User group provision

[Former Member]

Hi Experts,

We have different user groups created in prod systems and we want to tag them to users as needed/fit when creating users through GRC.

is it possible?

[Former Member · Accepted solution]

Thanks.

Here the S&A team submits the access request.

We understand the country of the user by the last two characters of the user Id.

Team we can populate depending on the JOB/Business role they request in the incident.

[former_member193066 · Accepted solution]

ok, cool, means this can be updated manually by S&A team while submission.

in EUP setting make user group mandatory and keep it editable.

before submitting the request in GRC update user group manually.

Regards,

Prasant

[Former Member]

I am finding the user default one a bit complicated

[former_member193066]

lets start from beginning.

from where you want to populate country?

from where you want to populate team.

does the user knows their user group?

can user select manually?

Approvers know their  user group?

then we can find a way to achive

Regards,

Prasant

[Former Member]

Thanks Plaban.

I will try and come back to you.

thanks to both of you for spending your time.

[former_member193066]

Hello,

first you need to check whether u can populate these 2 things in access request.

location can be used to populate country from LDAP by mapping to an LDAP attribute to location field.

not sure how you want to use Team, may be you can use function area, if that can also be mapped with some attribute in LDAP then that would be nice, after that you can follow whats plaban say or.

you can customize and make your own development either in screen or methods to achieve this.

to help you further lets us know where those data are maintained , to which country they belong and which team they belong.

REgards,

Prasant

[Former Member]

Hi Prashant,

The requirement is hat twe have to assign user groups based on the country and functional team.

Example: If an user is from UK and from FI team,we have have to assign UK_FI and so on.

[Former Member]

hi Somik,

Does your request capture Country and Team? If so, you can use these fields in Decision table of User default, and then assign user group to User default, in SPRO->..-> Maintain user defaults-> set user group.

This will be an easy and one-time set up, so that you do not have to fill up user group manually for a new user. Also, this eliminates the manual error factor, of incorrect user group fill.

Regards

Plaban

[former_member193066]

hello,

check your EUP setting and enable user group visible and editable,

you can fill user group while submitting request.

Regards,

Prasant

[Former Member]

Thanks Prasant!

Do I need to run any sync to see the groups available on the connector? or should we put the group manually?

[Former Member]

Hi Somik,

Could you explain how the answer is correct , when GRC system does not have user group values of connectors.

Sync will not pull user group values. Also, adding all user group values(of all connectors) into GRC Systems' s Own User group list , will ruin GRC system's data, because GRC itself is a connector,like any other. Eg. do you add all user groups of BI into ECC?

When your system has diff. user groups for Countries, why don't you use User defaults. It can assign user group values based on country. but , you would have to pull country from the request raised.

everyone has taken the long road, when they started as a beginner. So, it was never easy for anyone.

Regards

plaban

[Former Member]

Hi Plaban,

Absolutely! I completely agree with you and has full respect about the journey you had to come here.

It's always an inspiration while starting as a learner.

Can you please provide some more details on the below

When your system has diff. user groups for Countries, why don't you use User defaults. It can assign user group values based on country. but , you would have to pull country from the request raised.

How can we map user group to countries in user default?

[former_member193066]

Hello Somik,

i just replied based on my little knowledge in GRC.

I am very beginner with less experience,Unlike Plaban who is great experienced person.

would request you to remove this as answered and change it to plaban who gave you nice answer, as per my knowledge goes we could have kept it simple by keeping user group editable and can be filled manually as well,

i think for existing user user group can be populated automatically, just based on my little experience,you can seek help of other .

thanks ..

Prasant K Paichha

[Former Member]

Hi Prasant,

i admire you a lot, and you have been posting much before than i have. So, i am lesser experienced than you, in GRC.

Yes, existing user group of a user will be pulled automatically, and can be changed when set as editable and therefore can be filled manually.

Regards

Plaban

[Former Member]

Hi Both,

I admire you all the time and you all inspire me all the time.

But when I see in the GRC request the existing groups are not getting populated

Did i miss something here?

[Former Member]

Hi Somik,

Can you check, If you  have any user group values in GRC system. If not, as a best practice you cam create custom field, and proceed, as posted earlier by me.

Regards

Plaban

[former_member193066]

well i think , you need little tweak , to achieve what you need.

check you user detail data  source .

. im not sure about your design and your requirement completely, you just wanted to know whether you can keep user group in access request, which have been answered,

we cannot help unless you provide complete details of you requirement .

may be once we have fair idea we can help you setting your requirement.

regards,

prasant

[Former Member]

Hi Somik,

you can use User defaults, for assigning user group. But you can also create custom field, in GRC Box.  Add all user group values to this field. Then map this field to CLASS, in SPRO->-->Maintain mapping for Action and Connector groups. A simple search will give results, on this

Regards

Plaban

[Former Member]

Hi Plaban,

I have a lot of respect for all the knowledge and kindness of this community.

I am a new learner and I know that all the things are that not that easy to me as it may be to wise people like you

Our system has different user groups based on countries and functional team.

Can you kindly guide or refer to some blog/content?

Thanks as always!