Creating logical applications for Active Directory

[kunal_saxena]

Hi,

We have integrated an active directory domain with our Saviynt environment. We have few applications for which access is granted through AD groups and we want to create separate endpoints for these applications in Saviynt. For this, we are planning to take the following steps:

• Use the ENDPOINT_FILTER configuration under AD connection to define the groups used by each application
• Create application endpoints and associate them to the AD security system
• Modify the workflow to accommodate and approvals required for these application
• Run the AD account import job to import accounts and entitlements under these applications.

However this documentation for logical apps mentions that we should create a separate connection and security system. Also, to create a endpoint for Parent application.

Can you please let us know which approach will be more feasible for our requirements? The one we have listed above or the one in documentation?

If it is the documented approach, then what is the benefit of creating a new connection and security system?

Thanks,
Kunal

[NM]

@kunal_saxena , you don't have to create a seperate SS or connection for logical application.

[Manu269 · Accepted solution]

@kunal_saxena the document talks more about in terms of management.

The one you are working on is also correct.

We are using the same.

[rushikeshvartak · Accepted solution]

• For Filtering applications from technical to logical application 1-1-N is approach 
• one connection - 1 security system and multiple endpoints
• Documentation specifications are more about naming conventions for ease of use.

[wizzy]

Hello @rushikeshvartak  @Manu269  I was able to create the Logical AD apps for AD apps and their entitlement. But, Now I wanted to do same form eDirectory apps and wondering if this is possible using same Saviynt guide for AD? Please advise

[rushikeshvartak]

✅Please click the 'Accept As Solution' button on the reply (or replies) that best answered your original question and hit 'Kudos' button 👍.

• Endpoint Filter is supported for REST/ Azure AD/ AD ,etc connectors if eDirectory  connector have Endpoint filter block you can use.

[Manu269]

Which connector type are you using for eDirectory?

[wizzy]

Hello @Manu269 

I have the eDir Server connected  now and I was able to get the 42 eDir apps requestable in Saviynt. But there Entitlements are not requestable. Here is the endpoint filter script that I used:

{ 

"App1": 

[ 

{ 

"memberOf": 

["%OU=,OU=,OU=,o="] 

} 

], 

"App 42":

[

{

"memberof" :

["%OU=,OU=,OU=,o="]

}

]

}

Please advise, Thank You

[rushikeshvartak]

Check request option 

under endpoint - entitlement type - request option

it should be table / drop down as per need

[wizzy]

Hello , can you show me with screen shot as I did not see a table or drop down when I did:

Security System - Selected the Security system from the list- Endpoints - Selected the Endpoint(App name) - Entitlement type - I did not see the request option or drop down

[rushikeshvartak]

[wizzy]

Yes I have that set:  entitlements in Endpoint – Select App – Entitlements. Mind you I already had the entitlement types set to Request Options = Table, Hierarchy =Not required and saved. But the four apps are still not showing their entitlements

[rushikeshvartak]

Please create new thread for issue you facing

[Manu269]

Navigate to ep- entitlement type and select option as table