Role Provisioning Policy And App prov Policy

Implement & Extend
, , ,
1

I have Two create prov policies for the AD . One is on the Application another is on the Role . The Create policy on the application will be used to create primary AD Accounts. The Create policy on the Role will be used for the Admin account creation.  The Role Prov policy is only taking precedence . A plan with all the attributes from  both the policies is created and admin account is provisioned ,when i request for the role .

Now the scenario is i dont want to provision all the attributes on the application create policy to be provisioned for admin accounts i want to skip some . how can i acheive that ?

2

You may find below conversation useful.

https://community.sailpoint.com/t5/IdentityIQ-Forum/Battle-of-the-Role-Provision-Policy-vs-App-Create-Provision/td-p/188772

3

Thanks Kalyan but i did look into that discussion but the final solution was to clarify on what purpose each policy would be utilized .

4

Let’s say there are 4 AD attributes common for both normal and admin account - cn, sn, givenname, samaccountname

There are 2 attributes to be set only for admin account - memberOf to add the account to a specific privileged group, description to reflect this is an admin account

so, first 4 should be part of app provisioning policy and last 2 should be part of role provisioning policy

5

Correct thats wat i did now the scenario is

For normal account (app policy)all 4 attributes(cn,sn,givenname,samaccountname) should be populated with value

For admin account(role policy) 2 attributes(cn,sn) should be there and 1 attribute (given name) should be null. this nullifying part is not working

what i have tried so far is adding that third attribute in the role policy with script as return null;

what happens:  when the provisioning happens,sailpoint creates a combined plan as below

<plan>

cn<value from the role policy>

sn<value from the role policy>

given name <looks the role policy first returning null so this attribute is not in the plan so add it from the app policy>

samaccountname<value from app policy>

</plan>

as this givenname  attribute is returning null in role policy ,it is automatically  taking the attribute from the app provisioning policy and populating value for it .