AnsweredAssumed Answered

application role logic

Question asked by Martin Piroh on Nov 14, 2019
Latest reply on Dec 12, 2019 by Zoltan Izsak

Like • Show 0 Likes0
Comment • 13

Hello,

I'm seeking an advice how to meet our customer requirement. I need to set up a logic for one of our applications in Access Management, which has several roles available, to check the following:

'For “A” and “B” role, when user click “Add” button, can we have a backend logic to check if the user has User Role of "X" (for A role) or 'Y' (for B role)? If there is no Application Role setup, then, we need to error out this request.

Is this possible to achieve, if so what is the simplest solution?

Thank you,

Martin

Frank Schubert Nov 22, 2019 6:27 AM

Correct Answer

Is that only for those entitlements? by that I mean, is it a managable amount of entitlements? A User Access rule could be used. e.g.

User having "Customer Marketing (for CORP_PRICING) or 'BU - Price Approver' (for BU) from BBB" are the only ones allowed to access "BU and “CORP_PRICING role for AAA aplication".

Or, if you like to make sure they have the stuff from AAA when they request stuff from BBB, why not use entitlement relationships? Have the stuff from BBB, that is a prereq for stuff from AAA be e.g. parents and in the form have a hidden control that adds those parents?

See the reply in context

No one else had this question

Outcomes

13 Replies

Mostafa Helmy Nov 14, 2019 11:35 AM
Mark Correct
Correct Answer
It is definitely possible using some custom checks in your Workflow. The question is where do you have these dependencies stored?

You could also look into using the Request Hierarchy lists in the application. To me this sounds like a relevant use case for the Request Hierarchy attributes, however to be honest I never used them before.
1 person found this helpful
Like • Show 1 Like1
Actions
Zoltan Izsak Nov 15, 2019 8:48 AM
Mark Correct
Correct Answer
I am not sure if I understand correctly the use case but you should also check user access type rules. You can a define a rule which ensures that only members of role 'X' can have the entitlement 'A'.
Like • Show 1 Like1
Actions
Martin Piroh Nov 15, 2019 10:50 AM
Mark Correct
Correct Answer
Hi Zoltan,

I need the oposite - members of X role can not have the entitlement 'A'. Is this possible to achieve using access type rules?

Thanks,

M.
Like • Show 0 Likes0
Actions
- Zoltan Izsak @ Martin Piroh on Dec 5, 2019 9:09 AM
  Mark Correct
  Correct Answer
  Hi Martin,
  
  Sure, take a look at the definition options. In condition you can set " Verify that the users in role X" "Do not have access to any of entitlement A".
  
  Hope that this is what you are looking for.
  
  Regards,
  Zoltan
  1 person found this helpful
  Like • Show 1 Like1
  Actions
Kristian Nordman Nov 18, 2019 7:23 AM
Mark Correct
Correct Answer
That sounds like Segregation of Duties.

Configuring a rule to have the application role in Entitlement Set 1 and the entitlements in Entitlement Set 2 will give you excellent control and feedback in the request form without any modification. I'm not sure if you can force the process to exit if a violation is found, but it will be flagged.
Like • Show 0 Likes0
Actions
Martin Piroh Nov 18, 2019 10:06 AM
Mark Correct
Correct Answer
Hi Kristian,

Thanks, this is helpful, but doesn't really meet our requirements:

For “BU” and “CORP_PRICING” role for AAA aplication, when user clicks “Add” button, can we have a backend logic to check if the user has role of "Customer Marketing" (for CORP_PRICING) or 'BU - Price Approver' (for BU) from BBB aplication? If there is no application Role setup, then, we should error out this request.

So basically, we need to check it user doesn't have that entitlement and if he doesn't, then the request should not proceed.
Like • Show 0 Likes0
Actions
- Frank Schubert @ Martin Piroh on Nov 22, 2019 6:27 AM
  Unmark Correct
  Correct Answer
  Is that only for those entitlements? by that I mean, is it a managable amount of entitlements? A User Access rule could be used. e.g.
  User having "Customer Marketing (for CORP_PRICING) or 'BU - Price Approver' (for BU) from BBB" are the only ones allowed to access "BU and “CORP_PRICING role for AAA aplication".
  Or, if you like to make sure they have the stuff from AAA when they request stuff from BBB, why not use entitlement relationships? Have the stuff from BBB, that is a prereq for stuff from AAA be e.g. parents and in the form have a hidden control that adds those parents?
  1 person found this helpful
  Like • Show 3 Likes3
  Actions
Martin Piroh Dec 6, 2019 2:49 AM
Mark Correct
Correct Answer
Thank you Zoltan. Are you reffering to Segregation of Duties - Change detection rule set? Where exactly is it possible to configure followign: " Verify that the users in role X" "Do not have access to any of entitlement A" ?
I searched through available configuration but did not find this option.

Thank you,

Martin
Like • Show 0 Likes0
Actions
- Zoltan Izsak @ Martin Piroh on Dec 6, 2019 3:12 AM
  Mark Correct
  Correct Answer
  No, it is in the user access rules.
  Like • Show 0 Likes0
  Actions
Martin Piroh Dec 6, 2019 6:23 AM
Mark Correct
Correct Answer
If I understand correctly, I first need to create a role set which will collect roles I need to define a rule for?
Like • Show 0 Likes0
Actions
- Zoltan Izsak @ Martin Piroh on Dec 7, 2019 5:16 AM
  Mark Correct
  Correct Answer
  I am not sure if I fully got the original question. As I understood you already have User Role X (I think you mean business/global/technical role) and application role A. Only those users can have application role A who are not members of X.
  In this case you should define your User Access type rule as the following:
  Verify that the specified users
  users.id in roles ((' ','X'))
  Do not have access to any of
  Application Role (approles in (('YourApplication EDC','A'))).
  
  Your X role of course will be in a role set but it has nothing to do with it.
  Like • Show 1 Like1
  Actions
Martin Piroh Dec 10, 2019 6:32 AM
Mark Correct
Correct Answer
I apologize, by role I meant entitlements/groups collected by entitlement collectors ...
Like • Show 0 Likes0
Actions
- Zoltan Izsak @ Martin Piroh on Dec 12, 2019 7:10 AM
  Mark Correct
  Correct Answer
  I think I got it and also I think Frank Schubert wrote the User Access rule what you need. Anyways, as far as I know user access rules are not able to fully stop a request, they will only highlight it so you will have to stop the CR in the workflow. You can add a decision node which checks if your user access rule was triggered and stop the CR if necessary.
  1 person found this helpful
  Like • Show 1 Like1
  Actions

application role logic

Outcomes

Related Content

Recommended Content