permission groups and application role

Hello,

Governance Administration would correlate to data Governance.  Have you assigned any of the Data Governance roles?  If not, you won't see this menu.

Specifically, Data Governance\Administrators.

Trevor

Hi Trevor,

if you are referring to the application roles that are under the Identity & Access Governance branch, no, I have not applied them neither to user01 nor  user02. user01 only has the application role Identity Management\Organizations\Administrators and user02 my new application role custom/restrictedOrgAdmin

How can I get user02 to be the administrator of a subgroup of departments, and to access their administration from the IT shop portal?

Regards,

The manager of a department can see the department under Responsibilities | My Responsibilities.

Perhaps you could look into delegation.

Trevor

The manager of a department can see the department under Responsibilities | My Responsibilities.

Perhaps you could look into delegation.

Trevor

Trevor,

what I am looking for is simpler than delegation: that user02 is the administrator of all the departments with a specific role type, without having to make him the manager of these departments. I had seen in the one identity videos how permission groups are related to application roles and how filters are applied to achieve this, but I can't get it to work for me

Thanks

Hi,

That's correct, permission groups are related to application roles, but it cant be complicated, especially as far as IT Shop is concerned.

So vi_4_STRUCTADMIN_ADMIN would have read permissions on the Department table, as you probably have seen, but simply linking a permissions group does not always allow for viewing permissions in IT Shop.

There's actually a condition on the Department tile that determines whether it is displayed on not.  This is based on the entry in HelperHeadOrg. You could look into changing the clause so that it uses the permissions group.  That may be one option.

Trevor

Trevor,

Here in web designer: configure project> Role Management> Reponsability for objects of type Department  I can see the query with helperheadorg that you mention. This query would show the departments of which some of my users were manager from the menu My Responsibilities> Organizations (I will call it, myOrganizations tile) But this is not the case, none of my users is manager of any department or organization. As I said before User01 is a member of the the application role Identity Management\Organizations\Administrators, and from  Responsablitilies> Governance Administration> Organization (allOrganizations tile), this user can manage all the departments. I try, but I am unable to see the query that gives me the visibility of this other tile. Would you know how to guide me?

Sorry, maybe with some images I could explain myself better ... but I don't know how to upload images to the forum

Thanks!

I got it!  Finally I have found the query in the QER_Responsibilities_Administration module

exists("Person", variable("uid_person = '%useruid%' and uid_person in ( select piae.uid_person from personinaerole piae join AERoleCollection aec on aec.UID_AERole = piae.uid_aerole where aec.UID_ParentAERole = 'QER-AEROLE-STRUCTADMIN-ADMIN')"))

I will change it to get it what I'm looking for

Thank you!!