AnsweredAssumed Answered

Create Rule on Attribute Value

Question asked by Marta Benedetti on Apr 24, 2020
Latest reply on Apr 29, 2020 by Zoltan Izsak

Like • Show 0 Likes0
Comment • 18

Hi,

I have RSA IGL 7.1.

I'm trying to create a rule in order to do:

detect users with attribute Supervisor null
send email

I'm trying with "Attribute Change" but it doesn't seem to work fine for my purpose.

With with condition "When new users are detected" is not possible to decide which attribute has to be checked.

With conditions "When change is detected for existing users" it's not possible to find existing users with attribute supervisor null.

I've tried with a Review as-well but it doesn't seem possible to review users and their attributes.

Do you have any ideas?

Thank you,

Marta

No one else has this question

Outcomes

18 Replies

Craig Ramsay Apr 24, 2020 6:33 AM
Mark Correct
Correct Answer
Hi Marta,

Is this use case dealing with new users without a supervisor populated (part of the Joiner process) or all users without a supervisor populated (reoccurring check of Identity data quality)?

Will the notification be going to one destination for all cases or a specific e-mail per user identified?

Kind regards,
Craig
1 person found this helpful
Like • Show 0 Likes0
Actions
- Craig Ramsay @ Craig Ramsay on Apr 24, 2020 6:41 AM
  Mark Correct
  Correct Answer
  The reason I ask is that your use case might be resolved by generating a report of all users without a supervisor and sending this on a regular basis rather than by using a rule.
  
  I know you are still on v7.1 but the new don't send if report is empty feature in v7.2 would be good in this use case to ensure no empty reports are sent if there are no users without supervisors too.
  Like • Show 0 Likes0
  Actions
  - Marta Benedetti @ Craig Ramsay on Apr 24, 2020 10:49 AM
    Mark Correct
    Correct Answer
    Hi Craig,
    
    it's not really part of the Joiner process, at the moment on RSA IGL there are con Identity, Account and Entitlements collectors. The platform is used only for data collection and reviews.
    
    I have already created a report and scheduled it but the customer though would like to have something else, such as a review or a violation. Is it possible to do so?
    
    Thank you
    Marta
    Like • Show 0 Likes0
    Actions
    - Craig Ramsay @ Marta Benedetti on Apr 24, 2020 11:11 AM
      Mark Correct
      Correct Answer
      Is the supervisor attribute collected from an identity source or managed in another way?
      
      What is the customer expecting the violation or review to do that the current report is not allowing?
      
      As far as I am aware there is no review/rule that would allow you to define a supervisor for a user where one does not exist. Increasing visibility of where this does happen so it can be populated at source and updated in the next identity collection.
      
      This can be achieved by the report you have already scheduled and if they are getting annoyed with checking to find empty reports then recommend an upgrade to v7.2 so you can send the report only when it contains data
      Like • Show 1 Like1
      Actions
      - Marta Benedetti @ Craig Ramsay on Apr 24, 2020 11:38 AM
        Mark Correct
        Correct Answer
        The supervisor is collected from AD through the attribute manager.
        AD is the identity source.
        My report lists the user with no supervisor and is sent via email every months.
        
        For the customer is important to have in control which are the users with no manager on AD, and it would be nice to have something of more effect then just a report, something like a violation or a review.....but I don't know if there is a way to achieve so.
        
        Does the 7.2 have this feature?
        
        Marta
        Like • Show 0 Likes0
        Actions
        Zoltan Izsak @ Marta Benedetti on Apr 24, 2020 1:26 PM
        Mark Correct
        Correct Answer
        If you have an entitlement which is granted to every user you can create a user access rule:
        
        I think this is not better than running a report on daily basis. When creating a report you can even set not to send it if empty. I would like it better but customers sometimes have weird requirements.
        1 person found this helpful
        Like • Show 1 Like1
        Actions
        Marta Benedetti @ Zoltan Izsak on Apr 27, 2020 4:35 AM
        Mark Correct
        Correct Answer
        Hi Zoltan,
        thank you for the idea, actually I've thought the same since all the users access the same directory.
        It seems to work fine, but then doesn't send the email:
        
        Only 63 users has the Supervisor
        
        But if I test the rule I have 0 results and if I process the rule there are no emails sent.
        I think there must be something I'm missing.
        
        Thank you
        Like • Show 0 Likes0
        Actions
        Zoltan Izsak @ Marta Benedetti on Apr 29, 2020 11:28 AM
        Mark Correct
        Correct Answer
        Hm. I checked it and seems that it works for new violations.
        Like • Show 0 Likes0
        Actions
        Craig Ramsay @ Marta Benedetti on Apr 27, 2020 5:46 AM
        Mark Correct
        Correct Answer
        As far as I am aware, there is nothing in 7.2 to allow a review or violation to update a collected Identity attribute such as Supervisor. The feature I was talking about would mean Reports have the option to only be sent when there is data in it.
        
        There are some cool suggestions that are more dynamic than a scheduled Report suggested on this post though.
        
        In general, users without a supervisor being populated points to a problem with the identity feed. This would normally be the responsibility of the HR Department to provide complete and accurate information for IGL to consume. Improving these notifications from a monthly report to a more dynamic notification when the exception is detected is definitely an improvement. However, I would also advise the customer to look at why this keeps happening and make improvements to the processes involved in populated identity data into their AD environment.
        1 person found this helpful
        Like • Show 1 Like1
        Actions
Clive Morrish Apr 24, 2020 2:03 PM
Mark Correct
Correct Answer
I agree regarding the Report, that's definitely the most straight forward approach. With regards to why you're not seeing results for "When change is detected for existing users", the attribute has to change from something to something else (or nothing) in order for it be picked up.

Thinking out loud here and bear in mind that it's a late on a Friday, but I think the following could work:
- Create a new collected user attribute, called 'Has supervisor'
- Create an additional Identity Collector that collects from the RSA IGL DB that sets the value of 'Has Supervisor' to 'No'. Something as simple as this:
```
select 
  user_id, 
  CASE WHEN SUPERVISOR_ID IS NOT NULL THEN '' ELSE 'No' END AS hassupervisor 
from 
  pv_users
```
IMPORTANT: Ensure that Create User is set to no for this identity collector!
- Join the New Identity Collector to existing Identity Collector.
- Create an Attribute Change rule
  Condition: When Change is detected for existing users
  users with the following changes: Has Supervisor = No
- Action: Send Email
- Schedule/Trigger: As required
Again, before running anything, Ensure that Create User is set to no for this identity collector!

Run the newly create Identity Collector, which should then populate the Has Supervisor? attribute against the relevant users. Run the rule (if it hasn't already done) and you should hopefully see an email sent. You can also check monitoring to see the Rule run and if it detected users/changes.

As said at the start, this is me thinking out loud so please test fully in a non production environment. Also consider the behavior when:
- A user goes from not having a supervisor to having a supervisor
- A user goes from having a supervisor to not having a supervisor
Finally, I may be massively over complicating this and others out there may have a simpler approach.

However, let me know your thoughts/how you get on
1 person found this helpful
Like • Show 3 Likes3
Actions
- Marta Benedetti @ Clive Morrish on Apr 27, 2020 4:24 AM
  Mark Correct
  Correct Answer
  Hi Clive,
  
  interesting idea, maybe not so quick of implementation but I like it
  I think I'll do some tries in my lab before going to the customer and finally decide the one that suits most for my case.
  
  In all these ideas I see though that the action performed is always "send an email", it's not possible to raise some kind of a violation or ask for a review....that is exactly what I found out from my tries.
  
  Thank you very much,
  
  Marta
  Like • Show 1 Like1
  Actions
  - Clive Morrish @ Marta Benedetti on Apr 27, 2020 4:44 AM
    Mark Correct
    Correct Answer
    The Attribute Change rule has Actions to either Create a Change Request or Generate a review:
    
    Change Requests could be used to assign manual tasks to a team or individual.
    
    With regards to the Review, what would would you expect it to include? I can't see how any of the different definitions would be suitable.
    
    Definitely agree with your suggestion of trying this in a lab first
    Like • Show 2 Likes2
    Actions
    - Marta Benedetti @ Clive Morrish on Apr 27, 2020 5:30 AM
      Mark Correct
      Correct Answer
      The customer thought of a review of user attribute, so that someone can review users and their supervisor....but I don't think the Review type permit something like that.
      
      I think the best way then is send an email or a CR, but I'd prefer send an email if I have to choose
      
      Thank you very much
      Marta
      Like • Show 1 Like1
      Actions
      - Clive Morrish @ Marta Benedetti on Apr 27, 2020 5:37 AM
        Mark Correct
        Correct Answer
        I think an email to have this value updated at source is a good approach.
        
        Let us know how you get on - good luck!
        Like • Show 2 Likes2
        Actions
Ahmed Nofal Apr 25, 2020 5:02 PM
Mark Correct
Correct Answer
Hi Marta,

how about utilizing the role module to reach the results you want out of this use case?

Step 1: Create an empty role with a membership rule filter that states that the supervisor attribute value is null.

Step 2: Configure the section "When non-members match the membership rule:" of the membership rule to create change requests to add those users to the role and send an email per the use case requirements. Choose the user that should be receiving emails around those users being added .Post configuring this section, a User In Constraint Rule (UINC) will get created at the rules module (Rules > Rule Definitions) with the naming format that includes the name of the rule.

Step 3: Configure the section "When members do not match the membership rule:" to create change requests to remove the users that are members of the rule that do not match the membership rule filter (supervisor is null). This way the role will get cleaned up so it always includes members of the role complying with the membership rule filter. When configuring this section, a User Out of Constraint Rule (UOOC) will get created at the rules module (Rules > Rule Definitions) with the naming format that includes the name of the rule.

Step 4: Schedule the two rules mentioned in Step 2 and Step 3 to run after unification or you can manually run them if you want to.

**Note: If you don't like the syntax of view of the email generated by the UINC rule, you can un-check the send email checkbox in the membership rule and put the role inside a roleset that is associated to an approval workflow consisting of an email node. In that email node, you can dynamically assign email recipients in addition to the email body you want. Putting that sole role inside that roleset would ensure that this role only is utilizing that custom approval workflow (it's not an approval workflow anymore after this :-) )
2 people found this helpful
Like • Show 6 Likes6
Actions
- Clive Morrish @ Ahmed Nofal on Apr 27, 2020 4:07 AM
  Mark Correct
  Correct Answer
  Neat idea!
  
  I guess the only caveat here is that you must be licensed to use BRM?
  Like • Show 1 Like1
  Actions
  - Ahmed Nofal @ Clive Morrish on Apr 27, 2020 5:18 AM
    Mark Correct
    Correct Answer
    most probably yes
    Like • Show 1 Like1
    Actions
    - Marta Benedetti @ Ahmed Nofal on Apr 27, 2020 5:26 AM
      Mark Correct
      Correct Answer
      Thank you Ahmed!!
      Actually we are not using the role module right now, I've just checked and the customer doesn't have license for BRM
      Like • Show 0 Likes0
      Actions

Create Rule on Attribute Value

Outcomes

Related Content

Recommended Content