We are delighted to share our new EIC Delivery Methodology for efficiently managing Saviynt Implementations and delivering quick time to value. CLICK HERE.

can we achieve entitlement level approval without entitlement owners for AD connected apps

dubeank
New Contributor III
New Contributor III

Hi Team,

We have a requirement to set up an entitlement-level approval process for one AD-connected application.
Scenario: We have two entitlements "user" and "admin". when any user selects "user" then it should go for only line manager approval but if  a user selects "admin" then it should go for one extra level of approval (entitlement owner or any other approvers)
issue: We are not maintaining owners for AD groups/entitlements in AD and if we try to set it directly in Saviynt, it is getting overwritten after the next sync, and the existing owner is getting removed.

Could you please provide your expert view on how we can achieve entitlement-level approval in the above scenario?
e.g. if we can achieve it through user groups or by checking entitlement value in if-else condition and if it is "Admin" then assign it to next level approver.

Thanks

6 REPLIES 6

rushikeshvartak
All-Star
All-Star

 

You can use if-else block to implement the logic

entitlement.entitlement_value== 'User'

rushikeshvartak_2-1703782450309.png

 

 

 


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

dubeank
New Contributor III
New Contributor III

@rushikeshvartak : Thank you for your response. 
Yes, I was looking for the syntax and it worked.

dubeank
New Contributor III
New Contributor III

@rushikeshvartak : is it possible to fetch the approvers from any customproperty attribute of entitlement?
I am storing approvers details in entitlement customproperty15 and when trying to use it in workflow, it's not working as expected and request is getting assigned to Admin.
I am using below code:
select userkey from users where USERNAME in (select customproperty15 from entitlement where entitlement.entitlement_valuekey=${REQUESTACCESSOBJ.id})

dubeank
New Contributor III
New Contributor III

@rushikeshvartak I have found a way to fetch customproperty values of an entitlement using the belwo query:
select userkey from users where username =(select customproperty15 from entitlement_values where entitlement_valuekey=${REQUESTACCESSOBJ.id})

However, if more than one user is available in customproperty15  with ";" as a separator, is it possible to identify them and send approval to all?

dubeank_0-1703859141841.png

I have tried to user SUBSTRING_INDEX function but it did not work for more than one value:

select userkey from users where username =(select SUBSTRING_INDEX(SUBSTRING_INDEX(customproperty15, ";", 2), "=", -1) from entitlement_values where entitlement_valuekey=${REQUESTACCESSOBJ.id})

 

select userkey from users where username in (SELECT SUBSTRING_INDEX(SUBSTRING_INDEX(customproperty8, ';', n), ';', -1) userkey FROM entitlement_values JOIN ( SELECT 1 AS n UNION SELECT 2 UNION SELECT 3 UNION SELECT 4 UNION SELECT 5 UNION SELECT 6 UNION SELECT 7 UNION SELECT 8 ) AS numbers ON CHAR_LENGTH(customproperty8) - CHAR_LENGTH(REPLACE(customproperty8, ';', '')) >= n - 1 where entitlement_valuekey=${REQUESTACCESSOBJ.id})


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

dubeank
New Contributor III
New Contributor III

@rushikeshvartak : Thank you so much. It worked.