AnsweredAssumed Answered

Add members to existing roles with AD collector

Question asked by Joaquim Rossello on Mar 28, 2019
Latest reply on Apr 8, 2019 by Mostafa Helmy

Like • Show 0 Likes0
Comment • 3

Hi,

We generate Roles from a DDBB collector with its members but not all the members are in this database.
We need to add members to the roles created from an existing attribute in the Active Directory but we can not configure an Active Directory Role collector with the User To Role Membership option (Filter for users and extract role memberships from user attributes). Is there a guide or document with a more detailed description that can help us?

We have tried to generate rules with the user attribute but a request is generated with activities to manually add the user to the role. It seems that if the role is generated from a collector, members can not be assigned automatically.

Thanks

No one else has this question

Outcomes

Mostafa Helmy

Apr 2, 2019 11:19 AM

I'm afraid there is no way to aggregate members from different data sources within the product, but I'm a bit confused on the architectural side or the use case in general. Correct me if I'm wrong

You have an authoritative data source which holds your role structure (assuming this is DDBB)?
You collect role information from that using a Role Collector.
On AD, are those accounts you mention already members of the role or should they be members or the role?

As for your last point, yes if a Role is collected then we assume everything should come from the source of collection (members, entitlements). By submitting a change request to add a new member, we are expecting someone (manually) or some process (AFX?) to fulfil the change on your target system then we would expect to collect the change back using the role collector to complete the request.

Actions

Joaquim Rossello @ Mostafa Helmy on Apr 4, 2019 7:19 AM

Hi,

Situation:

1. Collect role information from that using a Role Collector (DDBB)
2. Collect members of the role (DDBB)

3. In the DDBB are only the users from SAP, then not all users who have to be members of that role will be added to the role.

I understand that there is no way to add users to roles from a different source than the one that creates the role.

Thanks and regards.

Actions

Mostafa Helmy

@ Joaquim Rossello on Apr 8, 2019 6:49 AM

In that case as mentioned earlier, the only way to do so is if you can also include the AD user members in DDBB to be collected along with your SAP users. If that is not possible, then I would suggest you go for RSA managed Roles instead of collect from DDBB. You could then use Role membership rules to help automate adding members that all under a certain criteria to your Roles.

Actions

3 Replies

Mostafa Helmy Apr 2, 2019 11:19 AM
Mark Correct
Correct Answer
I'm afraid there is no way to aggregate members from different data sources within the product, but I'm a bit confused on the architectural side or the use case in general. Correct me if I'm wrong
You have an authoritative data source which holds your role structure (assuming this is DDBB)?
You collect role information from that using a Role Collector.
On AD, are those accounts you mention already members of the role or should they be members or the role?

As for your last point, yes if a Role is collected then we assume everything should come from the source of collection (members, entitlements). By submitting a change request to add a new member, we are expecting someone (manually) or some process (AFX?) to fulfil the change on your target system then we would expect to collect the change back using the role collector to complete the request.
Like • Show 0 Likes0
Actions
- Joaquim Rossello @ Mostafa Helmy on Apr 4, 2019 7:19 AM
  Mark Correct
  Correct Answer
  Hi,
  
  Situation:
  
  1. Collect role information from that using a Role Collector (DDBB)
  2. Collect members of the role (DDBB)
  3. In the DDBB are only the users from SAP, then not all users who have to be members of that role will be added to the role.
  
  I understand that there is no way to add users to roles from a different source than the one that creates the role.
  
  Thanks and regards.
  Like • Show 0 Likes0
  Actions
  - Mostafa Helmy @ Joaquim Rossello on Apr 8, 2019 6:49 AM
    Mark Correct
    Correct Answer
    In that case as mentioned earlier, the only way to do so is if you can also include the AD user members in DDBB to be collected along with your SAP users. If that is not possible, then I would suggest you go for RSA managed Roles instead of collect from DDBB. You could then use Role membership rules to help automate adding members that all under a certain criteria to your Roles.
    Like • Show 0 Likes0
    Actions