AnsweredAssumed Answered

role review not trigering a change in all casses

Question asked by Marcel van Kekeren on Apr 29, 2020
Latest reply on Jul 30, 2020 by Ian Staines

Like • Show 0 Likes0
Comment • 10

When we perform a fine grained Role review not all changes that are made seem so result in an item in the change preview tab of the review.

changes that not result in a item in de change preview tab can be commited to the role via the normal role change process and show a warning that the change of the role was initiated from a role review.

from what we see now is:

that adding entitlements or changing the metadata of the role does not generate a change from within the review.
removing Users or entitlements will generate a change.

Is this to be expected and if so how can we simply commit the changes that don't generate change preview items.

Ian Staines

Jul 24, 2020 5:22 PM

Correct Answer

Marcel van Kekeren

I see you opened a support case for this issue and were advised to submit an idea to RSA Ideas.

Did you end up following up on that?

See the reply in context

No one else had this question

Outcomes

10 Replies

Ian Staines May 6, 2020 11:54 AM
Mark Correct
Correct Answer
Yes, there are certain types of Role activities that do not result in a change request item. This is a general issue and not related specifically to Reviews.

This is currently by design but the following RSA Ideas proposes changing this.

Role Ownership/Role Name Changes needs to be captured in Change Request
Like • Show 0 Likes0
Actions
- Mostafa Helmy @ Ian Staines on May 6, 2020 12:09 PM
  Mark Correct
  Correct Answer
  I think Marcel might be talking about something different. The idea you reference says if you generate a change request, it doesn't show what attributes have changed.
  
  From what I understood from Marcel's case, in the fine grained review, you can actually add/remove/update role members/entitlements/attributes. However only the remove actions generate change requests. So in the review, if reviewer chooses to just add a member/entitlement, then no change request is generated at all.
  
  Marcel van Kekeren please correct me if I'm wrong.
  Like • Show 0 Likes0
  Actions
  - Marcel van Kekeren @ Mostafa Helmy on May 7, 2020 3:51 AM
    Mark Correct
    Correct Answer
    Mostafa Helmy you are right.
    
    Via normal role management adding an entitlement or changing the role owner will generate a request that is handled by the workflow configured under the workflow menu.
    
    Changes made via role reviews like removing user or entitlements generates a request but adding a user, entitlement or changing the role owner will not.
    While we see the change in de review it does not show up in de change activity tab of the review and therefore can not be converted in a request
    Like • Show 0 Likes0
    Actions
    - Mostafa Helmy @ Marcel van Kekeren on May 7, 2020 3:58 AM
      Mark Correct
      Correct Answer
      How about outside the review? If you go to Roles > Roles > Find the changed Role > Is it in Changed state there? Would you be able to apply those changes from there?
      Like • Show 0 Likes0
      Actions
      - Marcel van Kekeren @ Mostafa Helmy on May 7, 2020 4:02 AM
        Mark Correct
        Correct Answer
        Mostafa Helmy
        Yes the role state will change and changes can be applied.
        Like • Show 0 Likes0
        Actions
        Mostafa Helmy @ Marcel van Kekeren on May 7, 2020 4:10 AM
        Mark Correct
        Correct Answer
        So what happens if you both remove and add different members/entitlements to a Role? I believe that would generate a change request with all changes (not just the removals)?
        
        In all cases, I think you should log a case with RSA Support to explain this behaviour. It might be by design for some reason or a just an unhandled defect since you cannot "add” access in any other review type.
        Like • Show 0 Likes0
        Actions
        Marcel van Kekeren @ Mostafa Helmy on May 7, 2020 7:43 AM
        Mark Correct
        Correct Answer
        we dit not test that but we can try is.
        Like • Show 0 Likes0
        Actions
        Ian Staines @ Marcel van Kekeren on Jul 24, 2020 5:22 PM
        Unmark Correct
        Correct Answer
        Marcel van Kekeren
        
        I see you opened a support case for this issue and were advised to submit an idea to RSA Ideas.
        
        Did you end up following up on that?
        Like • Show 0 Likes0
        Actions
        Marcel van Kekeren @ Ian Staines on Jul 29, 2020 10:55 AM
        Mark Correct
        Correct Answer
        Ian Staines
        
        No i have not but still think it is unbelievable that the system is working unpredictable as it does and that seems to be works as designed.
        
        Did not have the time to create a good documented case. it is on my to do list.
        Like • Show 0 Likes0
        Actions
        Ian Staines @ Marcel van Kekeren on Jul 30, 2020 2:05 PM
        Mark Correct
        Correct Answer
        We will of course take your suggestions as to how you want it to work seriously. There are lots of potential improvements coming for Role management.
        Like • Show 0 Likes0
        Actions

role review not trigering a change in all casses

Outcomes

Related Content

Recommended Content