Duo access request issue

[GauravJain]

Hi

After configuring required connectors and importing data for Duo integration, i am trying to raise first access request for another user but its failing with following error in logs. Its related to dynamic attributes which were created by default by Duo connector - i am just selecting a user, Account type as "EndUser", MFA status as "Active" and putting "test" in comments section. Let me know if you require any further information.

ERROR-INTERNAL-ERROR|java.lang.NullPointerException: null| at com.saviynt.ssm.arsms.service.impl.RequestAccessServiceImpl.validateDynamicAttr(RequestAccessServiceImpl.java:8661) ~[classes!/:2021.1.0.0-SNAPSHOT]| at com.saviynt.ssm.arsms.service.impl.RequestAccessServiceImpl.validateRequestFormAccounts(RequestAccessServiceImpl.java:1707) ~[classes!/:2021.1.0.0-SNAPSHOT]| at com.saviynt.ssm.arsms.service.impl.RequestAccessServiceImpl.createRequestAsync(RequestAccessServiceImpl.java:661) ~[classes!/:2021.1.0.0-SNAPSHOT]| at com.saviynt.ssm.arsms.service.impl.RequestAccessServiceImpl.processRequest(RequestAccessServiceImpl.java:9650) ~[classes!/:2021.1.0.0-SNAPSHOT]| at com.saviynt.ssm.arsms.controller.v2.RequestAcessControllerV2.createRequest(RequestAcessControllerV2.java:59) ~[classes!/:2021.1.0.0-SNAPSHOT]| at com.saviynt.ssm.arsms.controller.v2.RequestAcessControllerV2$$FastClassBySpringCGLIB$$23525e70.invoke(<generated>) ~[classes!/:2021.1.0.0-SNAPSHOT]|

[Dhruv_S]

Hi @GauravJain 

Thanks for reaching out to forums. Please share additional information to help us understand the issue and assist you further. 

1. Request is failing -> At what point the request is failing?

Request ID is getting generated, but request is not getting processed?

Request ID is not getting generated itself?

2. Error screenshot- Any error in UI? Please share screenshots of the error message on UI and request creation screenshot.

3. Logs- Above mentioned log snippet is not sufficient. Please share the detailed logs at the time of request creation via Forums send a message option. Exclude/Hide sensitive information from logs. 

Regards,

Dhruv Sharma

[GauravJain]

Hi @Dhruv_S thanks for your revert.

Request ID is not getting generated. When i click on "Review & Submit" button i get the attached error message.

Sharing complete logs is risky as i will have to scan each and every log line to remove sensitive information. So, if possible can you refer the log file attached on ticket INC-2019036?

Regards

Gaurav

[Dhruv_S]

Hi @GauravJain 

Thanks for the update. I can see below error in the logs.

===========

"arsms","c.s.s.a.s.impl.EndpointsServiceImpl","http-nio-8787-exec-2-qcd8b","DEBUG","final list of map is [{ID=EndUser}, {ID=AdminUser}] "
"2024-02-19T04:35:39.567+00:00","arsms","c.s.s.a.s.impl.EndpointsServiceImpl","http-nio-8787-exec-2-qcd8b","DEBUG","checking if DA is of drop-down-type "
"2024-02-19T04:35:39.567+00:00","arsms","com.saviynt.ssm.arsms.util.ARSUtils","http-nio-8787-exec-2-qcd8b","DEBUG","Inside the bindingRequestorAndRequestee "
"2024-02-19T04:35:39.567+00:00","arsms","c.s.s.a.s.impl.EndpointsServiceImpl","http-nio-8787-exec-2-qcd8b","DEBUG","Default query EndUser "
"2024-02-19T04:35:39.589+00:00","arsms","o.h.engine.jdbc.spi.SqlExceptionHelper","http-nio-8787-exec-2-qcd8b","ERROR","You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'EndUser' at line 1 "

It seems to an issue with the SQL Query for the dynamic attribute  accounttype with value EndUser.

Can you please also share the screenshot of this dynamic attribute from endpoint along with the query mentioned there. 

Regards,

Dhruv Sharma

[GauravJain]

Hi @Dhruv_S i have attached screenshots on support ticket. i dont see any query in accounttype dynamic attribute configuration. Its Enum type.

[GauravJain]

Also, these dynamic attributes are created by Saviynt automatically during first import job execution. not a single dynamic attribute was created manually here.

[Dhruv_S]

Hi @GauravJain 

I can see that you are trying to create an access request with OOTB DUO connector. However, as per the documentation you should use REST Connector.

The documentation mentions DUO connector can be used for import and REST for provisioning and deprovisioning. Please refer to the documentation. 

Supported Features (saviyntcloud.com)

Request you to follow the documentation and let us know if you still have any questions.

Regards,

Dhruv Sharma

[GauravJain]

Hi @Dhruv_S not sure why you had this impression but i have done everything using documentation only. I am using Duo connector for import and REST connector for provisioning. At security system level i have selected Duo connector in "Connection" field and REST connector in "Provisioning Connection".

After executing jobs for import i am able to import both Duo accounts and access. As part of this job's first execution, endpoint and all the dynamic fields were created automatically.

After this i created a REST connector which has a configuration for ConnectionJSON and CreateAccountJSON. 

After this i made a configuration change for entitlement types to present them in table format on request page. Now i am trying to raise a request for another user which is failing while validating dynamic attributes.

Please let me know if anything is incorrect here or if i have followed the wrong steps.

[rushikeshvartak]

Share Dynamic attribute screenshot

[GauravJain]

PFA screenshot of dynamic attributes.

Rest of the details are updated on this support ticket INC-2019036.

[rushikeshvartak · Accepted solution]

• Open Dynamic attribute and click on update.

[GauravJain]

this worked. thanks

[Dhruv_S]

Hi @GauravJain 

Thanks for the update.

You have mentioned the connector name as DUO in the original description of the issue on this post. Nothing about REST Connector is mentioned in this post.

I had also requested the connector information (DUO or REST?) from our team handling this ticket and there also you have provided the connector name as DUO connector.

We request you to share the complete and exact information in the posts and tickets so that we can come to the issue quickly and help resolve the issue.

Now that you have confirmed that you have setup both the connectors, it should be fine. We will take this up with Engineering team if there is a bug which need to be fixed.

Regards,
Dhruv Sharma