• State Suggested Answer
  • Replies 11 replies
  • Answers 1 answer
  • Subscribers 61 subscribers
  • Views 3094 views
  • Users 0 members are here
Options
Related

Assigning Access Template - Prevent "Propagate permissions to Active Directory"

Michiel
over 2 years ago

Hi,

When linking Access Templates to AD locations (in order to delegate Active Roles permissions to support teams), I'm always a bit worried that someone in my AR admin team (especially the new kids on the block) accidentally enable the option for "Propagate permissions to Active Directory" which appears on the final page of the Delegation Wizard. 

Is it perhaps possible to make that option inaccessible to everyone, thereby forcing them to stick with AR-only permissions? Can I somehow revoke access to that option?

If not, and someone accidentally adds a DENY to the native AD structure - how can we get permissions back? Just by taking ownership + inheriting default permissions down again like you would with a traditional File/Folder structure? Is there a rollback or undo at that level?

One of the major reasons for deploying AR was to keep native AD delegations to a minimum; would be unfortunate if we only make things worse by accidentally applying that "Propagate" option without noticing..

Thanks; regards,

Michiel

Parents
  • 0 over 2 years ago

    Hi  

    Anyone who holds the Active Roles Admin Group have full permissions in Active Roles to perform any administration task, or configuration change. Depending on your environment and your RBAC model, and the way your organization work, you could delegate permissions to do certain configuration changes (under the configuration node) so they don't hold the full admin group.

    But also as   says, you could just use a workflow to intercept any operation against an AT Link (edsACE) object, where the edsaIsSynchronizedWithAD is set to 1 (true), the just change it to 0...

    Or if you have use cases where this needs to be set, do it as an approval workflow (remembering to enforce approval for it fires for Admins too)

    This way you could include the edsaIsSynchronizedWithAD in the approval step, to allow the approve (you) the ability to change the value back to 0 manually if required.

  • 0 over 2 years ago in reply to Stu.Pollock

    This information is great guys, thanks so much!! As usual, spot on support by   and  

Reply Children
No Data