Announcing the Saviynt Knowledge Exchange unifying the Saviynt forums, documentation, training,
and more in a single search tool across platforms. Read the announcement here.

Active Directory - Add Access

SowmithriV
Regular Contributor
Regular Contributor

Hi All,

While trying to add a Primary group via ADD Access Task, we are getting the following error,

Error while ADD operation for account-v.sowmithri to Group-1181 in AD - [LDAP: error code 21 - 00000057: LdapErr: DSID-0C091275, comment: Error in attribute conversion operation, data 0, v4563]

How can we fix this issue?

Screenshot 2024-04-18 at 6.26.12 PM.pngScreenshot 2024-04-18 at 6.27.10 PM.png

12 REPLIES 12

NM
Valued Contributor
Valued Contributor

Hi @SowmithriV , did you add memebertoent in the connector configuration under endpoint?

SowmithriV
Regular Contributor
Regular Contributor

yes it's added ad below,

SowmithriV_0-1713446271207.png

 

NM
Valued Contributor
Valued Contributor

@SowmithriV , is mapping working for PrimaryGroupID?

SowmithriV
Regular Contributor
Regular Contributor

yes I can see Primary Groups mapped to the accounts. Account-Ent Mapping is working. 

NM
Valued Contributor
Valued Contributor

try removing ADDUSERENT and only keeping MemberENT once...

and also, what is the accountID set currently? ObjectGuid or DN

SowmithriV
Regular Contributor
Regular Contributor

Let me try that and the accountID is ObjectGuid

rushikeshvartak
All-Star
All-Star

Here are a few steps you can take to troubleshoot this issue:

  1. Verify Group Exists: Ensure that the group with the ID "1181" exists in Active Directory.

  2. Check Attribute Mapping: Double-check the attributes being used in the ADD operation. Make sure that all required attributes are being provided and that their values are correctly formatted.

  3. Permission Check: Ensure that the account you're using to perform the ADD operation has the necessary permissions to add users to groups in Active Directory.

  4. Data Validation: Check if there are any constraints on the attributes you're trying to set. For example, if the group has restrictions on the types of users that can be added, ensure that the user you're trying to add meets those criteria.

  5. Syntax Issues

  6. Review Logs


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

SowmithriV
Regular Contributor
Regular Contributor

Hi @rushikeshvartak and @NM Thank you for your responses. We were able to update the primary group of an AD account by,

1. Adding the new group to the account
2. Setting it as primary for the account
3. Removing the old group from the account

Right now we have created an analytics to generate add access of the new group and when the workday recon runs, it triggers the disable task (includes removing all the groups + setting the group added via analytics as primary). Problem now is, since the workday recon marks the status of the user as inactive, the add access generated by the Analytics is not getting provisioned and we are seeing "User xxx is not active" in the Provisioning Comments.

Is there any other way to handle it?

Make user inactive after updating primary group id


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

NM
Valued Contributor
Valued Contributor

Hi @SowmithriV, did you set any other configuration for primary group provisioning?

2) Maybe check user enddate and trigger AD task in the basis of that(Analytics).. in that way your username is inactive case will be handled...

SowmithriV
Regular Contributor
Regular Contributor

@NM @rushikeshvartak ,  There are chances, there will be new terminations entered during the Workday recon run dynamically which will be missed, if we use the Analytics.

You can have detective report to find such corner cases


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.