No Compliance Rule Has Been Violated LieP

Question

In OIM 7.1.2 our workflow is granting business roles to requests that violated policy. After granting the business role, if we run the compliance rule check task, the person will be flagged as violated. Our workflow has several steps, but the last two are: Rule Violations (CR - Compliance check Simplified) then on fail goes to Rule Violation for Exception Approver (OC - Exception approvers for violated rules). The audit policy in question has exception approvers and neither the requester or the requestee is on that list. The work approval history is showing no compliance rule has been violated, however as I stated before, if we run the rule check the person gets flagged as violated. Here is a example of one of the rules that is passes that fails after being assigned: 
 This rule will be violated only by employees that meet all of the following conditions: 
 Property Business Role is X,Y,Z 
 If one of the employee's identities meets the following conditions 
 The Employee has at least one entitlement of the type Account Definitions that meets all of the following sub-conditions: 
 Account Definition contains System Admin 
 
 (IE can't have Role X, Y, or Z and have a role with the account def System admin)

Markus Weiss-Ehlers · Accepted Answer

Yes, there are primary and secondary memberships in role possible in One Identity Manager, but after some digging, I do not think that this is the issue here. 
 Reason for the seen behavior is, as assumed earlier, the way you have defined the rule leads to the seen behavior. You have limited the persons, that should be checked against an assigned account definition with the condition for your business roles. So when the risk analysis during the approval workflow is checking the rules that might have been violated, it will jump over your rule, because the recipient is currently not an affected person according to the condition of your rule. 
 When the request has been fulfilled, the user is matched by your person condition and the compliance check will find the violation. 
 To avoid that, and to be able to detect a potential violation due to the request you have to options. 
 Option a) Define two compliance rules to check your use-case. Rule one has the business role assignments in the upper person condition and checks against the account definitions in the lower part. And the other one checks against the account definitions in the upper part and against the business role memberships in the lower part. In that case, one of the rules will be violated during the request depending on what type of assignment exists prior to the request. A drawback is that after the fulfillment you end up with two violations, one for each rule. 
 Option b) Re-define your compliance rule and remove the condition in the upper part and replace it with a check against the business roles in the lower part with the type "at least one role or organizational assignment". It should look similar to the screenshot I've attached. Please check the behavior of the proposed rule to see if it fits your needs and performance expectations.

No Compliance Rule Has Been Violated LieP

Top Replies