Config for Selected Entitlement in ARS based on Dataset_Values

[aro]

Hi,

in the "Config for Selected Entitlement in ARS" field under "Entitlement Type Details", we need access to data from a dataset.

With this configuration:

ev.entitlement_value in (select Attribute2 from Dataset_Values, where Datasetname = 'SAP-Rollen' and Attribute1 = 'AzureAD')

we get this error:

"arsms","2023-07-31T10:28:22.311+00:00","{"log":"2023-07-31 10:28:21.323 ERROR [traceId=e6aa0b24f4e37f55, spanId=e6aa0b24f4e37f55, spanExportable=true, X-Span-Export=true, X-B3-SpanId=e6aa0b24f4e37f55, TENANT_ID=DEFAULT, X-B3-TraceId=e6aa0b24f4e37f55] 7 --- [http-nio-8787-exec-9] c.s.s.a.e.ControllerExceptionHandler : ILLEGAL-ARGUMENT-ERROR|java.lang.IllegalArgumentException: org.hibernate.hql.internal.ast.QuerySyntaxException: Dataset_Values is not mapped [select ev.id from com.saviynt.ssm.entity.EntitlementValues ev where ev.status=1 and ev.entitlementtypekey.endpointkey.id = 3 and ev.entitlementtypekey.id = 4 and ( ev.entitlement_value in (select attribute2 from Dataset_Values where Datasetname = 'SAP-Rollen' and attribute1 = 'AzureAD') )]|\u0009at org.hibernate.internal.ExceptionConverterImpl.convert(ExceptionConverterImpl.java:138) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.internal.ExceptionConverterImpl.convert(ExceptionConverterImpl.java:181) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.internal.ExceptionConverterImpl.convert(ExceptionConverterImpl.java:188) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.internal.AbstractSharedSessionContract.createQuery(AbstractSharedSessionContract.java:729) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.internal.AbstractSharedSessionContract.createQuery(AbstractSharedSessionContract.java:104) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at jdk.internal.reflect.GeneratedMethodAccessor107.invoke(Unknown Source) ~[na:na]|Caused by: org.hibernate.hql.internal.ast.QuerySyntaxException: Dataset_Values is not mapped [select ev.id from com.saviynt.ssm.entity.EntitlementValues ev where ev.status=1 and ev.entitlementtypekey.endpointkey.id = 3 and ev.entitlementtypekey.id = 4 and ( ev.entitlement_value in (select attribute2 from Dataset_Values where Datasetname = 'SAP-Rollen' and attribute1 = 'AzureAD') )]|\u0009at org.hibernate.hql.internal.ast.QuerySyntaxException.generateQueryException(QuerySyntaxException.java:79) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.QueryException.wrapWithQueryString(QueryException.java:103) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.hql.internal.ast.QueryTranslatorImpl.doCompile(QueryTranslatorImpl.java:219) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.hql.internal.ast.QueryTranslatorImpl.compile(QueryTranslatorImpl.java:143) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.engine.query.spi.HQLQueryPlan.\u003cinit\u003e(HQLQueryPlan.java:119) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.engine.query.spi.HQLQueryPlan.\u003cinit\u003e(HQLQueryPlan.java:80) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|Caused by: org.hibernate.hql.internal.ast.QuerySyntaxException: Dataset_Values is not mapped|\u0009at org.hibernate.hql.internal.ast.util.SessionFactoryHelper.requireClassPersister(SessionFactoryHelper.java:169) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.hql.internal.ast.tree.FromElementFactory.addFromElement(FromElementFactory.java:91) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.hql.internal.ast.tree.FromClause.addFromElement(FromClause.java:79) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.hql.internal.ast.HqlSqlWalker.createFromElement(HqlSqlWalker.java:331) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.hql.internal.antlr.HqlSqlBaseWalker.fromElement(HqlSqlBaseWalker.java:3695) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]|\u0009at org.hibernate.hql.internal.antlr.HqlSqlBaseWalker.fromElementList(HqlSqlBaseWalker.java:3584) ~[hibernate-core-5.3.18.Final.jar!/:5.3.18.Final]| \n","stream":"stdout","time":"2023-07-31T10:28:21.323668305Z"}"

The documentation does not help us. It doesn't say whether it's SQL or HQL:

https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter02-Identity-Repository/Viewi...

How can we access "datasets"?

[rushikeshvartak]

Only entitlement_value  table is exposed hence use dynamic attribute and refer in Config for Selected Entitlement in ARS

[Darshanjain]

Hi @aro 

As Discussed,

You can create a Dynamic attribute say name as TEST and use sql enum and keep the below query

select Attribute2 from Dataset_Values, where Datasetname = 'SAP-Rollen' and Attribute1 = 'AzureAD'

and in the config for ent types- you can keep this condition

ev.entitlement_value in ${test}.

Thanks

Darshan

[aro]

Hi @Darshanjain,

we tried it with a Dynamic Attribute, but unfortunately this workaround doesn't work.

This is what the Dynamic Attribute looks like:

When opening the form, no selected values are displayed:

In addition, when selecting new values (which are not displayed here either), the dynamic attribute including all configurations would be displayed:

However, in some systems there are more than 30 configurations, which are much longer than the example above.

How could the selected values be displayed without manual user interaction?

And is there a way with no visible Dynamic Attribute?

[Darshanjain]

Hi @aro 

Quite confused with your requirement here, So the above query returns multiple attributes as per the screenshot and you have made it non editable as well so that it shows all the values returned by the query and as per that Entitlements are requestable.

I am actually not sure what is the issue you are facing

Thanks

Darshan

[aro]

Hi @Darshanjain 

The whole thing is just a workaround. We're trying to build around a limitation of Saviynt here:

Actually we just want to put a very long configuration in the field "Configuration for selected entitlement in ARS". However, this is not possible because in the Entitlement_Types table, the ARS_SELECT_ENT_SQLQUEREY column is of type varchar(255).

In contrast, you can make very long configurations in the "Config for Requestable Entitlement in ARS" field. Because here the column ARS_REQ_ENT_SQLQUEREY () is of the long text type.

Why do both fields differ in the data type, although the same configurations are/can be stored here?

Without this limitation, we wouldn't need all these workarounds with datasets or Dynamic Attributes. The end user should see the required values from "Configuration for selected entitlement in ARS" , even if the the configuration is very long. But that is currently not possible.

Is there a better workaround that the end user doesn't notice?

[Darshanjain]

Hi @aro 

Unfortunately there is no otherway, we also have a idea request ( https://ideas.saviynt.com/ideas/EIC-I-4918 ) for the same to make both attributes as same type.

The dynamic attribute workaround will show all the values in the form which makes little clumsy ( is this the issue )

Thanks

Darshan