Assignment Behavior
Introduction
Throughout its life cycle, any role or resource assignment is subject to multiple changes. Depending on the order of these changes, the system configuration, and other influencing factors, the resulting outcomes may not always be intuitive or predictable. This page documents various scenarios and edge cases to help you identify potential issues and plan more effectively.
Shortening and Extending
Shortening an Assigned Assignment
When an assignment is already in place, its duration may be subject to change for various reasons:
The duration was manually edited.
The assignment is based on employment, and the employment's
valid-to
date has been set or adjusted to an earlier date.The assignment is tied to an employment, and the associated organizational unit's
valid-to
date has been set or shortened.
In such cases, the valid-to
date of the assignment will be updated to reflect the new valid-to
date without requiring any additional actions. If the assignment initially required approval, no new approval process will be triggered, as the revised assignment duration remains within the time frame of the original approval.
Extending an Assigned Assignment
When an assignment is already in place, its duration may be extended for various reasons:
The duration was manually edited.
The assignment is based on employment, and the employment's
valid-to
date has been set or adjusted to a later date.The assignment is tied to an employment, and the associated organizational unit's
valid-to
date has been extended.
In such cases, the valid-to
date of the assignment will be updated to reflect the new date. If an approval process is required, it will be triggered again. Since extending the timeframe significantly alters the approved scope, a new approval is necessary.
What Happens to the Assignment
During this process, any existing assignments will transition to the deletion pending
state until the approval is processed. However, even though the assignment is in this state, it will not be deprovisioned until the approval is either declined or the original valid-to
date has passed.
Deny
Denies are an effective tool while building your role model. There are a few key rules that you should be aware of, when using those.
If you have assigned resource A through one role, and you have another role assignment that contains a deny to the resource A, the deny will have higher priority
If you have assigned resource A manually and you have role assignment that contains a deny to the resource A, the manual assignment will have higher priority
So to summarize the priorities:
Manual denies
Manual assignments
Automatic denies
Automatic assignments
© ITSENSE AG. Alle Rechte vorbehalten. ITSENSE und CoreOne sind eingetragene Marken der ITSENSE AG.