Compare and Export Assigned privileges

[Former Member]

Dear all,

How to compare the user assigned privileges in the system (in reality) and the related/Linked privileges to BR or Rules.

For example:

BR1: Priv 1 + Priv2

Rule1: Priv3

User1 has BR1 and Rule1.

How to be sure that the User1 having BR1 and Rule1 has really these privileges: Priv1, Priv2 and Priv3 and nothing is missing and how to get the status of each assignement (OK or Not).

Is it possible to export the task's result to Excel file ?

Many thanks for your help,

Regards,

Niad

[Former Member · Accepted solution]

Hi Niad,

You can query it from the idm_views . To know more about the views available in IDM, from management console, goto help and search for views as below. you will get the required information.

Alternatively, you can refer to the reporting section of SAP IDM RDS solution. I am sure the reports available with RDS solution meets your requirement.

All the best !!!

~ Krishna.

[Former Member]

Many thanks Krishna and Matt,

Step1: We generate privileges by rules(for example HR Position) or by Business roles.

As mentionned in my example: I will generate 3 privileges (priv1, priv2 and priv3). (A)

Step2: I assign a BR/Rule to my user U. -->user gets privileges (B)

Step3: How to be sure that the assigned privileges in (B) are the same as in (A) for one given user U?

Please give the idm tables to check ?

Best regards,

Niad

[former_member2987]

Niad,

Part of the answer if you want from a table perspective depends on the version of IDM you are using.

If you're using 7.1, I believe it is MXIV_SENTRIES

In 7.2 it is idmv_vallink_ext_active (since you'll only want active users).

As I mentioned before, you can direct the results of this query (I'm guessing you'll do at least some column filtering) to a CSV file in a Job which can then be read by Excel.

Hope this helps!

Matt

[former_member2987]

Niad,

Not sure about the first part of your question.  You can always look in an edit/view user screen to see what is assigned.

As far as dumping everything to Excel, my suggestion would be to create a job that would dump the information into a CSV file which excel could read.

Matt