AnsweredAssumed Answered

Rule Missing entitlements - Error clearance

Question asked by Pchelintseva Olga on Apr 30, 2020
Latest reply on May 4, 2020 by Pchelintseva Olga

Like • Show 0 Likes0
Comment • 4

Dears,

We have an issue with error for the change request when we run the rule Role Missing entitlements.

I've already seen that there is a recommendation to complete the workflow of an error.

Yes, it works but only for the the request to be closed. BUT the main is to grant an access according to the role but request doesn't do its job, all changed are canceled after.

Could you please help with the correct way how to clear an error and to proceed with the changes in change request?

(pictures are attached, completed WF is taken from another request to show the result)

Pchelintseva Olga May 4, 2020 11:03 AM

Correct Answer

Dears,

We found a solution, at list request skipped the error and the groups and/or entitlements were assigned to the users which were affected by the change request.

The needed actions are:

- to go to the error WF

- to go the menu (three dots) and select Evaluate

- to confirm the action to the question: Job has been modified. Do you wish to save your changes before continuing?

See the reply in context

Attachments

No one else had this question

Outcomes

Craig Ramsay

Apr 30, 2020 4:20 AM

Hi Olga,

Is the error in each case due to the attempt to create a new account with a name that already exists in the target system or is there another error I am not seeing.

Trying to understand the use case here, from what I can see:

Missing Entitlements Rule detects User with missing ents from a Managed Role
CR Generated from the above rule
- Contains create account and add permissions to 'new' account
CR fails due to account name not being unique in create account work item

Questions:

What logic is being used to calculate the account name?
If it already exists in the target system why is it not mapped to the User?
Is this triggering as part of a Joiner or a Mover? Or is access being removed from accounts or account mapping from users that shouldn't be prompting the missing access rule to add permissions back

1 person found this helpful

Actions

Ahmed Nofal

Apr 30, 2020 10:55 AM

As you can see and as Craig stated, the request is erroring out because it contains a change request item that is creating an account with a same name of an account in the same directory that is already existing in IG&L and some ammendments need to be probably made to your account naming logic to overcome this in the future.

If you already acknowledge the reason the request is erroring up as stated above and you want to proceed with the rest of the change request items not related to that account that already exists, then you have a valid argument there. What I believe in is that IG&L should only cancel the change request items causing the error and proceed with the rest of the CR items in that change request. I suggest you open a support ticket for this issue to see how the response from the engineering team is like on this one, as currently you cannot proceed with the other items in that CR in error state.

Actions

Ian Staines

@ Ahmed Nofal on Apr 30, 2020 12:28 PM

I agree it would be interesting to see what engineering says.

To be fair, with a provisioning product the conservative approach when there is an unhanded error is not to proceed with the action. Is easy to say that we should proceed with the rest of the CR but that is a subjective decision and machines are not the best at that. While for create account use case it may make sense to continue to provision the rest of the CR that may not be a general rule for all types of request or all types of provisioning.

Actions

Pchelintseva Olga May 4, 2020 11:03 AM

Dears,

We found a solution, at list request skipped the error and the groups and/or entitlements were assigned to the users which were affected by the change request.

The needed actions are:

- to go to the error WF

- to go the menu (three dots) and select Evaluate

- to confirm the action to the question: Job has been modified. Do you wish to save your changes before continuing?

1 person found this helpful

Actions

4 Replies

Craig Ramsay Apr 30, 2020 4:20 AM
Mark Correct
Correct Answer
Hi Olga,

Is the error in each case due to the attempt to create a new account with a name that already exists in the target system or is there another error I am not seeing.

Trying to understand the use case here, from what I can see:
- Missing Entitlements Rule detects User with missing ents from a Managed Role
- CR Generated from the above rule
  Contains create account and add permissions to 'new' account
- CR fails due to account name not being unique in create account work item
Questions:
- What logic is being used to calculate the account name?
- If it already exists in the target system why is it not mapped to the User?
- Is this triggering as part of a Joiner or a Mover? Or is access being removed from accounts or account mapping from users that shouldn't be prompting the missing access rule to add permissions back
1 person found this helpful
Like • Show 2 Likes2
Actions
Ahmed Nofal Apr 30, 2020 10:55 AM
Mark Correct
Correct Answer
As you can see and as Craig stated, the request is erroring out because it contains a change request item that is creating an account with a same name of an account in the same directory that is already existing in IG&L and some ammendments need to be probably made to your account naming logic to overcome this in the future.

If you already acknowledge the reason the request is erroring up as stated above and you want to proceed with the rest of the change request items not related to that account that already exists, then you have a valid argument there. What I believe in is that IG&L should only cancel the change request items causing the error and proceed with the rest of the CR items in that change request. I suggest you open a support ticket for this issue to see how the response from the engineering team is like on this one, as currently you cannot proceed with the other items in that CR in error state.
Like • Show 1 Like1
Actions
- Ian Staines @ Ahmed Nofal on Apr 30, 2020 12:28 PM
  Mark Correct
  Correct Answer
  I agree it would be interesting to see what engineering says.
  
  To be fair, with a provisioning product the conservative approach when there is an unhanded error is not to proceed with the action. Is easy to say that we should proceed with the rest of the CR but that is a subjective decision and machines are not the best at that. While for create account use case it may make sense to continue to provision the rest of the CR that may not be a general rule for all types of request or all types of provisioning.
  Like • Show 1 Like1
  Actions
Pchelintseva Olga May 4, 2020 11:03 AM
Unmark Correct
Correct Answer
Dears,

We found a solution, at list request skipped the error and the groups and/or entitlements were assigned to the users which were affected by the change request.
The needed actions are:
- to go to the error WF
- to go the menu (three dots) and select Evaluate
- to confirm the action to the question: Job has been modified. Do you wish to save your changes before continuing?
1 person found this helpful
Like • Show 1 Like1
Actions

Rule Missing entitlements - Error clearance

Attachments

Outcomes

Related Content

Recommended Content