Entitlements refer to the access rights an account has on a source.
If you've already loaded account information into IdentityNow from a source, you've also aggregated the entitlements associated with users. To make sure your users have access to everything they need, you should also run an entitlement aggregation separately.
An entitlement aggregation:
- Defines the entire catalog of entitlements associated with the source, regardless of whether they're already associated with accounts.
- Aggregates each entitlement's additional attributes, such as raw entitlement data and relationships with other entitlements.
- Updates entitlements that have already been aggregated.
If an entitlement is aggregated as part of an account aggregation, but IdentityNow doesn't detect it in any entitlement aggregations, the entitlement will be deleted from your site.
Creating an Entitlement Catalog for a Direct Connect Source
You can aggregate entitlements from a direct connect source just as you can aggregate accounts. You can also configure IdentityNow to aggregate entitlements on a schedule.
Prerequisite: Load accounts from a supported source.
To start an entitlement aggregation from a direct connect source:
In the Admin interface, go to Connections > Sources.
Click a direct connect source.
Go to Import Data > Entitlement Aggregation.
Choose whether to perform a one-time manual aggregation or to schedule recurring aggregations.
To perform a manual aggregation, click Start beside Manual Aggregation. The process begins immediately and occurs only once.
To schedule recurring aggregations, select the Enable Schedule checkbox.
Choose how often the aggregation should run. You'll see the following options:
If you chose the Daily option, select a time period in the Recurring Every field. This field determines how often the aggregation occurs after the time selected. For example, if you schedule a daily aggregation for 5pm to recur every 4 hours, the aggregation will run only at 5pm and 9pm, depending on the load.
Make the additional required selections under each option and select Save.
This source will automatically run an entitlement aggregation on the schedule you configured.
Creating an Entitlement Catalog for a Flat File Source
You can aggregate entitlements from a flat file source by uploading a flat file containing your entitlement data.
It is not possible to schedule recurring entitlement aggregations from a flat file source.
Prerequisite: Load accounts from a flat file.
To upload entitlements from a flat file source:
In the Admin interface, go to Connections > Sources.
Click a source that uses a flat file feed.
Go to Import Data > Import Entitlements.
Click Download to download the template.
The file you upload for a source must use the column headings included in the entitlements file template for that source. Column headings differ based on the type of source you're downloading entitlements from.
The most common type of flat file source is a delimited file.
The following columns are required regardless of source type:
- id - the technical ID for the entitlement
- name - the technical name for the entitlement
- displayName - the name for the entitlement that displays in the IdentityNow UI
- description - the description of the entitlement visible in the UI and during certifications
If you need help filling in these columns, contact SailPoint Expert Services.
Either edit your existing entitlements file to include the column headings from the template or populate the entitlements data into the template.
- Entitlements might be aggregated with names and descriptions that are difficult for end users to understand. You can make changes to those fields to enable users to make better decisions when reviewing access requests or certifications.
- The use of emojis in entitlement names and descriptions is not supported – only string values are accepted.
Save the file.
In the SailPoint Admin interface, click Import.
Select the file from step 6.
Screenshots related to these files are examples only. Excel is not required.
Information about the file is loaded into the Current File section.
After uploading this file, you can download it again to make changes as needed. Go to the Entitlements tab on a source and select Download CSV to download IdentityNow's latest version of the entitlements for this source.
Marking Entitlements Privileged
Entitlements from any source can be marked as privileged to reinforce their importance to users and to draw attention to any special access they grant. This flag appears everywhere the entitlement is displayed, including Search and certifications.
Any access profiles that contain a privileged entitlement are also marked as privileged.
To mark an entitlement privileged:
In the Admin interface, go to Connections > Sources, and click the source that contains the entitlements you want to edit.
In the Entitlements tab, select the checkbox next to the entitlements you want to mark as privileged.
Select the Actions drop down and select Mark as Privileged.
These entitlements display the privileged flag in all new certifications and anywhere in the product that entitlements are displayed.
If this entitlement is part of an access profile, that access profile will also be marked as privileged.
There are a number of places in IdentityNow where you can view the entitlements in your system.
- View all entitlements - To view all the entitlements for all sources in your system, go to Search. Search on the * wildcard, and go to the Entitlements tabs. A complete list of entitlements in your site is displayed.
- View a source's entitlements - In the Admin interface, go to Connections > Sources and click the source you want to view. Go to the Entitlements tab to see a complete list of all entitlements from that source.
- View an identity's entitlements - In the Admin interface, go to Identities > Identity List and click the name of the identity you want to view. On the Accounts tab, click the source you want to view. The identity's entitlements from that source are displayed in the Entitlements tab at the bottom of the page.
If you’re seeing an entitlement that doesn’t contain the correct group name or is missing the display name or description, there was probably a problem connecting to the source during an aggregation.
You have the following options for resolving this problem:
- Perform an entitlement aggregation for your source to pull in the display names and descriptions for all entitlements.
- Using the Update Schema API, modify the attribute used as the description attribute for your entitlements. The next time you run an entitlement aggregation for this source, IdentityNow will use the data in this attribute to populate the entitlements' description field.
- Edit the CSV file in the Entitlements tab for your source to fix any incorrect or incomplete entitlement data, and reupload it into IdentityNow.