AD Child endpoint Entitlements are inactivating on Access Import.

[ShyamSrisailam]

Hi All,

We have Active Directory connection which has multiple Child endpoints (ept1,ept2,ept3.........ept10).

Now for one of the child endpoint (ept4) we are using AD Group Creation and AD Groups has to create in Specific OU in target and provisioning of the group in specific OU is working fine. We are using advanceGroupFilter in groupImportMapping for AD connection to push the group in specific OU in AD. 

"advanceGroupFilter": {
"memberOf": {
"OU=Contractor/Vendor,OU=VPN,OU=UserGroupsApps,OU=SystemUsers,DC=,DC=,DC=": [
"(&(objectClass=group)(displayName=Groups))"
],
"DC=,DC=,DC=": [
"(&(objectClass=group))"
]
}
}

Now, I got an issue while importing access for AD (Parent endpoint).

1.  I did create an AD group (Ex: abc1) through ARS for AD child endpoint (Ex: Ept4) and it got provisioned and created the same group in target AD.
2. Now I have ran the Access Import for Active Directory which is the parent endpoint for "ept4" endpoint, and it has imported the "abc1" entitlement in AD endpoint and it has inactivated the same "abc1" entitlement in "ept4" endpoint. (FYI, job got failed with an error saying "Duplicate entry 'CN=abc1,OU=Contractor/Vendor,OU=VPN,OU=UserGroupsApps,OU' for key 'ENTITLEMENTID'"

FYI,

Reconciliation Field - ObjectGUID

In Saviynt ObjectGUID is populating in CP18 when group is crearted but I haven't added anywhere that Guid has to populate in such Customproperty.

##Attached groupImportMapping and CreateUpdateMapping Json's for reference

Please let me know when Access import runs how we can I make "abc1" entitlement as active in "ept4" child endpoint as well, do I need to make changes anywhere else?

[rushikeshvartak · Accepted solution]

Groups should be created in parent endpoints and then it can be populated in child endpoints.

if you create groups in child endpoints entitlemnent reference key will not be populated and it will be inactivated and issue will occur. Keep only parent endpoints creation available on ars

[ShyamSrisailam]

@rushikeshvartak , Thanks for the response.

if we create AD Group in Parent endpoint OU, it will create like [CN= abc1,DC=test,DC=test,DC=com ]

but the group has to create only in specific OU like [CN=abc1,OU=Contractor/Vendor,OU=VPN,OU=UserGroupsApps,OU=SystemUsers,DC=test,DC=test,DC=com]

Is it possible in any way?

[rushikeshvartak]

You can have another dropdown on Ui of all child apps based on that in create json you can mentioned what will be OU groups to be created 

[ShyamSrisailam]

Thanks @rushikeshvartak

I have made the group creation for Parent endpoint and it worked since I used advanceGrouppFilter to provision the created group to specific OU through AD Group Creation