FullSODCheck

Full segregation of duty check that reports all existing violations

FullSODCheck performs a full segregation-of-duty (SoD) check across all users in the Identity Store. The PolicyAgent evaluates every user’s current privilege set against the configured SoD rules and records all violations it finds. The check is a reporting operation: it does not remove or revoke any privilege assignments.

Run this workflow periodically or before compliance audits to get a complete picture of all active SoD violations in the Identity Store.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

FullSODCheck

Category

Identity Store

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

-

Connected system / controller type

-

Configuration wizard

LDAP-LDAP

Active in the factory data

not set

Factory data version

7.0

Factory data path

Workflows/Default/Identity Store/FullSODCheck

Prerequisites

  • SoD rules must be configured in the Identity Store.

  • The FullSODCheck In and FullSODCheck Out channels must be configured in the C++-based Server.

Workflow and Activities

Step Activity Description Agent Runs after

1

FullSODCheck

Full SOD check activity

PolicyAgent

start activity

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

FullSODCheck

FullSODCheck

PolicyAgent

Full Import

FullSODCheck In

FullSODCheck Out

Configuration Parameters

Table 1. Parameters of job FullSODCheck
Parameter Default value

delta_mode

full

delta_on

0

mode

AssignOnly

request

process

trace

2

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

The workflow has a single activity, FullSODCheck, which runs the PolicyAgent job of the same name. The job reads user entries from the FullSODCheck In input channel and evaluates each user’s privilege set against the SoD rules. Violations are written to the FullSODCheck Out output channel. The mode is AssignOnly and the request is process.

Operation

  1. You start the workflow manually from the Identity Manager or attach it to a schedule.

  2. The C++-based Server starts the FullSODCheck activity and launches the PolicyAgent job.

  3. The agent reads user entries from the Identity Store through the FullSODCheck In input channel.

  4. For each user the configured SoD rules are evaluated against the user’s current privilege set.

  5. All detected violations are written to the FullSODCheck Out output channel for reporting and review.

  6. Privilege assignments are not modified; the workflow only records and reports violations.