AD Account correlation overwrite not working

[Shreya47]

Hi Team,

We are facing issue with overwriting the User Correlation for AD account. We have this below Correlation Rule in AD Endpoint where the Customproperty24 contain the EmployeeID field from AD and User's username is same as the EmployeeID.

users.username = accounts.customproperty24

So, if we change the Employee ID of an account in AD, after the Account Import job the EmployeeID is getting update in the Customproperty24 of the AD account in Saviynt, but the account is not correlating to the new User profile. 

Also, we validated the logs of Account Import Job and found this below line:

2022-08-08 13:59:34,365 [quartzScheduler_Worker-2] DEBUG saviynt.ImportExternalDbService - Associating Users and Accounts

Could you please help us find any missing configuration from our side to achieve the overwriting of the Account Correlation.

[prasannta]

Hi @Shreya47 

Can you provide more details as to what is the reconciliation filed being used for AD? Also, is AD your authoritative source used to create user objects in Saviynt?

Thanks

[Shreya47]

Hi @prasannta 
The Reconciliation field we are using for AD is objectGUID. AD is not the authoritative source we are using it as a Target application.

Thanks.

[stalluri]

Can you try this below syntax.
(users.username=accounts.customproperty24)

[Shreya47]

Hi @stalluri 
Thank you for suggesting this, but I tried it did not work.

[prasannta]

Hi @Shreya47 

Can you provide more details from logs? Can you check what query is being formed in logs during correlation?

Thanks

[Shreya47]

Hi @prasannta 

Please find the logs below:

2023-10-05T12:59:35.646+00:00,ecm-worker,,,,"2023-10-05T12:59:35.247917023Z stdout F 2023-10-05 12:59:35,247 [quartzScheduler_Worker-2] DEBUG saviynt.ImportExternalDbService - Associating Users and Accounts"
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,"2023-10-05T12:59:35.287627527Z stdout F 2023-10-05 12:59:35,287 [quartzScheduler_Worker-2] DEBUG saviynt.ImportExternalDbService - Orphan Accounts- 416"
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,"2023-10-05T12:59:35.287637527Z stdout F 2023-10-05 12:59:35,287 [quartzScheduler_Worker-2] DEBUG saviynt.ImportExternalDbService - Rule: users.username = accounts.customproperty24"
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,"2023-10-05T12:59:35.287640027Z stdout F 2023-10-05 12:59:35,287 [quartzScheduler_Worker-2] DEBUG saviynt.ImportExternalDbService - sql = "
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,"2023-10-05T12:59:35.287642227Z stdout F SELECT USERS.USERKEY AS USERKEY, ACCOUNTS.ACCOUNTKEY AS ACCOUNTKEY FROM ACCOUNTS ACCOUNTS"
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,2023-10-05T12:59:35.287644427Z stdout F LEFT JOIN USER_ACCOUNTS UA ON ACCOUNTS.ACCOUNTKEY = UA.ACCOUNTKEY
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,2023-10-05T12:59:35.287646627Z stdout F LEFT JOIN USERS USERS ON
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,2023-10-05T12:59:35.287648727Z stdout F users.username = accounts.customproperty24
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,"2023-10-05T12:59:35.287657327Z stdout F WHERE ACCOUNTS.ENDPOINTKEY = 18 AND ACCOUNTS.STATUS IN ('Active','InActive','1','Manually Provisioned','2','SUSPENDED FROM IMPORT SERVICE','Manually Suspended')"
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,2023-10-05T12:59:35.287659327Z stdout F AND ACCOUNTS.ACCOUNTKEY IS NOT NULL AND UA.ACCOUNTKEY IS NULL
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,2023-10-05T12:59:35.287661027Z stdout F AND ACCOUNTS.NAME IS NOT NULL AND USERS.USERNAME IS NOT NULL
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,2023-10-05T12:59:35.287663027Z stdout F
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,"2023-10-05T12:59:35.308885282Z stdout F 2023-10-05 12:59:35,308 [quartzScheduler_Worker-2] DEBUG saviynt.ImportExternalDbService - Total accounts to be correlated = 0"
2023-10-05T12:59:35.646+00:00,ecm-worker,,,,"2023-10-05T12:59:35.308891782Z stdout F 2023-10-05 12:59:35,308 [quartzScheduler_Worker-2] DEBUG saviynt.ImportExternalDbService - User-accounts correlated: 0"

[Shreya47]

Hi All,
Just wondering those the correlation process only happens for Active Orphan accounts, since in the log there is this below line:

2023-10-05T12:59:35.646+00:00,ecm-worker,,,,"2023-10-05T12:59:35.287627527Z stdout F 2023-10-05 12:59:35,287 [quartzScheduler_Worker-2] DEBUG saviynt.ImportExternalDbService - Orphan Accounts- 416"

[prasannta]

Hi @Shreya47 

Can you check if you are getting any results back from this query?

SELECT USERS.USERKEY AS USERKEY, ACCOUNTS.ACCOUNTKEY AS ACCOUNTKEY FROM ACCOUNTS ACCOUNTS
LEFT JOIN USER_ACCOUNTS UA ON ACCOUNTS.ACCOUNTKEY = UA.ACCOUNTKEY
LEFT JOIN USERS USERS ON
users.username = accounts.customproperty24
WHERE ACCOUNTS.ENDPOINTKEY = 18 AND ACCOUNTS.STATUS IN ('Active','InActive','1','Manually Provisioned','2','SUSPENDED FROM IMPORT SERVICE','Manually Suspended')
AND ACCOUNTS.ACCOUNTKEY IS NOT NULL AND UA.ACCOUNTKEY IS NULL
AND ACCOUNTS.NAME IS NOT NULL AND USERS.USERNAME IS NOT NULL

Thanks

[Shreya47]

Hi @prasannta,

No, this is not returning any data.

[Shreya47]

Hi Everyone,

Could you please help us resolve this issue.

[prasannta]

Hi Shreya,

Can you provide the status for both accounts? What is the status for the new and old Ad account? Also, please ensure that inactivateAccountsNotInFile is set to true.

Thanks

[rushikeshvartak]

Import never overwrite account to user correlation 

[Shreya47]

Hi @rushikeshvartak 
Thanks for confirming this, is there any other way we can achieve this without manual intervention. 

[Dave]

@Shreya47 - Did you still need help with this issue?  I noticed you never replied to @prasannta who was trying to help you. 

[Shreya47]

Hi @Dave,
To @prasannta 's ask, there is only one AD account which we want to uncorrelate from one identity and correlate with another identity automatically following the correlation rule while import. As Rushikesh mention "Import never overwrite account to user correlation" I believe we would have to perform this manually. However, if team can suggest some other alternative method to achieve this, would be helpful to us.

[Rajesh-R]

@Shreya47 - Accounts once correlated, Remains correlated. We cannot overwrite that by any means.