Create Dynamic Attributes with Hyperlink in ARS

[ShyamSrisailam]

Hi All,

We can be able to create Normal Dynamic Attribute but not able to create a Dynamic Attribute with a hyperlink which should display in the ARS form. Just like the one in the below Screenshot. The hyperlink in Screenshot is created from Backend of the Saviynt but can we create this through Endpoint > Dynamic Attributes?

Getting the below Error while creating DA with a link in Endpoint Dynamic Attribute.

I have tried this syntax in the Attribute Label: <a href="<URL>" target="_blank">T&E Detailed Policy Book</a>

Is it possible. If yes, please let me know what's the correct way is to approach.

Version: v5.5 SP 3.12.2

Thanks,

Shyam

[sk]

You should be able to create hyperlinks in DA try below

<a href="<URL>">T&E Detailed Policy Book</a>

Also you can refer this helpful KBA: https://forums.saviynt.com/t5/did-you-know/did-you-know-how-and-where-can-you-leverage-the-strength-... on Dynamic Attributes

[rushikeshvartak]

Complete mandatory FCC training prior to filling-up this webform.<a href="https://sww-lms.com/s9" target="Training" > (Link to Training)</a>

[ShyamSrisailam]

Hi,

Still, I'm not able to create the hyperlink in DA. It's not even saving the DA.

Filled the Mandatory Fields in dynamic attribute.

I have tried both URL syntax's in Attribute Label but it's not even saving.

1.    <a href="<URL>">T&E Detailed Policy Book</a>

2.   <a href="https://sww-lms.com/s9" target="Training" > (Link to Training)</a>

In Logs I'm seeing the same error for both URL's

ERROR: 

2023-02-17/14:08:43.735 [{}] [https-jsse-nio-443-exec-393] DEBUG println.PrintlnToLogger - Println :: Denied due to pattern <[a-zA-Z!#&?0-9]{1,}\s*(.*)> , value= <AHREF="HTTPS://SWW-LMS.COM/S9"TARGET="TRAINING">(LINKTOTRAINING)</A>

2023-02-17/14:08:43.755 [{}] [https-jsse-nio-443-exec-393] DEBUG println.PrintlnToLogger - Println :: Denied due to pattern <a(.*?)> , value= <AHREF="HTTPS://SWW-LMS.COM/S9"TARGET="TRAINING">(LINKTOTRAINING)</A>

Let me know is this possible in v5.5 3.12

Thanks,

Shyam

[sk]

Add some text before and see if it works like below

Attribute Label: Click on <a href="<URL>">T&E Detailed Policy Book</a>

or 

Attribute Label: Click on <a href="<URL>" target="Training" >T&E Detailed Policy Book</a>

[Sheba]

As far as I know, we can't achieve this in UI, We also had a same scenario. we did it with saviynt team help by adding the URL in backend , I think JSP pages they will be adding it. Please raise a ticket on this,

[rushikeshvartak]

Raise FD ticket for v5.5

update endpoint_attributes set ATTRIBUTELABLE ='<a href=\"https://www.google.com" target=\"NDA\" > (Link to NDA) </a>' where  endpointkey=(SELECT ENDPOINTKEY FROM ENDPOINTS WHERE ENDPOINTNAME = 'Endpoint Name') and attribute='Dynamic Attribute Name';

[ShyamSrisailam]

It is not working even I keep text before Attribute Label: Click on <a href="https://www.google.com" target="Training" >T&E Detailed Policy Book</a>

Tried to run the update query through CustomQueryJOB but giving the same pop up msg: "Access denied due to XSS"

Already raised a ticket in FD and Saviynt team replied as below: 

"Unfortunately, based on feedback from the Product team, we won't be able to support Hyperlinks in Dynamic attributes due to certain security issues. Regret the inconvenience.  For any such information and directions on how to achieve something like this, forums would be your ideal way to approach. Saviynt Support is to help address break fix issues and determine defects. After the discussion with our PM team, it was brought to our attention that this is not recommended and that we are not supposed to make any changes via backend for dynamic attributes. This is not supported in v5.5SP3.12 and later versions. The solution is to not use hyperlinks in Dynamic Attributes as this use case is not supported. If you still insist on wanting to use Dynamic Attributes with Hyperlinks, please log this in the Ideas portal here - https://ideas.saviynt.com/ "

Thanks

Shyam

[rushikeshvartak]

Its supported in higher version hence you need to achieve using query if you are getting access denied error

[Manu269]

Try achieving the same via the Saviynt REST API.

[ShyamSrisailam]

@rushikeshvartak , I tried it in v5.5 SP 3 and giving the ERROR as "Access denied due to XSS" but let me know any other way we can achieve this.

@Manu269 How can we achieve, adding Hyperlink in ARS through Saviynt REST API? please let me know the steps that to make it work.

Thanks,

Shyam

[Darshanjain]

@ShyamSrisailam @rushikeshvartak ,

Security fixes has been applied across versions for specific keyword like ( '<a , <img' etc ) Hence these are not supported to fix vulnerability issues. Right now there is no way but engineering still finding a way to get these supported. Right now as it is 3.x if its very much needed you can update in database ( with approvals ) as it will be exposed to vulnerability, So would suggest you to aviod it