In vRealize Automation version 7.0.0 and 7.0.1 user permissions are taking up to 10 minutes to propagate after they have been synced from the Active Directory, is this normal behaviour?
From testing with the scenario below, It appears that there may be a background process that updates the permissions used by the business group and entitlement from the directory.
Scenario.
- Active Directory: Group 1, Group 2 and user 1 are synced into vRA.
- A new business group “Group 1” with an entitlement “Group 1” which give access to a service called “Configuration” is created. AD “Group 1” is made a support user and added to the entitlement.
- A new business group “Group 2” with an entitlement “Group 2” which give access to a service called “Blueprint Configuration” is created. AD “Group 2” is made a support user and added to the entitlement.
- User1 logs into vRA and has access to the Home and Inbox tabs only as expected. User1 logs out.
- User1 is now added to Group1 in Active Directory, then the vRA directory sync is run, and sync completes.
- User 1 logs in and can immediately, see the Catalog tab and the “Configuration” service workflows.
- User 1 logs out.
- We now remove User1 from AD Group1 and add User1 to AD Group 2.
- In vRA we run the directory Sync and when this finishes we can see in " Directory Users & Groups" that the Group membership and entitlement has been updated correctly.
- However when User1 logs in the portal again, he still sees the Group1 entitlements. After 10 minutes of logging out then logging in User1 eventually gets the correct entitlements from “Group2”.