AD accounts status changes to suspended when group import mapping is changed

[bhushan]

Hi Team,

Usecase: We want to use AD extensionattribute14 as a flag to update status of entitlements. The requestable entitlements will be flagged and set active. This will be used along with endpoint filter
Details: We are using below group import mapping.
{

"importGroupHierarchy": "true",

"entitlementTypeName": "memberOf",

"performGroupAccountLinking": "false",

"incrementalTimeField": "whenChanged",

"groupObjectClass": "(objectclass=group)",

"mapping":"memberHash:member_char,customproperty1:sAMAccountType_char,customproperty2:instanceType_char,customproperty3:uSNCreated_char,customproperty4:groupType_char,customproperty5:dSCorePropagationData_char,customproperty12:dn_char,customproperty13:cn_char,lastscandate:whenCreated_date,customproperty15:managedBy_char,entitlement_glossary:description_char,description:description_char,displayname:name_char,customproperty9:name_char,customproperty10:objectCategory_char,customproperty11:sAMAccountName_char,entitlement_value:distinguishedName_char,entitlementid:objectGUID_Binary,customproperty14:objectClass_char,updatedate:whenChanged_date,customproperty17:distinguishedName_char,RECONCILATION_FIELD:customproperty18,customproperty18:objectGUID_Binary,status:extensionAttribute14_char",

"activeGroupPossibleValues": ["active","a","l","TRUE","requestable"]

}

This does set the entitlements to active and inactive as per the use case.

Issue Details: When accounts are imported the accounts status is updated to suspended from import service.

When we update the mapping i.e. copy from document as is, it gets the account with active status. The existing account is not activated instead a new account is created.

The reconciliation field is objectGUID in the account import mapping.

Has anyone faced this earlier

Thanks,

Bhushan

[dgandhi]

Hi @bhushan 

If the status of the account is SUSPENDED FROM IMPORT SERVICE and in account name -Deleted tag is added then Saviynt will create new account (when next recon happens and account is part of the import.) It wont make existing -Deleted account as Active.

Above is the expected behaviour.

[bhushan]

ok but, why the accounts are updated to suspended from import service if we change the group import mapping. If we update the status mapping all the accounts in the endpoints are suspended.

[dgandhi]

Status of the account will be updated based on your account import json. Can you paste that?

[bhushan]

[name::sAMAccountName#String,
CUSTOMPROPERTY1::CN#String,
DISPLAYNAME::displayName#String,
CUSTOMPROPERTY3::givenName#String,
ACCOUNTCLASS::objectClass#String,
ACCOUNTID::distinguishedName#String,
status::userAccountControl#String,
LASTLOGONDATE::lastLogon#millisec,
CUSTOMPROPERTY2::employeeType#String,
CUSTOMPROPERTY4::userPrincipalName#String,
CUSTOMPROPERTY5::sn#String,
CUSTOMPROPERTY6::c#String,
CUSTOMPROPERTY7::title#String,
CUSTOMPROPERTY8::physicalDeliveryOfficeName#String,
CUSTOMPROPERTY9::telephoneNumber#String,
CUSTOMPROPERTY10::department#String,
CUSTOMPROPERTY11::employeeID#String,
CUSTOMPROPERTY12::countryCode#String,
CUSTOMPROPERTY13::middleName#String,
CUSTOMPROPERTY14::manager#String,
CUSTOMPROPERTY15::userAccountControl#String,
CUSTOMPROPERTY16::objectGUID#Binary,
CUSTOMPROPERTY17::mail#String,
description::description#String,
RECONCILATION_FIELD::CUSTOMPROPERTY16

]

[sk]

groupImportMapping changes shouldn't impact Account import or their status. Is there anything you changed in connection apart from groupImportMapping

[bhushan]

No, I did not change anything other than group import mapping.