I would like to update my transfer/movers process to create a review as part of an attribute change rule that runs after identity unification, however, i am only able to select User Access Review definitions in the rule.
Is anyone aware of a solution/workaround to this issue?
Thanks,
Bill
7.0.2
Hi,
what would you make prefer that kind of review over a user-based one, especially for a mover?
Frank
Hi Frank, some of the applications in my environment are not providing entitlements, only accounts. We have a user access review definition for transfers for all the apps that are sending us entitlement level data.
Hi,
I see two potential workarounds for this
a) you equip those empty accounts with a dummy entitlement. Either via the EDC that collects the entitlements anyways (UNION in the dummy entitlement for all empty accounts) or via a separate one (collect from the IGL database, get all those empty accounts and associate the dummy entitlement for them via e.g. a MAEDC)
b) trigger the Account review indirectly. use two User Attribute change rules. One that detect the move (like you do right now), but let it set a custom user attribute (managed) to a certain value e.g. Is Mover = True and another (Date) attribute to the current datestamp (Move Date). Then have a second rule check all users with a Move Date of > sysdate -1.5 and let that rule reset the Is Mover to empty or "No".
Then let the account review be scheduled and only include accounts which users' have the Is Mover = True set.
Pretty sure this is what will get you there.
Frank
Frank, thank you for the detailed response. I may have to look at your option a), as we are currently doing something very similar to your option b), however, what we recently found out was that when Aveksa's queue gets backed up due to some unforeseen reason, the scheduled transfer review is being added into the job queue before the Unification job is able to spawn the transfer rule that is setting the attribute that the review scope is looking at. In our case, we are setting a custom date attribute and then review is looking for any users with a date > sysdate-.5
Thanks again!
Hi,
I don't think you can select any other review type on the "attribute change" rule, except a user access review.
Have you considered creating an entitlement collector to collect a dummy entitlement and map it to all your accounts?
This is what i do and it work well for me.
Just ensure that your provisioning is well handled (depending on what you use: AFX, email, integration to a service manager portal...)
Regards
Armel
Hi,
I see two potential workarounds for this
a) you equip those empty accounts with a dummy entitlement. Either via the EDC that collects the entitlements anyways (UNION in the dummy entitlement for all empty accounts) or via a separate one (collect from the IGL database, get all those empty accounts and associate the dummy entitlement for them via e.g. a MAEDC)
b) trigger the Account review indirectly. use two User Attribute change rules. One that detect the move (like you do right now), but let it set a custom user attribute (managed) to a certain value e.g. Is Mover = True and another (Date) attribute to the current datestamp (Move Date). Then have a second rule check all users with a Move Date of > sysdate -1.5 and let that rule reset the Is Mover to empty or "No".
Then let the account review be scheduled and only include accounts which users' have the Is Mover = True set.
Pretty sure this is what will get you there.
Frank