Dear colleagues,

defining filters in the Life Cycle Rules we have not able to use the expression ${role.errolename}, neither with wildcards nor special characters like '(', ')', … , although they are replaced by the '\' + ASCII code as it is defined in the RFC. Please, could you confirm that it is not possible?

 Thank in advanced for your support.

Dear colleagues,

defining filters in the Life Cycle Rules we have not able to use the expression ${role.errolename}, neither with wildcards nor special characters like '(', ')', … , although they are replaced by the '\' + ASCII code as it is defined in the RFC. Please, could you confirm that it is not possible?

 Thank in advanced for your support.

Hi Franz,
let me show you some examples where it could be interesting. There is no doubt that there are workarounds for the issues we will see later, nevertheless this post it is just only to confirm that there are some limitations defining LCR with role names.

Example1 
The role name 'BE-WINDOWS (BDEEXP01)' must be renamed as 'BE-WINDOWS-BDEEXP01' for being able to use in the LCR definition: ' (${role.errolename}=BE-WINDOWS-BDEEXP01)'.

Using escape characters in the filter, ie. '(${role.errolename}=BE-WINDOWS \28BDEEXP01\29)', is not an option due to it doesn't work.

When the role name, instead of erglobalid, is used in the filter, it allows us to import the LCR to ISIM production from development enviroment. At the same time, the LCR is legible.

Example 2.
We would like to run a LCR for the users who are authorized to one application. As we are working in a RBAC modelo it could be done using a wildcard in the LCR filter, such as: '(${role.errolename}=W-APL.XXX*)'

BTW: it would be great to be able to use role name in the dynamic rol definition for setting automatic dependences between roles without workflows customizations, neither managing role hierarchy.

------------------------------
Felipe Risalde Serrano
Security Expert
Banco de España

Original Message:
Sent: Mon February 08, 2021 04:00 AM
From: Franz Wolfhagen
Subject: Using wildcard and special characters in LCR filters

Can you please show one or more  example of what you are trying to accomplish ? There are some limitations to the filters - but none that matches what you seem to struggle with :-)

------------------------------
Franz Wolfhagen
IAM Technical Architect for Europe - Certified Consulting IT Specialist
IBM Security Expert Labs

Original Message:
Sent: Mon February 08, 2021 03:31 AM
From: Felipe Risalde Serrano
Subject: Using wildcard and special characters in LCR filters

Dear colleagues,

defining filters in the Life Cycle Rules we have not able to use the expression ${role.errolename}, neither with wildcards nor special characters like '(', ')', … , although they are replaced by the '\' + ASCII code as it is defined in the RFC. Please, could you confirm that it is not possible?

 Thank in advanced for your support.

Hi Franz,
let me show you some examples where it could be interesting. There is no doubt that there are workarounds for the issues we will see later, nevertheless this post it is just only to confirm that there are some limitations defining LCR with role names.

Example1 
The role name 'BE-WINDOWS (BDEEXP01)' must be renamed as 'BE-WINDOWS-BDEEXP01' for being able to use in the LCR definition: ' (${role.errolename}=BE-WINDOWS-BDEEXP01)'.

Using escape characters in the filter, ie. '(${role.errolename}=BE-WINDOWS \28BDEEXP01\29)', is not an option due to it doesn't work.

When the role name, instead of erglobalid, is used in the filter, it allows us to import the LCR to ISIM production from development enviroment. At the same time, the LCR is legible.

Example 2.
We would like to run a LCR for the users who are authorized to one application. As we are working in a RBAC modelo it could be done using a wildcard in the LCR filter, such as: '(${role.errolename}=W-APL.XXX*)'

BTW: it would be great to be able to use role name in the dynamic rol definition for setting automatic dependences between roles without workflows customizations, neither managing role hierarchy.

------------------------------
Felipe Risalde Serrano
Security Expert
Banco de España

Original Message:
Sent: Mon February 08, 2021 04:00 AM
From: Franz Wolfhagen
Subject: Using wildcard and special characters in LCR filters

Can you please show one or more  example of what you are trying to accomplish ? There are some limitations to the filters - but none that matches what you seem to struggle with :-)

------------------------------
Franz Wolfhagen
IAM Technical Architect for Europe - Certified Consulting IT Specialist
IBM Security Expert Labs

Original Message:
Sent: Mon February 08, 2021 03:31 AM
From: Felipe Risalde Serrano
Subject: Using wildcard and special characters in LCR filters

Dear colleagues,

defining filters in the Life Cycle Rules we have not able to use the expression ${role.errolename}, neither with wildcards nor special characters like '(', ')', … , although they are replaced by the '\' + ASCII code as it is defined in the RFC. Please, could you confirm that it is not possible?

 Thank in advanced for your support.

Hi Franz,
let me show you some examples where it could be interesting. There is no doubt that there are workarounds for the issues we will see later, nevertheless this post it is just only to confirm that there are some limitations defining LCR with role names.

Example1 
The role name 'BE-WINDOWS (BDEEXP01)' must be renamed as 'BE-WINDOWS-BDEEXP01' for being able to use in the LCR definition: ' (${role.errolename}=BE-WINDOWS-BDEEXP01)'.

Using escape characters in the filter, ie. '(${role.errolename}=BE-WINDOWS \28BDEEXP01\29)', is not an option due to it doesn't work.

When the role name, instead of erglobalid, is used in the filter, it allows us to import the LCR to ISIM production from development enviroment. At the same time, the LCR is legible.

Example 2.
We would like to run a LCR for the users who are authorized to one application. As we are working in a RBAC modelo it could be done using a wildcard in the LCR filter, such as: '(${role.errolename}=W-APL.XXX*)'

BTW: it would be great to be able to use role name in the dynamic rol definition for setting automatic dependences between roles without workflows customizations, neither managing role hierarchy.

------------------------------
Felipe Risalde Serrano
Security Expert
Banco de España

Original Message:
Sent: Mon February 08, 2021 04:00 AM
From: Franz Wolfhagen
Subject: Using wildcard and special characters in LCR filters

Can you please show one or more  example of what you are trying to accomplish ? There are some limitations to the filters - but none that matches what you seem to struggle with :-)

------------------------------
Franz Wolfhagen
IAM Technical Architect for Europe - Certified Consulting IT Specialist
IBM Security Expert Labs

Original Message:
Sent: Mon February 08, 2021 03:31 AM
From: Felipe Risalde Serrano
Subject: Using wildcard and special characters in LCR filters

Dear colleagues,

defining filters in the Life Cycle Rules we have not able to use the expression ${role.errolename}, neither with wildcards nor special characters like '(', ')', … , although they are replaced by the '\' + ASCII code as it is defined in the RFC. Please, could you confirm that it is not possible?

 Thank in advanced for your support.

Hi Franz,
let me show you some examples where it could be interesting. There is no doubt that there are workarounds for the issues we will see later, nevertheless this post it is just only to confirm that there are some limitations defining LCR with role names.

Example1 
The role name 'BE-WINDOWS (BDEEXP01)' must be renamed as 'BE-WINDOWS-BDEEXP01' for being able to use in the LCR definition: ' (${role.errolename}=BE-WINDOWS-BDEEXP01)'.

Using escape characters in the filter, ie. '(${role.errolename}=BE-WINDOWS \28BDEEXP01\29)', is not an option due to it doesn't work.

When the role name, instead of erglobalid, is used in the filter, it allows us to import the LCR to ISIM production from development enviroment. At the same time, the LCR is legible.

Example 2.
We would like to run a LCR for the users who are authorized to one application. As we are working in a RBAC modelo it could be done using a wildcard in the LCR filter, such as: '(${role.errolename}=W-APL.XXX*)'

BTW: it would be great to be able to use role name in the dynamic rol definition for setting automatic dependences between roles without workflows customizations, neither managing role hierarchy.

------------------------------
Felipe Risalde Serrano
Security Expert
Banco de España

Original Message:
Sent: Mon February 08, 2021 04:00 AM
From: Franz Wolfhagen
Subject: Using wildcard and special characters in LCR filters

Can you please show one or more  example of what you are trying to accomplish ? There are some limitations to the filters - but none that matches what you seem to struggle with :-)

------------------------------
Franz Wolfhagen
IAM Technical Architect for Europe - Certified Consulting IT Specialist
IBM Security Expert Labs

Original Message:
Sent: Mon February 08, 2021 03:31 AM
From: Felipe Risalde Serrano
Subject: Using wildcard and special characters in LCR filters

Dear colleagues,

defining filters in the Life Cycle Rules we have not able to use the expression ${role.errolename}, neither with wildcards nor special characters like '(', ')', … , although they are replaced by the '\' + ASCII code as it is defined in the RFC. Please, could you confirm that it is not possible?

 Thank in advanced for your support.

Hi Franz,
let me show you some examples where it could be interesting. There is no doubt that there are workarounds for the issues we will see later, nevertheless this post it is just only to confirm that there are some limitations defining LCR with role names.

Example1 
The role name 'BE-WINDOWS (BDEEXP01)' must be renamed as 'BE-WINDOWS-BDEEXP01' for being able to use in the LCR definition: ' (${role.errolename}=BE-WINDOWS-BDEEXP01)'.

Using escape characters in the filter, ie. '(${role.errolename}=BE-WINDOWS \28BDEEXP01\29)', is not an option due to it doesn't work.

When the role name, instead of erglobalid, is used in the filter, it allows us to import the LCR to ISIM production from development enviroment. At the same time, the LCR is legible.

Example 2.
We would like to run a LCR for the users who are authorized to one application. As we are working in a RBAC modelo it could be done using a wildcard in the LCR filter, such as: '(${role.errolename}=W-APL.XXX*)'

BTW: it would be great to be able to use role name in the dynamic rol definition for setting automatic dependences between roles without workflows customizations, neither managing role hierarchy.

------------------------------
Felipe Risalde Serrano
Security Expert
Banco de España

Original Message:
Sent: Mon February 08, 2021 04:00 AM
From: Franz Wolfhagen
Subject: Using wildcard and special characters in LCR filters

Can you please show one or more  example of what you are trying to accomplish ? There are some limitations to the filters - but none that matches what you seem to struggle with :-)

------------------------------
Franz Wolfhagen
IAM Technical Architect for Europe - Certified Consulting IT Specialist
IBM Security Expert Labs

Original Message:
Sent: Mon February 08, 2021 03:31 AM
From: Felipe Risalde Serrano
Subject: Using wildcard and special characters in LCR filters

Dear colleagues,

defining filters in the Life Cycle Rules we have not able to use the expression ${role.errolename}, neither with wildcards nor special characters like '(', ')', … , although they are replaced by the '\' + ASCII code as it is defined in the RFC. Please, could you confirm that it is not possible?

 Thank in advanced for your support.

Hi Franz,
let me show you some examples where it could be interesting. There is no doubt that there are workarounds for the issues we will see later, nevertheless this post it is just only to confirm that there are some limitations defining LCR with role names.

Example1 
The role name 'BE-WINDOWS (BDEEXP01)' must be renamed as 'BE-WINDOWS-BDEEXP01' for being able to use in the LCR definition: ' (${role.errolename}=BE-WINDOWS-BDEEXP01)'.

Using escape characters in the filter, ie. '(${role.errolename}=BE-WINDOWS \28BDEEXP01\29)', is not an option due to it doesn't work.

When the role name, instead of erglobalid, is used in the filter, it allows us to import the LCR to ISIM production from development enviroment. At the same time, the LCR is legible.

Example 2.
We would like to run a LCR for the users who are authorized to one application. As we are working in a RBAC modelo it could be done using a wildcard in the LCR filter, such as: '(${role.errolename}=W-APL.XXX*)'

BTW: it would be great to be able to use role name in the dynamic rol definition for setting automatic dependences between roles without workflows customizations, neither managing role hierarchy.

------------------------------
Felipe Risalde Serrano
Security Expert
Banco de España

Original Message:
Sent: Mon February 08, 2021 04:00 AM
From: Franz Wolfhagen
Subject: Using wildcard and special characters in LCR filters

Can you please show one or more  example of what you are trying to accomplish ? There are some limitations to the filters - but none that matches what you seem to struggle with :-)

------------------------------
Franz Wolfhagen
IAM Technical Architect for Europe - Certified Consulting IT Specialist
IBM Security Expert Labs

Original Message:
Sent: Mon February 08, 2021 03:31 AM
From: Felipe Risalde Serrano
Subject: Using wildcard and special characters in LCR filters

Dear colleagues,

defining filters in the Life Cycle Rules we have not able to use the expression ${role.errolename}, neither with wildcards nor special characters like '(', ')', … , although they are replaced by the '\' + ASCII code as it is defined in the RFC. Please, could you confirm that it is not possible?

 Thank in advanced for your support.

First at all, please don't say sorry for the delay. It must not be seen as we are managing an incident with Support, if not just only sharing our thoughts, and so we do our best effort to enrich the forum.

Going to the subject, as I said, more than to have an use cases, my questions started just for my better understanding (probably this user case happened when the '(' and ')' characters could be escaped and a wildcard tried to be used). Let me to invent an example where wildcards could be interesting. It could be needed you send an email to anyone who are authorized to one application. Taking into consideration in a RBAC model all of them belong to some application role, it could be fixed in an easy way by means of a LCR. I totally agree it can be used carefully.

I keep my eyes in the new release due to it is in our plans to migrate to that one in the comings months

Hi Franz,
let me show you some examples where it could be interesting. There is no doubt that there are workarounds for the issues we will see later, nevertheless this post it is just only to confirm that there are some limitations defining LCR with role names.

Example1 
The role name 'BE-WINDOWS (BDEEXP01)' must be renamed as 'BE-WINDOWS-BDEEXP01' for being able to use in the LCR definition: ' (${role.errolename}=BE-WINDOWS-BDEEXP01)'.

Using escape characters in the filter, ie. '(${role.errolename}=BE-WINDOWS \28BDEEXP01\29)', is not an option due to it doesn't work.

When the role name, instead of erglobalid, is used in the filter, it allows us to import the LCR to ISIM production from development enviroment. At the same time, the LCR is legible.

Example 2.
We would like to run a LCR for the users who are authorized to one application. As we are working in a RBAC modelo it could be done using a wildcard in the LCR filter, such as: '(${role.errolename}=W-APL.XXX*)'

BTW: it would be great to be able to use role name in the dynamic rol definition for setting automatic dependences between roles without workflows customizations, neither managing role hierarchy.

------------------------------
Felipe Risalde Serrano
Security Expert
Banco de España

Original Message:
Sent: Mon February 08, 2021 04:00 AM
From: Franz Wolfhagen
Subject: Using wildcard and special characters in LCR filters

Can you please show one or more  example of what you are trying to accomplish ? There are some limitations to the filters - but none that matches what you seem to struggle with :-)

------------------------------
Franz Wolfhagen
IAM Technical Architect for Europe - Certified Consulting IT Specialist
IBM Security Expert Labs

Original Message:
Sent: Mon February 08, 2021 03:31 AM
From: Felipe Risalde Serrano
Subject: Using wildcard and special characters in LCR filters

Dear colleagues,

defining filters in the Life Cycle Rules we have not able to use the expression ${role.errolename}, neither with wildcards nor special characters like '(', ')', … , although they are replaced by the '\' + ASCII code as it is defined in the RFC. Please, could you confirm that it is not possible?

 Thank in advanced for your support.