AnsweredAssumed Answered

User access rule combine multiple queries in one statement

Question asked by Danny Bissett on Dec 17, 2019
Latest reply on Dec 17, 2019 by Mostafa Helmy
  • Comment • 1

I have created a "User Access" rule where I would like to create an expression defining the applications roles with "and" and "Or" statements within the one condition which I have been unable to get to work.

 

I have created the expression below but it does not work.

 

approles in (('Oracle Legacy EDC New','Ent1'))
and (approles in (('Oracle Legacy EDC New' ,'En2'))
or approles in (('Oracle Legacy EDC New','Ent3')))

 

I would have expected the above query to show any user who has Ent1 and either Ent2 or Ent3.

 

I have attached a screenshot with the rule config.

 

Can anyone advise what I'm doing wrong or even if this is possible?

Mostafa Helmy
Mostafa Helmy Employee Dec 17, 2019 11:30 AM
Correct Answer

I'm not sure that is possible from a User Access Rule. The User Access rule only allows you to choose between:

  • "Are the only ones with access to any of”/”Do not have access to any of” which acts as an OR
  • "Do not have access to all of” which acts as an AND

 

I'm not sure about your actual use case, but I think you can do this in two ways:

  1. Split it into two User Access rules, both doing "Do not have access to all of” and filtering on (Ent1,Ent2) and (Ent1,Ent3)
  2. Perhaps use a Segregation of duties (SoD) rule? Entitlement Set 1 filter would be Ent1, while Entitlement Set 2 filter would be Ent2 or Ent3
See the reply in context

Attachments

No one else had this question

Outcomes

    Visibility: RSA Identity Governance & Lifecycle37 Views
    Last modified on Dec 17, 2019 9:17 AM
    Tags:
    Categories: Rules
    Ratings: