AnsweredAssumed Answered

Automated process for updating custom attributes

Question asked by Abhinav Athikam on Jan 10, 2020
Latest reply on May 22, 2020 by Abhinav Athikam

Like • Show 0 Likes0
Comment • 7

Hi All,

We've a use case to update tags for specific groups, entitlement and app roles of all applications in G&L to identify them uniquely and pull them in review definition based on that tag information.
To achieve that we're planning to create a custom attribute for Groups, entitlements and approles in G&L. The challenge is, G&L does not allow to write jobs on custom attributes to reconcile information, it has to be done manually and there are 1000's of entitlements in our environment which will become a tedious process to update tags for each entitlement manually.

Is there any process to update custom attribute through a csv file like how there is option updating long and short desc through CSV file in desc tab?

or any other automated process for update custom attributes ( We are restricted to run update commands on backend database and which is not recommended by RSA)

Thanks,

Abhinav

Pradeep Kadambar

Feb 5, 2020 6:35 PM

Correct Answer

Here is a solution that is purely configuration only !!!!

Steps

Load the the descriptions via XML for the app roles/groups/ents in question. You can add one or more tags to the long description
Define review to cover only specific reviews. Specifically Contents > Include application roles (Same is true if for ents or groups)
Click on Advanced

Add the below queries to pull in roles that match the desired tag. Note: The query below is not optimized for production use.

approles.id in (SELECT roles.id FROM pv_application_role roles
INNER JOIN pv_business_source apps
ON apps.id = roles.application_id
WHERE apps.name = 'Oracle Database Access'
AND roles.long_desc LIKE '%#UAR1%')

Click OK
Run the review and you will only see the reviews for specific tags.

See the reply in context

1 person had this question

Outcomes

Ian Staines

Jan 10, 2020 11:24 AM

No, sorry you cannot add custom attributes programmatically.

Some general information on Custom Attributes:

Be aware that when you define a custom attribute the database schema is actually extended to support these new columns across all tables. This is not reversible and is not a trivial change. Ensure you have a valid backup before adding any custom attributes and do not restart acm after making changes. The process to extend the schema occurs in the background and takes some time to complete. This process must not be interrupted.
Be aware that there is a limit to the number of custom attributes you can define (20), and a limit to the number of specific types (lengths) of each type of attribute that can be defined.
Custom Attributes cannot be deleted once they are created.
When testing in DEV and moving to PROD, try to use exactly the same procedure and order to add your new attributes or you will end up with different schema's in DEV and PROD which may affect your regression testing.

Warning:

7.0.2 (and earlier) versions were limited to a maximum of 10 custom attributes (CAS1-CAS10). In 7.1.0 (and later) an additional 10 custom attributes were added (CAS11-CAS20).

Unfortunately due to a defect the new custom attributes CAS11-CAS20 cannot be used in reviews. If you define custom attributes that you intend on using for reviews please ensure you define them only in the first group of attributes CAS1-CAS10.

Actions

Clive Morrish

Jan 10, 2020 12:43 PM

Is there any logical sorting/grouping that can be applied to the entitlements e.g. Name starts with 'xxx', or Description contains 'xxx'?

If yes, once grouped you can select multiple/all entitlements and update the attribute at once. For example:

1 person found this helpful

Actions

Abhinav Athikam @ Clive Morrish on Jan 10, 2020 3:19 PM

Thanks Morrish for sharing the above information.

We can follow above approach for some of the entitlements but most of our application level entitlements has unique names which is no way similar to others. So, we cannot filter out through starts with / Contains in what access tab.

Actions

William May Jan 10, 2020 5:32 PM

I was going to suggest getting a script from RSA to update T_GROUPS, T_ENTITLEMENTS, T_ENTITLEMENT_GROUPS tables, but if you are restricted, that's not going to work

Other approach would be to create the custom attributes as collected attributes and merge the values with your source collection data, however, then you would not be able to make changes from the GUI side.

Actions

Pradeep Kadambar

Feb 5, 2020 6:35 PM

Here is a solution that is purely configuration only !!!!

Steps

Load the the descriptions via XML for the app roles/groups/ents in question. You can add one or more tags to the long description
Define review to cover only specific reviews. Specifically Contents > Include application roles (Same is true if for ents or groups)
Click on Advanced

Add the below queries to pull in roles that match the desired tag. Note: The query below is not optimized for production use.

approles.id in (SELECT roles.id FROM pv_application_role roles
INNER JOIN pv_business_source apps
ON apps.id = roles.application_id
WHERE apps.name = 'Oracle Database Access'
AND roles.long_desc LIKE '%#UAR1%')

Click OK
Run the review and you will only see the reviews for specific tags.

3 people found this helpful

Actions

Ian Staines

@ Pradeep Kadambar on Feb 5, 2020 7:19 PM

I like the way you think Pradeep, rather than answer the question; you just provide an alternate solution.

Custom attributes are a rare resource and perhaps overused for use cases they are not suited for. I am sure there are other places descriptions can be leveraged in a similar way. As always there are limitations. Performance ones as you mentions, but also length, and the complexity of doing sub-string matches. Be aware that string searches using LIKE with wildcards (two of them!) are very expensive and not easily optimized. Just because we allow you to create a particular filter in a review does not mean it will work when scaled up.

1 person found this helpful

Actions

Abhinav Athikam @ Pradeep Kadambar on May 22, 2020 4:27 PM

Thank you Pradeep. It helped to resolve the issue.

Actions

7 Replies

Ian Staines Jan 10, 2020 11:24 AM
Mark Correct
Correct Answer
No, sorry you cannot add custom attributes programmatically.

Some general information on Custom Attributes:
- Be aware that when you define a custom attribute the database schema is actually extended to support these new columns across all tables. This is not reversible and is not a trivial change. Ensure you have a valid backup before adding any custom attributes and do not restart acm after making changes. The process to extend the schema occurs in the background and takes some time to complete. This process must not be interrupted.
- Be aware that there is a limit to the number of custom attributes you can define (20), and a limit to the number of specific types (lengths) of each type of attribute that can be defined.
- Custom Attributes cannot be deleted once they are created.
- When testing in DEV and moving to PROD, try to use exactly the same procedure and order to add your new attributes or you will end up with different schema's in DEV and PROD which may affect your regression testing.
  
  Warning:
  
  7.0.2 (and earlier) versions were limited to a maximum of 10 custom attributes (CAS1-CAS10). In 7.1.0 (and later) an additional 10 custom attributes were added (CAS11-CAS20).
  
  Unfortunately due to a defect the new custom attributes CAS11-CAS20 cannot be used in reviews. If you define custom attributes that you intend on using for reviews please ensure you define them only in the first group of attributes CAS1-CAS10.
Like • Show 0 Likes0
Actions
Clive Morrish Jan 10, 2020 12:43 PM
Mark Correct
Correct Answer
Is there any logical sorting/grouping that can be applied to the entitlements e.g. Name starts with 'xxx', or Description contains 'xxx'?

If yes, once grouped you can select multiple/all entitlements and update the attribute at once. For example:

1 person found this helpful
Like • Show 1 Like1
Actions
- Abhinav Athikam @ Clive Morrish on Jan 10, 2020 3:19 PM
  Mark Correct
  Correct Answer
  Thanks Morrish for sharing the above information.
  
  We can follow above approach for some of the entitlements but most of our application level entitlements has unique names which is no way similar to others. So, we cannot filter out through starts with / Contains in what access tab.
  Like • Show 0 Likes0
  Actions
William May Jan 10, 2020 5:32 PM
Mark Correct
Correct Answer
I was going to suggest getting a script from RSA to update T_GROUPS, T_ENTITLEMENTS, T_ENTITLEMENT_GROUPS tables, but if you are restricted, that's not going to work

Other approach would be to create the custom attributes as collected attributes and merge the values with your source collection data, however, then you would not be able to make changes from the GUI side.
Like • Show 0 Likes0
Actions
Pradeep Kadambar Feb 5, 2020 6:35 PM
Unmark Correct
Correct Answer
Here is a solution that is purely configuration only !!!!

Steps
1. Load the the descriptions via XML for the app roles/groups/ents in question. You can add one or more tags to the long description
2. Define review to cover only specific reviews. Specifically Contents > Include application roles (Same is true if for ents or groups)
3. Click on Advanced
4. Add the below queries to pull in roles that match the desired tag. Note: The query below is not optimized for production use.
  approles.id in (SELECT roles.id FROM pv_application_role roles INNER JOIN pv_business_source apps ON apps.id = roles.application_id WHERE apps.name = 'Oracle Database Access' AND roles.long_desc LIKE '%#UAR1%')
5. Click OK
6. Run the review and you will only see the reviews for specific tags.
3 people found this helpful
Like • Show 3 Likes3
Actions
- Ian Staines @ Pradeep Kadambar on Feb 5, 2020 7:19 PM
  Mark Correct
  Correct Answer
  I like the way you think Pradeep, rather than answer the question; you just provide an alternate solution.
  
  Custom attributes are a rare resource and perhaps overused for use cases they are not suited for. I am sure there are other places descriptions can be leveraged in a similar way. As always there are limitations. Performance ones as you mentions, but also length, and the complexity of doing sub-string matches. Be aware that string searches using LIKE with wildcards (two of them!) are very expensive and not easily optimized. Just because we allow you to create a particular filter in a review does not mean it will work when scaled up.
  1 person found this helpful
  Like • Show 2 Likes2
  Actions
- Abhinav Athikam @ Pradeep Kadambar on May 22, 2020 4:27 PM
  Mark Correct
  Correct Answer
  Thank you Pradeep. It helped to resolve the issue.
  Like • Show 0 Likes0
  Actions