There are several targets that EIC manages on which accounts are not deleted. They are retained for various reasons and therefore the apps have a requirement for Saviynt to allow users to request reactivation of their IDs on the targets.
The security system has also been configured to create entitlement tasks only because the New Account pending task needs to be suppressed within Saviynt until the requested entitlements are fully approved. If this configuration is not enabled in Saviynt, then Saviynt will create an ID right away on the target even while entitlements are pending approval (because request type = 3 is configured for autoapproval).
Additionally, the below configuration has also been enabled on the endpoint:
Users are still able to request a new account to be created with the above configurations through the following request workflow:
Click on Add New Access which then brings up all the different endpoints avaialble in Saviynt for ARS (for this use case, the ServiceNow ID of the user is inactive and user is trying to request it).
When the user click on the endpoint tile, EIC shows the option to request new account.
In the next step, the user is able to provide the same ID as was used before and also request the required entitlements. This would create a pending task with selected entitlements and WSRETRY would fail to process the pending task because there is already an inactive account on the target with the same name.
If the user provides an account name that does not exist on the target, then this ends up with (1) the target having multiple IDs for a single user (2) SSO failing because the new user ID on the target is not present in the enterprise directory to successfully authenticate the user via SSO solution.
Any suggestions on how to overcome this shortfall in Saviynt product?
Thanks.
Hi @krecpond
Please try adding the uniqueness check on the account name rule in your endpoint.
Go to Endpoint->Account Name Rule->Check Unique Account and select Inactive, Manually Suspended.
This will prevent the user to submit the request.
