only Active directory group name and user details in the table with actions. As an application name only a Datasource name of a directory is available. Of course it is possible to click on "i" icon on group name and application name can be found here, but it is definitely not what it should be. An approver should see application name and permission name in the table.

Are there any ways how we can get more attributes from group to the approvals table?

Thx

BR,

Volodymyr

Boris Lekumovich

Feb 12, 2019 7:38 PM

Correct Answer

In your screenshot, the Business Source column indicate the application name

If you are collecting all AD groups to one directory/application and each group (or subset of groups) can be identified as access to different application, consider creating a separate application/s and collecting to it only the relevant groups. In this approach you will see under Business Source column the relevant name once the request is generated.

If you are using a web service to create change requests in G&L, you could use the Change Request Item object and create a new attribute in which you can populate the name of the application for each change item. This attribute can be added to the visible columns.

From help section:

For the Change Request Item object, you can specify attribute values only through the web services createChangeRequest command. See the command description in Admin > Web Services > Request Commands for details on providing attributes and their values in the command block. This enables RSA Identity Governance and Lifecycle to provide those attribute values throughout the lifecycle of a change request when those requests originate from an external change request system but are approved and fulfilled in RSA Identity Governance and Lifecycle.

See the reply in context

Attachments

issue_with_App_name.png75.5 KB

No one else had this question

Outcomes

Boris Lekumovich

Feb 12, 2019 7:38 PM

In your screenshot, the Business Source column indicate the application name

From help section:

For the Change Request Item object, you can specify attribute values only through the web services createChangeRequest command. See the command description in Admin > Web Services > Request Commands for details on providing attributes and their values in the command block. This enables RSA Identity Governance and Lifecycle to provide those attribute values throughout the lifecycle of a change request when those requests originate from an external change request system but are approved and fulfilled in RSA Identity Governance and Lifecycle.

Actions

Volodymyr Melnyk @ Boris Lekumovich on Feb 13, 2019 6:04 AM

Dear Boris Lekumovich,

Thank you for the suggestion. I configured a separate account collector linked to the application for specific AD groups (I had to put a filter in LDAP query and exclude them from a collector that does a collection to a directory first). It works, now I have in Business Source application name instead of directory name.

BR,

Volodymyr

Actions

Volodymyr Melnyk @ Boris Lekumovich on Feb 14, 2019 10:44 AM

Hello Boris,

Unfortunately it creates another issue. Now AFX doesnt work for this application as accounts are in directory and groups are in application business source. It is not possible to collect accounts to the application as they are already in another directory ( i tried an got an error in collector raw data).

Usually we get accounts to the applications by multi-app collector

AFX error:

Exception while processing the automated request for item 5237, exception is: 'Entitlements Require Account' is not enabled for BusinessApplication Demo Application.
Could not find Pending Account for ChangeRequestItem[AddUserToUserGroup]

Is there any way to get AFX working?

Thx

BR,
Volodymyr

Actions

3 Replies

Boris Lekumovich Feb 12, 2019 7:38 PM
Unmark Correct
Correct Answer
In your screenshot, the Business Source column indicate the application name

If you are collecting all AD groups to one directory/application and each group (or subset of groups) can be identified as access to different application, consider creating a separate application/s and collecting to it only the relevant groups. In this approach you will see under Business Source column the relevant name once the request is generated.

If you are using a web service to create change requests in G&L, you could use the Change Request Item object and create a new attribute in which you can populate the name of the application for each change item. This attribute can be added to the visible columns.

From help section:
For the Change Request Item object, you can specify attribute values only through the web services createChangeRequest command. See the command description in Admin > Web Services > Request Commands for details on providing attributes and their values in the command block. This enables RSA Identity Governance and Lifecycle to provide those attribute values throughout the lifecycle of a change request when those requests originate from an external change request system but are approved and fulfilled in RSA Identity Governance and Lifecycle.
Like • Show 0 Likes0
Actions
- Volodymyr Melnyk @ Boris Lekumovich on Feb 13, 2019 6:04 AM
  Mark Correct
  Correct Answer
  Dear Boris Lekumovich,
  
  Thank you for the suggestion. I configured a separate account collector linked to the application for specific AD groups (I had to put a filter in LDAP query and exclude them from a collector that does a collection to a directory first). It works, now I have in Business Source application name instead of directory name.
  
  BR,
  Volodymyr
  Like • Show 1 Like1
  Actions
- Volodymyr Melnyk @ Boris Lekumovich on Feb 14, 2019 10:44 AM
  Mark Correct
  Correct Answer
  Hello Boris,
  
  Unfortunately it creates another issue. Now AFX doesnt work for this application as accounts are in directory and groups are in application business source. It is not possible to collect accounts to the application as they are already in another directory ( i tried an got an error in collector raw data).
  
  Usually we get accounts to the applications by multi-app collector
  
  AFX error:
  Exception while processing the automated request for item 5237, exception is: 'Entitlements Require Account' is not enabled for BusinessApplication Demo Application.
  Could not find Pending Account for ChangeRequestItem[AddUserToUserGroup]
  
  Is there any way to get AFX working?
  
  Thx
  
  BR,
  Volodymyr
  Like • Show 0 Likes0
  Actions

Application name attributes are absent in approval form table fields when AD group membership to be approved

Attachments

Outcomes

Related Content

Recommended Content