Change Password task not getting triggered

[rahul_p]

Hello Experts,

We are having the user update rule which unable to trigger the change password task.

Logs are not showing any error.

To debug, we added a test notification which is working but change password task for AD not getting triggered.

We are on 23.5 version.

PFB rule:

Thanks,

Rahul

[sk]

Does the respective user has account on respective endpoint(AD) which you are trying to trigger change password?

[armaanzahir]

Hi @rahul_p ,

Do you have a password policy created for this application? The policy also needs to be set at the security system's "Policy Rule" for the tasks to be created and the change password tile to reflect this application via a UI request.

Ref: Viewing or Updating Security System (saviyntcloud.com)

Creating Password Policies (saviyntcloud.com)

[rahul_p]

Hello @sk ,

The respective user has active account on AD and we are trying to trigger change password of AD.

Hello @armaanzahir ,

Yeah, we have assigned password policy at AD endpoint and at change password action we have selected the AD endpoint.

Thanks,

Rahul

[rushikeshvartak]

Does user account is active ? 

Does creating task from postman works ? (For testing)

[rahul_p]

Dear Saviynt Team,

Can you please update on this? If this is an open bug then please confirm so we can accordingly we will design our solution.

Waiting for your reply.

Regards,

Rahul

[pmahalle]

Hi @rahul_p ,

Did you have added same AD connection under Password Management Connection in Security System.

Also put values for all the below fields inside connection:

[rahul_p]

Hi @pmahalle ,

We have performed both the configuration i.e. in security system and connection but still its not working.

Please comment.

Regards,

Rahul

[pmahalle]

@rahul_p Your rule is detective, right? Can you try with non-detective rule, put condition on what user update you wanted to trigger change password task.

[rahul_p]

Hi @pmahalle ,

Thank you for your input and its working. But in our use case we want to trigger the change password action using detective user update rule as change password need account in "Active"state. 

We are configuring "Re-hire" scenario where account will be in-active or terminated. So in both cases we want to trigger change password action at certain point where account should have been active.

So change password for an account cannot get triggered using detective user update rule, is an open bug? Please confirm?

Regards,

Rahul

[rushikeshvartak]

If your analysis proof that it does not work then it should be defect, now that will be challenging that whether it was working ever ? If yes that will be considered as enhancement 

[pmahalle]

Hi @rahul_p ,

Yes change password for an account cannot get triggered using detective user update rule. But I don't think it's bug it's default behavior of Saviynt, otherwise it would keep changing the password for user whenever you run the detective rule run job and conditions matched.

I can suggest one work-around which we are using in our project as well

1. Add one more action in your existing update rule where you are enabling the account "Create Update User Task" and update one of the user's custompropertyX let's say with string "ChangePassword".

2. Create Sav for Sav and under userimport xml, write query to find out all the users with custompropertyX as "ChangePassword" and update same custompropertyX with "PasswordChanged" string.

3. Write one more update rule on user updated through Import with condition (a.status=1 and ## a.custompropertyX isupdated## and a.custompropertyX  ='PasswordChanged") and add action Change Password with your endpoint.

It will trigger Change password task and even your account will be in active state.

Let me know if any challenges.

[rahul_p]

Hey @pmahalle ,

Thank you so much for the reply, let me discuss the same internally and will get back to you soon.

Thanks again.

Regards,

Rahul

[rahul_p]

Hello @pmahalle ,

Let me try this.

Regards,

Rahul