Announcing the Saviynt Knowledge Exchange unifying the Saviynt forums, documentation, training,
and more in a single search tool across platforms. Read the announcement here.
100% helpful (2/2)
Saviynt Employee
Saviynt Employee

Short Description

AD is one of the most commonly used connector. This article provides best practices for configuring AD connector

Applicable version

All versions

Detail best practice

  • Try to use ObjectGUID as reconciliation Attribute in Account_Attribute parameter

Sample JSON for the Accounts Import - 

  • Similarly map ObjectGUID as reconciliation Attribute in in groupImportMapping

Sample JSON for Group Import -
"entitlementTypeName": "",
"performGroupAccountLinking": "true",
"importnestedmembershipoutofscope": "true",
"incrementalTimeField": "whenChanged",
"groupObjectClass": "(objectclass=group)",
"tableFieldAttribute": "accountID"

  • Implement AD Account incremental import with daily frequency. We need to add below attributes in Accounts Import mapping of AD Connector to enable the incremental Import and run the Incremental Import 


  • AD User Incremental Import can be configured at the object filter level in AD Connector. Please find the object filter details in the below screenshot



  • Use ADVANCE_FILTER_JSON if you just want to import accounts from specific containers :



  • Similarly, Advanced Group filter can be used in Group Import Mapping JSON to import groups from specific containers



  • Schedule either AD accounts import or access import, don’t implement both. Both accounts and access triggers can bring Accounts and entitlements with the difference being Access imports also bring entitlements which are not yet assigned to any account
  • If there are multiple AD domains then instead of multiple AD connectors per domain, make use of ADSI connector. Note - no need to use ADSI connector if there is only AD domain
  • Ensure AD connection’s Status and threshold parameter has all the AD userAccessControl which can mark accounts’ status as Active or Inactive
    Below are the possible Active status of AD userAccessControl. There might be some ddditional once specific to your customer so recommended to do a LDAP search before finalizing the status list
  • Make use of character "?" for null check. Example: "manager":"${managerAccount?.accountID}“
  • Make sure REUSEINACTIVEACCOUNT parameter is marked FALSE. If this config is set to TRUE then the connector will reuse the existing inactive account name while creating new accounts. By default this will be set to TRUE so our recommendation is to set this value to false.
  • SUPPORTEMPTYSTRING should be FALSE,  in case you want to skip the null/empty values for any attribute during creation


Key Benefit

Better performance and ease of maintenance 

Reference documentation 

Regular Contributor II
Regular Contributor II

Hi @Rishi i am onboarding an LDAP application to manage group lifecycle and group access provisioning/reconciliation. Assuming it will follow the similar kind of setup as "AD". i have few questions/doubts here if you can look into and respond

1) In the provisioning job execution i see this line in logs "You must have objectGUID or objectSID present in ACCOUNT_ATTRIBUTE as a Reconcilation_Field". 

objectGUID or objectSID is not present in LDAP but we have entryUUID which is unique for all LDAP accounts. Is it ok to use this attribute or its mandatory to have one of them (objectGUID or objectSID).

2) while provisioning users access to a ldap group i am getting this exception in logs

"java.lang.NullPointerException: Cannot invoke method toUpperCase() on null object"

what could be the issue here? Few of the log lines printed in given sequence from bottom to top


java.lang.NullPointerException: Cannot invoke method toUpperCase() on null object at com.saviynt.ldap.SaviyntGroovyLdapService$_printBindingMap_closure43.doCall(SaviyntGroovyLdapService.groovy:5213) at com.saviynt.ldap.SaviyntGroovyLdapService.printBindingMap(SaviyntGroovyLdapService.groovy:5207) at com.saviynt.ldap.SaviyntGroovyLdapService$_provisionAccessToAccountGLDAP_closure4.doCall(SaviyntGroovyLdapService.groovy:1329) at com.saviynt.ldap.SaviyntGroovyLdapService.provisionAccessToAccountGLDAP(SaviyntGroovyLdapService.groovy:1242) at at$_whenTaskTypeIsOneAddAccess_closure45.doCall(ArsTaskHelperService.groovy:2794) at at$_completeAutoProvTasksUpgraded_closure1.doCall(ArsTaskHelperService.groovy:165) at at MultipleProvisioningJob.execute(MultipleProvisioningJob.groovy:222) at at org.quartz.simpl.SimpleThreadPool$
Inside getAttrUsingGUIDorSID method
Enter getLDAPContext
calling executeRequestWithTimeoutConfig for api...
calling api...
Enter acquireLDAPContext
Setting default timeout
Env Properties in IMPORTJSON: null
enable_dclocator = false
Exit getLDAPContext
called api...
timeout validated for api...
got response for api...
You must have objectGUID or objectSID present in ACCOUNT_ATTRIBUTE as a Reconcilation_Field
Result size= 0
Query to update Account DN Attr: Select accountID  from ACCOUNTS WHERE ACCOUNTKEY={userkey}
Enter getAssignedGroups

@Rishi can we some writeup for AD service Account Management?

Saviynt Employee
Saviynt Employee

@Manu269 sure, we will publish an article on service Account Management

New Contributor III
New Contributor III

can we know the incremental config for user import. The above config is not working for user import

Regular Contributor II
Regular Contributor II

Hi @trivi just use the CREATEDATE and UPDATEDATE configuration in USER_ATTRIBUTE configuration. that's it.

Version history
Last update:
‎06/16/2023 06:54 AM
Updated by: