We are seeing an error during role fulfillment where a user has access either granted or removed. The entitlement granted by the role appears under their Access tab but the role will not.
Is this an error in the default fulfillment of the role? Or in the way that the role is created?
Request granting access
User's Access Tab - Missing the "SOC1 - IAM-646" rol
Locally managed roles.
Right that particular role is part of the "SOC1 - FCM Role Set. Which doesn't appear under the Access>All
In that case, this seems really similar to a previously reported problem ACM-79345. Looking at the details, It was random behaviour that kept happening till the system was restarted then didn't happen again.
The aveksaServer.log contained an error like the below stacktrace:
09/25/2017 15:06:37.962 ERROR (Thread-913) [com.aveksa.server.workflow.scripts.utils.SystemFulfiller] Failed to get change request from queue.
java.lang.NullPointerException
at com.aveksa.server.workflow.scripts.utils.GlobalRoleFulfiller.processWatches(GlobalRoleFulfiller.java:163)
at com.aveksa.server.workflow.scripts.utils.SystemFulfiller$WatchProcessor.run(SystemFulfiller.java:231)
at java.lang.Thread.run(Thread.java:798)
In all cases, I would suggest you open a case with RSA Support to further investigate this. Referring to this post in the case might be helpful.
Are these collected or locally managed roles?
One thing I notice is that you are grouping by Business Source and only check the application. A Role will not be in the same application as entitlements, it will be under a Role Set. From your screenshot of the change request, there are two Business Sources: