Entitlements

Entitlements in Oblique assign roles on resources to subjects (groups, users, and accounts), granting them access.

A user or group has access to a resource when they have one or more entitlements that grant access to that resource. Entitlements can be direct or indirect, such as when a user belongs to a group that has an entitlement.

Entitlements can have an expiry date or be indefinite.

Existing entitlements are imported when an integration is connected to Oblique. Imported entitlements explain the relationship between an account in that integration and a role in that integration. These accounts are then mapped to users in Oblique to reflect the access that a user has.

View access

You can view entitlements for roles on resources:

• You can see the entitlements you have, including for indirect access, from your profile page; and the entitlements another user has on their profile page, in the Access section.
• You can see the entitlements an attribute-based group, reporting group, or team group has from their detail page, in the Access section.
• You can see the entitlements for a given role on a resource, including for indirect access, from the resource’s detail page, in the Entitlements section.

To open the access graph to visualize entitlements, select View graph on a user profile or group, team, or resource’s detail page.

Grant access

Creating an entitlement requires a request.

In Oblique, access to a resource is granted by a request, which creates an entitlement assigning a role on a resource to a subject. Any user can request access for themselves, or any group, team, or other user. A user is granted access through their account in the resource’s integration, so only users with an account there can be granted access.

Admins can unilaterally make access changes, since they can self-approve requests.

Request access

Grant access to multiple subjects

You can select multiple subjects as part of the same request, to grant them all access to the same roles on a resource.

Grant access to multiple resources

It’s not currently possible to create a request which grants access to multiple resources at once.

If there is a set of users who need access to the same set of resources, create a group or team to manage access more efficiently. A request adding a user to a group or team will automatically grant them access to the group’s or team’s resources.

Or, create multiple requests.

Edit access

Editing an entitlement requires a request.

As with granting access, editing an entitlement requires a request, which admins can self-approve.

You can create a request to change the roles an entitlement grants, or to edit its expiry date, to either extend or shorten it. You can also create a request to change an entitlement from being indefinite to expiring, or vice versa. Roles and expiry are changed by separate requests. You can only edit an entitlement if it’s direct.

Change roles

Change access expiry

Revoke access

Revoking an entitlement requires a request.

As with granting access, revoking an entitlement requires a request, which admins can self-approve.

Revoke access

If a user has multiple entitlements which grant access to the same resource, you must revoke each one to remove the user’s access.

Tip

You can only revoke direct entitlements. Indirect entitlements, such as a user’s membership in a group, aren’t revokable. Instead, either remove the user from the group, or revoke the group’s entitlement.

Expire access

Oblique automatically revokes an entitlement on its expiry date.