adminCount setting retained after JIT role membership to protected groups expired

[red-erik]

Hello,
we noticed that the attribute is still mantaining a value of 1 after Jit Role expiration and removal from group (eg. Domain Admin).
We don't see a simple solution for that because, in some cases, it need to be maintained, while in other not.

Let me try to explain:

1. I'm member of Domain Admins
2. use Jit Role to be "Schema Admins"
3. after Jit Role expiration my account is removed from Schema Admins
4. AdminCount needs to be maintaned since I'm a domain admin

on contrary:

1. I'm a standard user
2. I'm added to Domain Admin with a Jit Role
3. After expiratin, my account is removed from Domain Admins and the adminCount should be cleaned up

Do you see a possible solution doing a check before and after the Jit Role execution ?

Regards,
Red.

[ryannewington]

Hi Red,

This is a tricky one. If Access Manager were to solve this, it would be having to make a decision to reverse something done by AdminSdHolder/SdProp logic. I'm not sure we want to do that. The adminCount isn't so much the problem, it's that sdprop has turned off inheritance and changed the ACLs on the object. We'd only be able to wipe them and reset them back to default. Not something I'm really comfortable with the idea of.

In a practical sense, in my own organization, I would solve this by not letting a standard user become a privileged. I'd have a non-elevated privileged account that I JIT with, to claim the privileged role. The account is always treated as privileged, even if it holds no privileged roles at the time. And it's kept very separate from the day-to-day account.

Ryan

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs.