All Accesses are Detected as Out of Band Access after access Import from Application

[KK]

Hi.

I found issue with Out of Band access detection.
The record of account_entitlements1 that's arstaskkey is empty will be detected as Out of Band.

Now, I have one account that have 2 entitlements.
One is assigned from application, so, arstaskkey is empty.
Other is assigned by Saviynt, so, arstaskkey is set.
In this case, the record that's arstaskkey is empty is detected as Out of Band.

select * from account_entitlements1 where accountkey=24185

Now, I do re-baseline application from endpoint.

Then, the dummy arstaskkey is set to 1st record. So, now, both records are not detected as Out of Band.

Then, I do access import from application. Then, arstaskkey for both records are empty.

So, both entitlements are detected as Out of Band,
This is issue because I set 1st record as NOT Out of Band by Baseline function, and 2nd record entitlement was assigned from Saviynt actually.
Both entitlements should not be detected as Out of Band.

Problem is that arstaskkey become empty by access import.
Arstaskkey should be remained after access import.

Could you check for this?

Best Regards,

[Amit_Malik]

@KK , we had this issue in sp3.5. It was then fixed with 3.6 hotfix.

Raise a ticket. Looks like the same bug/issue.

[rushikeshvartak]

• This is issue with your import.
• Does your accentkey is changing after import or is it same ?
• If its changing then you have issue in import
• if accentkey is same then its known product issue fixed in latest version 24.9

[KK]

@rushikeshvartak 
Thank you.
Accentkey is changing after import.
How to fix this issue?

Best Regards,

[rushikeshvartak]

• This is issue with connector configuration. 
• You need to find why mapping is getting removed and adding back.

[KK]

@rushikeshvartak 
Thank you.

I use Active Directory connection.
Which configuration of connection is wrong?

groupImportMapping is below.

{
"entitlementTypeName": "memberOf",
"importGroupHierarchy": "true",
"performGroupAccountLinking": "true",
"importnestedmembershipoutofscope": "true",
"incrementalTimeField": "whenChanged",
"groupObjectClass": "(objectclass=group)",
"entitlementOwnerAttribute": "managedBy",
"tableFieldAttribute": "accountID",
"mapping": "memberHash:member_char,customproperty1:sAMAccountType_char,customproperty20:whenCreated_date,customproperty2:instanceType_char,customproperty3:uSNCreated_char,customproperty4:groupType_char,customproperty5:dSCorePropagationData_char,customproperty12:dn_char,customproperty13:cn_char,lastscandate:whenCreated_date,customproperty15:managedBy_char,entitlement_glossary:description_char,description:description_char,displayname:name_char,customproperty9:name_char,customproperty10:objectCategory_char,customproperty11:sAMAccountName_char,entitlement_value:distinguishedName_char,entitlementid:objectGUID_Binary,customproperty14:objectClass_char,updatedate:whenChanged_date,customproperty16:memberOf_char,customproperty17:distinguishedName_char,RECONCILATION_FIELD:customproperty18,customproperty18:objectGUID_Binary,status:isCriticalSystemObject_Binary"
}