This document covers problems that administrators and reviewers can have with access review and certification campaigns. Each section describes one symptom, its cause, and how to solve it. To learn how campaigns work, see Access review and certification.
A campaign cannot be created
You cannot create a campaign. One of the following happens:
- When you save a new campaign, Segura™ refuses to create it and shows the message A global approver must be defined. Configure one to continue.
- You cannot open the campaign screen.
Cause 1: There is no User Management global approver
No global approver is registered for the User Management module. Every campaign needs one, to review users who have no reviewer. A global approver registered only for another module does not count.
Cause 2: You do not have a role that creates campaigns
By default, only PAM Administrator and System Administrator users create and manage campaigns. The Access review and certification role only reviews.
Solution
- For cause 1, register at least one active user as a global approver for the User Management module, and then create the campaign again. For the steps, see Register an approver user.
- For cause 2, ask a PAM Administrator or System Administrator to create the campaign.
A campaign shows the Paused status
A campaign shows the Paused status in the campaign list. PAM Administrator and System Administrator users get a notification about the pause.
Cause
The campaign has no active global approver for the User Management module. This happens when the last one is deactivated or deleted in user management. Segura™ checks for this every hour and pauses each Enabled, Scheduled, or Processing campaign it affects. The campaign details show the reason and the date of the pause.
Solution
- Register an active user as a global approver for the User Management module. For the steps, see Register an approver user.
- In the campaign list, in the Actions column of the paused campaign, select Resume campaign.
The campaign returns to the status it had before the pause. Paused time does not count toward escalation, and the end date moves forward by the same amount.
If Segura™ shows a message that starts with The campaign cannot be resumed., there is still no active User Management global approver. Repeat step 1.
"You do not have permission to access this screen!"
A reviewer tries to open the review screen and gets this message:
"You do not have permission to access this screen!"
Cause 1: The reviewer does not have the review role
Being selected as a reviewer does not grant access to the review screen. Reviewers also need the Access review and certification role.
Cause 2: The reviewer opened a screen that the review role does not cover
The Access review and certification role only reviews. It does not open the campaign screen or the Users by reviewer report.
Solution
- For cause 1, ask a System Administrator to assign the Access review and certification role to the reviewer. The reviewer can then open the review screen in Settings > Access control > Users review and certification.
- For cause 2, ask a PAM Administrator or System Administrator to manage the campaign or to check the report.
"The current user is not a reviewer of this user."
A reviewer tries to open or save a review, or to view a user's review history, and gets this message:
"The current user is not a reviewer of this user."
Cause
The logged-in user is not one of that user's reviewers. A user's reviewers are their direct reviewer and the reviewers of their user groups. This also happens when the user's reviewer changed during the campaign, because pending reviews move to the new reviewer.
Solution
- Check the user's current reviewers in the Users by reviewer report, in Settings > Access control > Users review and certification > Users by reviewer. For details, see Users by reviewer.
- If the reviewer is wrong, ask a System Administrator to change it on the user record or on the user group. For details, see Reviewers and global approvers.
To see the reviews of every user, use the Users review and certification report in Reports > Review and certification. By default, System Administrator, PAM Administrator, System Auditor, and PAM Auditor users can open it. The review history on the review screen shows only the users you review, while a campaign is active.
"The campaign is not active."
A reviewer saves a user review and gets this message:
"The campaign is not active."
Cause
The review belongs to a campaign that has ended or has been replaced by a new one. Segura™ does not accept reviews for a campaign that is no longer active.
Solution
- Reload the review screen.
- Review the user again in the current campaign, if the user is in its scope.
If there is no active campaign, the review waits for the next one. A PAM Administrator or System Administrator can check the campaign status in the campaign list. For details, see Campaign.
Users are reviewed by the global approver
The global approver receives reviews for users that you expected another reviewer to review.
Cause 1: The users have no reviewer
A user has no reviewer when they have no direct reviewer and none of their user groups has a reviewer. A group reviewer who is a member of that group is not counted as their own reviewer.
Cause 2: The users' reviewer was deactivated
When a reviewer is deactivated, their users pass to that reviewer's own reviewer. If the deactivated reviewer has no reviewer, the global approver reviews those users. The same rule applies to a deactivated group reviewer.
Solution
- Open the Users by reviewer report, in Settings > Access control > Users review and certification > Users by reviewer.
- Find the users whose Assignment type is
None, or whose reviewer is marked(Disabled). - Ask a System Administrator to set an active Reviewer for each user, on the user record or on one of their user groups. For details, see Manage users and User groups.
Pending reviews in the current campaign move to the new reviewer.