Found duplicate entitlements after running AD recon Job

[harishyara]

Hello All,

After running AD recon JOB successfully it was found that there were some duplicate entitlements found in Saviynt. Logs doesn't have complete information to investigate the issue.

Is there any config that we need to add in AD connection to view complete logs during AD recon job execution ?

objectGUID_Binary is the RECONCILATION_FIELD mapped in groupImportMapping

Note - Actual entitlement has all attribute values reconciled successfully as expected but duplicate entitlement doesn't have all the attribute values (like cp's mapping during import) it has only Entitlement Value . Also Accounts are getting mapped to the duplicate entitlement but not to the actual entitlement.

[Dhruv_S]

Hi @harishyara 

Could you please share the groupImportMapping.

Is the entitlement_id mapped in JSON?

Regards,

Dhruv Sharma

[harishyara]

Hi @Dhruv_S - yes it is mapped to distinguishedName.

Below is the groupImportMapping

Regards,

Harish

[rushikeshvartak]

It was working before ?

[harishyara]

Hi @rushikeshvartak - It happened after I changed the groupSearchBaseDN

FROM

OU=abc,DC=test,DC=domain,DC=com

TO

DC=test,DC=domain,DC=com

Since required groups are present under OU=Test-Groups,DC=test,DC=domain,DC=com so I have given root domain to get all the groups. 

[rushikeshvartak]

what is entitlementid for one of the duplicate ent

[harishyara]

@rushikeshvartak - duplicate entitlementid is showing as null.

[rushikeshvartak]

It seems it pulled from account import and not from Access import. inactivate them and rerun recon and try

[harishyara]

@rushikeshvartak - Okay thanks for the update but, if there is already an entitlement exist with same entitlement value why Saviynt is creating new entitlement with same entitlement value instead of updating the existing entitlement ?

Also, please note that the accounts are getting mapped to the duplicate entitlement but not to the actual entitlement?

[rushikeshvartak]

• Rename the entitlement without entitlementid.
• Using account import entitlement metadata (entielement id ) is not imported.