Add Access task for Azure AD failing

[Jagadish]

Hi,

I am using the ARS to place request for an Azure AD group which is of the entitlement type AADGroup in Saviynt.

The request gets submitted and Add Access task gets generated successfully.

But, when I run the provisioning job, Task is not getting complete, there is no error in the logs

AddAccessJson:

{
  "call": [
    {
      "name": "AADGroup",
      "connection": "userAuth",
      "url": "https://graph.microsoft.com/v1.0/groups/${entitlement.entitlementID}/members/\\$ref",
       "showResponse": true,
      "httpMethod": "POST",
      "httpParams": "{\"@odata.id\":\"https://graph.microsoft.com/v1.0/directoryObjects/${account.accountID}\"}",
      "httpHeaders": {
        "Authorization": "${access_token}"
      },
      "httpContentType": "application/json",
      "successResponses": {
        "statusCode": [
          200,
          201,
          204,
          205
        ]
      }
    }
  ]
}

referred from : Solved: Re: Add Access task for Azure AD failing - Saviynt Forums - 21656

[AmitM]

HI @Jagadish , In your URL , you are using ${entitlement.entitlementID} instead use ${entitlementValue.entitlementID}.

https://graph.microsoft.com/v1.0/groups/${entitlementValue.entitlementID}/members/\\$ref"

If you have right permissions , this should work.

Good Look!!

Best Regards,

Amit

[Jagadish]

Hi @AmitM 

1. I have tried with below url also still task is not completing

"url": "https://graph.microsoft.com/v1.0/groups/${entitlementValue.entitlementID}/members/\\$ref"

2. I have ROLE_ADMIN access

3. This is AzureAD connector(it was working for rest connector )

[AmitM]

Ah Okay, Yeah , make sense. 

In my knowledge , you need to use REST connector for Provisioning and ootb for import. 

This is how we are doing. Do you see any problem with that? I am not sure if ootb now supports provisioning and recon both but I dont think it is yet.

BR,Amit

[rushikeshvartak]

As per release note azure ad connector should support import and provision 

[AmitM]

Yeah, it does it seems from v23.10. But it didn't work for us also and using REST connector only for provisioning. 

[AmitM]

Hi @Jagadish , you can raise a freshdesk ticket. We have one as well.

Meanwhile continue to use REST for provisioning which you mentioned has been working.

Kind Regards,

Amit

If helped, please ACCEPT SOLUTION and hit Kudos

[NM]

Hi @Jagadish , Worth checking ConnectionJson in AzureAD OOTB connector, we can define it and use it for provisioning..

[rushikeshvartak]

Its same connection json as REST connector

"2024-02-07T02:57:02.559+00:00","ecm-worker","azure.AzureADRestProvisioningService","quartzScheduler_Worker-7-ngcnt","DEBUG","params.memento.addAccessJSON : [call:[[name:AADGroup, connection:userAuth, url:https://graph.microsoft.com/v1.0/groups/${entitlementValue.entitlementID}/members/\$ref, showResponse:true, httpMethod:POST, httpParams:{"@odata.id":"https://graph.microsoft.com/v1.0/directoryObjects/${account.accountID}"}, httpHeaders:[Authorization:${access_token}], httpContentType:application/json, successResponses:[statusCode:[200, 201, 204, 205]]]]]"
"2024-02-07T02:57:02.559+00:00","ecm-worker","azure.AzureADRestProvisioningService","quartzScheduler_Worker-7-ngcnt","DEBUG","currentEntitlementJsonMap : [call:[[name:AADGroup, connection:userAuth, url:https://graph.microsoft.com/v1.0/groups/${entitlementValue.entitlementID}/members/\$ref, showResponse:true, httpMethod:POST, httpParams:{"@odata.id":"https://graph.microsoft.com/v1.0/directoryObjects/${account.accountID}"}, httpHeaders:[Authorization:${access_token}], httpContentType:application/json, successResponses:[statusCode:[200, 201, 204, 205]]]]] | entitlementname: AADGroup"
"2024-02-07T02:57:02.559+00:00","ecm-worker","azure.AzureADRestProvisioningService","quartzScheduler_Worker-7-ngcnt","DEBUG","currentEntitlementJsonMap : [call:[[name:AADGroup, connection:userAuth, url:https://graph.microsoft.com/v1.0/groups/${entitlementValue.entitlementID}/members/\$ref, showResponse:true, httpMethod:POST, httpParams:{"@odata.id":"https://graph.microsoft.com/v1.0/directoryObjects/${account.accountID}"}, httpHeaders:[Authorization:${access_token}], httpContentType:application/json, successResponses:[statusCode:[200, 201, 204, 205]]]]]"
"2024-02-07T02:57:02.559+00:00","ecm-worker","azure.AzureADRestProvisioningService","quartzScheduler_Worker-7-ngcnt","DEBUG","params.memento.addAccessJSON: [call:[[name:AADGroup, connection:userAuth, url:https://graph.microsoft.com/v1.0/groups/${entitlementValue.entitlementID}/members/\$ref, showResponse:true, httpMethod:POST, httpParams:{"@odata.id":"https://graph.microsoft.com/v1.0/directoryObjects/${account.accountID}"}, httpHeaders:[Authorization:${access_token}], httpContentType:application/json, successResponses:[statusCode:[200, 201, 204, 205]]]]]"
"2024-02-07T02:57:02.559+00:00","ecm-worker","rest.RestProvisioningService","quartzScheduler_Worker-7-ngcnt","DEBUG","Total Call: 1"
"2024-02-07T02:57:02.579+00:00","ecm-worker","rest.RestProvisioningService","quartzScheduler_Worker-7-ngcnt","DEBUG","connection: userAuth"
"2024-02-07T02:57:02.589+00:00","ecm-worker","azure.AzureADRestProvisioningService","quartzScheduler_Worker-7-ngcnt","DEBUG","Task Response: null"
"2024-02-07T02:57:02.589+00:00","ecm-worker","azure.AzureADRestProvisioningService","quartzScheduler_Worker-7-ngcnt","DEBUG","Result: false"

[rushikeshvartak]

@prasannta  As discussed on call waiting for update 

[prasannta]

Hi @rushikeshvartak 

You will have to raise a support ticket for this as this issue would require feedback from our engg team. I was unable to find any other customer who are using Azure AD for provisioning.

Thanks

[rushikeshvartak · Accepted solution]

This has been resolved and working for all JSONs 

Connection name should ${connectionName}

{
 "call": [
 {
 "name": "AADGroup",
 "connection": "${connectionName}",
 "url": "https://graph.microsoft.com/v1.0/groups/${entitlementValue.entitlementID}/members/\\\\$ref",
 "httpMethod": "POST",
 "httpParams": "{\"@odata.id\":\"https://graph.microsoft.com/v1.0/directoryObjects/${account.accountID}\\"}",
 "httpHeaders": {
 "Authorization": "${access_token}"
 },
 "httpContentType": "application/json",
 "successResponses": {
 "statusCode": [
 200,
 201,
 204,
 205
 ]
 }
 }
 ]
}

Reference - https://saviyntsupport.saviynt.com/support/tickets/2017932

[Manu269]

@Jagadish we even faced similar issue where OOTB connector was failing for access provisioning.

Ended up using the REST Connector.

[Mamatha]

We have identified the cause of your issue:

can you use below JSON and confirm us on the result -

{
 "call": [
 {
 "name": "AADGroup",
 "connection": "${connectionName}",
 "url": "https://graph.microsoft.com/v1.0/groups/${entitlementValue.entitlementID}/members/\\\\$ref",
 "httpMethod": "POST",
 "httpParams": "{\"@odata.id\":\"https://graph.microsoft.com/v1.0/directoryObjects/${account.accountID}\\"}",
 "httpHeaders": {
 "Authorization": "${access_token}"
 },
 "httpContentType": "application/json",
 "successResponses": {
 "statusCode": [
 200,
 201,
 204,
 205
 ]
 }
 }
 ]
}

Primary difference is in the way connection parameter is configured, suggestion is to use "connection": "${connectionName}" and you don’t need to use showResponse

As Rushi confirmed it is working as expected using above JSON in ticket 

https://saviyntsupport.saviynt.com/a/tickets/2017932

[rushikeshvartak]

Please update respective documentation on docs portal https://docs.saviyntcloud.com/bundle/AzureAD-v2021x/page/Content/Configuring-the-Integration-for-Pro...