AD group Creation failing from Saviynt

[SumathiSomala]

Hi team,

I am creating the AD group from Saviynt. To perform this enabled the group management.

createUpdateMappings:

{
"cn": "${role?.customproperty13}",
"objectCategory": "CN=Group,CN=Schema,CN=Configuration,dc=xxxx,dc=com",
"displayName": "${role?.displayname}",
"sAMAccountName": "${role?.customproperty11}",
"description": "${role?.description}",
"objectClass": "group",
"name": "${role?.customproperty9}"
}

Getting the below error where i run the provisioning JOB

Provisioning comments in task:

<br> unexpected end of subtree [select new Map(a.entitlement_value as entitlement_value, a.entitlementtypekey.id as entitlementtypekey, a.id as id, a.entitlement_value as UNIQUE_COL) from com.saviynt.ecm.identitywarehouse.domain.Entitlement_values a where a.entitlementtypekey.id in ()]; nested exception is org.hibernate.hql.ast.QuerySyntaxException: unexpected end of subtree [select new Map(a.entitlement_value as entitlement_value, a.entitlementtypekey.id as entitlementtypekey, a.id as id, a.entitlement_value as UNIQUE_COL) from com.saviynt.ecm.identitywarehouse.domain.Entitlement_values a where a.entitlementtypekey.id in ()]

Any help would be appreciated.

[rushikeshvartak]

• Does all roles attributes are populated without special characters ?

[SumathiSomala]

@rushikeshvartak yes

Role name is Adtestgroup3

[rushikeshvartak]

Try hardcoding details in json

[SumathiSomala]

Updated the JSON

{
"cn": "${role?.customproperty13}",
"objectCategory": "CN=Group,CN=Schema,CN=Configuration,dc=xxxx,dc=com",
"displayName": "${role?.displayname}",
"sAMAccountName": "${role?.customproperty11}",
"objectGUID":"${role?. Entitlementid}",
"description": "${role?.description}",
"objectClass": "group",
"name": "${role?.customproperty9}"
}

Provisioning comments:<br> Error while Create operation for Entitlment-CN=Adtestgroup4,OU=EnterpriseGroups,DC=xxx,DC=com in AD, Exception : Error while GROUP CREATION IN AD <br>

error logs:

2024-08-16T13:00:32+05:30-ecm-worker-ldap.SaviyntGroovyLdapService-quartzScheduler_Worker-16-xdcks-ERROR-Error in createGroup :
2024-08-16T13:00:33+05:30-ecm-worker--null-xdcks--javax.naming.NamingException: [LDAP: error code 80 - 00000523: SysErr: DSID-031A1242, problem 22 (Invalid argument), data 0

[rushikeshvartak]

Did you done endpoint level configs from GLM

[SumathiSomala]

@rushikeshvartak what was the configuration you are referring to?

[rushikeshvartak]

[SumathiSomala]

@rushikeshvartak figured out the issue .ENTITLEMENT_ATTRIBUTE was wiped off .

Now group creation is working fine.

Currently I provided the groupsearchBaseDN for Group import because of that I am able to create groups in the main OU.

Any possibilities to create groups in SUB OUs with out using the advanced filter in groupimportmapping?

[rushikeshvartak]

You need to use advanced filter in groupimportmapping