Identity Portal Risk configuration role addition and removal limitation

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

When configuring Risk in Identity Portal, users may find that the interface does not allow for the simultaneous addition and removal of roles. This behavior is a built-in product safeguard designed to prioritize "Add" operations and prevent the accidental deletion of accounts that might occur during a recreate-style role transition.

Symptoms

• Unable to add and remove roles simultaneously within the Risk Configuration screen.
• Modifications to roles do not commit when both addition and deletion are attempted in a single operation.

Environment

Identity Portal 

Cause

This is a product design limitation intended to protect against data loss. The system requires an explicit "Add" operation to be successfully processed before a "Delete" operation can be initiated for a related role or account set.

Resolution

While the UI enforces this sequence, a workaround can be implemented using a custom attribute and Policy Xpress (PX) to automate the role transitions:

1. Create a Custom Attribute: Define a new user attribute that will serve as a trigger (e.g., roleTransitionFlag).
2. Evaluate Attribute Value: Configure the Risk evaluation to look at the value of this custom attribute.
3. Configure Policy Xpress:
   • Create a PX Policy that triggers upon the modification of this custom attribute.
   • Set the policy logic to manage the addition and removal of roles based on the attribute value provided during the user modification.
4. Trigger the Transition: When a role change is required, modify the user by setting the custom attribute value. The PX Policy will then handle the underlying role assignments on the back-end, bypassing the UI risk configuration restriction.