Dynamic calculation of privileges into business role

Question

hi,
I have a requirement to create business roles containing a dynamic list of privileges. In addition, a  costcenter attributes allows to determine the right privileges, within a business role, to assign.
I thought to use dynamic groups so that each time I assign a business role, a calculation of privileges based on costcenter is achieved.
for example:
BR1;FR10;Z_technical_privileges
BR1;FR30;Z_technical_privileges2
This list is often updated that's why I need it to be dynamic.
In the filter tab of the dyn group, I set a request to retrieve the mskeys of privileges (here is mskey of PRIV:ROLE:<sys>:Z_technical privileges & PRIV:ROLE:<sys>:Z_technical_privileges2)
Then I attach the dyn groups to the role (BR1) by setting up the autoassign field in the membership tab of the role.
When I assign the BR to a user, no privilege is provisioned (user already have an account in that system).
Am I forgetting something or doing something wrong?
how can I include the "check" on costcenter attributes?
thanks
Guillaume

Answer 1

Hello Guillaume,
dynamic roles find you the pool of people, that can be used in a business roles. If you attach a dynamic role to a BR, those users will become members of the BR.
You are trying the same with privileges and that's why nothing happens. Because privileges can't become members of the BR.
Are the different lists of privileges, that need to be assigned to users via the costcenter-attribute really changing so much?
You could use the dynamic groups to look for the members of a costcenter and assign those to the BR specific for that costcenter with the privileges added to the BR. That means one BR per costcenter and the privileges need to be changed manually or maybe via a job.
Hmm... where do the new privileges come from? How would you find them dynamically anyway? If you have a SQL statement for that, it should be possible to create a job, that adds the new privileges to the BR and delete old ones.
I don't see a fast and easy way to do this, but I haven't come across a request like this yet, so maybe there is one and I just don't know it (yet ^^).
Regards,
Steffi.