Allow System Owners to Review Access Reviews for Roles that involved their Application Only

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

The following is an example on how to configure different system accounts in Identity Governance to allow specific users to login to Identity Governance to view any user access reviews that have roles that involved their Application only.
Also how to limit them to read-only access to the access reviews. 

Environment

Symantec Identity Governance 

Resolution

Please note that this is an example which utilizes the Eurekify universe. 

1.) In property settings search for this property: "sage.security.disable" and set it to "False". Restart the server

2.) Using the DNA, open the Eurekify.cfg file and locate any user ("TestUser01" used in as an example below) and right click on him and "Show linked entities"

3.) Remove from "TestUser01"  "Basic Role" and link to "TestUser01" only these resources: a.) TmsSystem.* b.) SelfService.* c.) [Universe][R] d.) Entity Browser

4.) Save Eurekify.cfg to DB

5.) Open file:Eurekify_Resources.rdb and add a new resource with these attribures: a.) Res Name 1: [FILTER_ROLE] b.) Res Name 2: * c.) Res Name 3: Filter (add any non existing ID) d.) Description: Any description e.) Type: Filter f.) Filter 1: (rolename=Testrole)

6.) Save configuration to DB

7.) Drag the new Filter from the Eurekify_Resources.cfg to the Eurekify.cfg configuration and save it

8.) Link between "TestUser01" and the new Filter Resource you have created in Eurekify.cfg file

9.) Open the Model configuration and add a new Role with name 'Testrole' and Save the model configuration to DB

10.) Open IG web portal, login with "TestUser01" and verify in portal home page only these links(Home, Role Management, Entity Browser) are displayed to the user

11.) Click on "Entity Browser" link and Choose your Model configuration and verify on the role Testrole is displayed.
 

Additional Information

​For more information on how to use Filters and provide the permissions please review the documentation: Filter Type Resources