Alternate Delimiter for comma in Schema Role Upload as Active Directory Entitlements have comma

[ReshamDas]

Hi,

We are performing bulk role upload through the Schema Role import job in Saviynt. The problem we face in our environment is that we have entitlements from Active Directory that contain comma within its value such as:- CN=XXX,DC=XXX,OU=XXX.

So, when we run the SchemaRoleImport job with comma (,) used as the FILEIMPORTDELIMETER in the SAV file, it is considering such entitlement values as comma-separated, and are mapping 1) CN=XXX, 2) DC=XXX and 3) OU=XXX to the given role separately instead of mapping CN=XXX,DC=XXX,OU=XXX as a one whole entitlement.

We tried putting the complete entitlement name within double quotes (an usual practice for CSV-based upload process), but it gives same result.

Also, we tried using other characters instead of comma (,) as the FILEIMPORTDELIMETER such as - semicolon (;), tab (\t), backslash (\), tilde (~), but in each of those cases, the SchemaRoleImport job failed with error:-  java.lang.ArrayIndexOutOfBoundsException.

PFA the SAV file and CSV file we are using. Please suggest an alternate approach.

[PremMahadikar]

Hi @ReshamDas ,

Can you please try pipe (|) in your .sav file. 

Also change the delimiters in .csv file to pipe.

If this answers your questions, please consider selecting Accept As Solution and hit Kudos

[ReshamDas]

Hi @PremMahadikar pipe (I) cannot be used as some of the role names in our environment contain the character '|' within.

[Saathvik]

@ReshamDas : Can you share the SAV file you have used with different FILEIMPORTDELIMETER instead of comma(,)

[ReshamDas]

@Saathvik PFA the SAV file, CSV file used when tilde (~) is used as the FILEIMPORTDELIMETER value.

Also, PFA the error log in this case.

[ReshamDas]

Also, please note that if we separate the column names within the SAV file in the last line using the same delimiter (in this case, tilde~), then the job throws following error:- "This is not a valid SAV FILE". PFA error logs for this situation.

[rushikeshvartak]

When there is comma in AD Entitlement name , use double quotes to entitlement name

"CN=XXX,DC=XXX,OU=XXX"

[ReshamDas]

@rushikeshvartak Yes, we are encapsulating the whole entitlement name within double quotes:-

Still, Saviynt is considering DC=XXX as a separate entitlement, CN=XXX as separate and OU=XXX as the third entitlement, and mapping these three separated entitlements to the given role like this:-

Please note that we have specified NOACTION on the value for ENT_VAL_NOT_AVAILABLE column, but still Saviynt is creating these entitlements, mapping them to the given role, as well as triggering tasks to add those entitlements to the role members.

[rushikeshvartak]

Can you test with minimum mandatory attributes 

[ReshamDas]

@rushikeshvartak tested with minimum mandatory attributes as per following order:-

1) Mapped just the role name with role status and role type, keeping rest attributes blank. Role status and type got updated accordingly from the SchemaRoleImport job successfully.

2) Mapped role name with user name, keeping rest attributes blank. User got mapped to role and tasks got created for adding access to the user accounts successfully.

3) Mapped role name with entitlement name which does not have comma, along with respective system name, endpoint name, entitlement type. Kept rest attributes blank. Entitlement got successfully mapped to the role, and tasks got created for adding access to this entitlement for all role members.

4) Tried mapping role name with entitlement name which has comma - the problem statement (PFA sample_roles.sav and role_ents_test_05082024_1.csv files). This time, the SchemaRoleImport job failed with error in logs: "org.codehaus.groovy.runtime.typehandling.GroovyCastException: Cannot cast object 'null' with class 'null' to class 'long'. Try 'java.lang.Long' instead" (PFA complete logs in Logs_ExportData_2024-05-08_09-36-05-AM(UTC) (6).csv).

[rushikeshvartak]

Try keeping entitlement in end of list

[ReshamDas]

@rushikeshvartak got same error message keeping entitlement value at the end:-

As per logs, Saviynt is including some _24 prior to where the comma (,) exists within the entitlement value, then failing with error:- "org.codehaus.groovy.runtime.typehandling.GroovyCastException: Cannot cast object 'null' with class 'null' to class 'long'. Try 'java.lang.Long' instead" 

[rushikeshvartak]

what is _24 here?

[ReshamDas]

@rushikeshvartak That _24 (Sometimes _27 or _15) is appearing in the logs within the name of the entitlement being uploaded through the CSV file for Schema Role Import job.

For example, for an entitlement CN=4EM LOG,OU=HONDA GLOBAL,OU=HDM,DC=TLABMDS,OU=GROUPS,OU=ENGINEERING,DC=AM,DC=COM being passed on the CSV file, we can see the Saviynt logs stating it as CN=4EM LOG_27, OU=HONDA GLOBAL_27, OU=HDM_27, DC=TLABMDS_27, OU=GROUPS_27, OU=ENGINEERING_27, DC=AM_27, DC=COM_27 instead. It is like Saviynt is adding a _27/_24/_15 where there is a comma in the entitlement name.

[rushikeshvartak]

looks like defect please raise support ticket

[ReshamDas · Accepted solution]

@rushikeshvartak I raised a defect with Saviynt Support, and their engineering team have been recently able to solve this issue, by providing the attached template SAV files and CSV files. This time, the Schema Role Import job got executed successfully, and the entitlements with comma within its name, got mapped to the corresponding role in the CSV file.

Thank you.

[chandu_k09]

Hi Resham,

I am facing a similar issue when importing AD groups. 

The error I am seeing when running the Schema import job for entitlements is " SAV file column count is greater or less than csv file column count." Sometimes, also this error: 

But as you can see, the column counts match. I have also tried using the "|" as delimiter and adding the "SPLIT_ENT_WITH_COMMA=FALSE" option, but no luck. 

How did you get the AD group import to work? Any pointers would be appreciated. 

Kind regards,

Chandu K.

[ReshamDas]

@chandu_k09 PFA the template .csv and .sav file on my above response marked as 'Accepted Solution'. Please rearrange the order of attributes in CSV and SAV files, refine the field names in your SAV file, also remove the column header from CSV file, and just supply the values from first row itself, as it is demonstrated in the template files I shared.

[chandu_k09]

Thanks Resham for explaining, I will try.