Adding accounts to different entitlements automatically and dynamically

[Jdom]

Hello,

I'm trying to figure out the best way to tackle adding accounts to entitlements based on user properties.

Example: need to add an account to AD group automatically using user attributes; Example group name is "(department)(region)(title)" or "Legal-EMEA-Director". All of the attributes work as-is, so no translation needed, but is there a way to create a technical rule or other method that adds the AD account to the appropriate AD group automatically instead of creating a ton of rules that match all possible combinations of user attributes? I'd like to use technical rules with the birthright option, as it will allow the account to be added to the appropriate group if the department, region, or title changes...

I'm looking at dynamic attributes on the Active Directory endpoint, but unfortunately haven't been able to find a lot of documentation (https://saviynt.freshdesk.com/support/solutions/articles/43000556317-viewing-or-updating-endpoints) on them, it seems they are only used for ARS requests (I may be mistaken)?

[Sivagami]

You can do something like this in your Technical Rule Action.

[Jdom]

This looks like the approach I'd like to take, however when typing into the Object field, I'm unable to save it? It seems to look for the object but since it can't find it, it's not populating. Does my user need to have these properties filled out for this to "resolve" or is there another way to get this populated?

[avinashchhetri]

These will not be auto populated but you will have to manually type in the computed entitlement in the rule. Once you do that, you should be able to "send for approval" to save it.

Regards,

Avinash Chhetri

[Jdom]

When you say computed, do you mean that I'm unable to use variables? As it stands, it blanks out the CN=$(user.departmentname)$(user.region)$(user.title),OU=Distribution Groups,OU=Groups,DC=domainanamehere,DC=com value when I click out of the box.

I'm trying to use variables because otherwise I'd have to manually specify 500+ groups or create as many roles to assign the entitlements (not seeing another way at the moment) that could match all of the possible departments, regions and titles in my company.

[avinashchhetri]

No, what I am suggesting is instead of copy pasting the logic "CN=${user.departmentname}${user.region}${user.title},OU=Distribution Groups,OU=Groups,DC=domainanamehere,DC=com" try and manually type these under the Object field.

Regards,

Avinash Chhetri

[Jdom]

Unfortunately, I'm not able to type or paste into that field and have it stick. It's looking for an object to select and I cannot click or tab out of the field, as it will blank it out.

[avinashchhetri]

Interesting, which Saviynt version are you on ?

Regards,

Avinash Chhetri

[Jdom]

I have 2 Dev environments, v2021.0 and 5.5sp3.8

[avinashchhetri]

It should work on v5.5SP3.x version as shown in the screenshot below.

I' suggest to open a support ticket and get this resolved.

Regards,

Avinash Chhetri

[rushikeshvartak]

Try below logic for Role, for entitlement you need to go with Organizations

[Sivagami · Accepted solution]

@Jdom - As soon as you start typing, give it a moment to populate down and Select it. 

Hope this helps!

[Jdom]

Thanks! I think the actual issue was that I was using parentheses and not curly brackets. The screenshots looked like parentheses to me but when I saw your clip I switched to curly brackets and now it's letting me save the value. I'll test and see if everything works as I hope it will!

[avinashchhetri]

Great, Let us know how it goes and keep us posted.

Regards,

Avinash Chhetri