GRANTACCESSJSON and REVOKEACCESSJSON Assistance for Saviynt to Saviynt DB Connection

[Manu269]

Hi Team,

We need assistance for following use case in Saviynt.

Use Case:

1. We have created Saviynt to Saviynt DB Connection. We have used this for a disconnected system where provisioning will happen within Saviynt DB only. Note: Roles here does not mean Saviynt Roles like SAV Roles etc.

2. As a part of access provisioning we have made roles  to be Requestable.

2. We need assistance is creating GRANTACCESSJSON and REVOKEACCESSJSON.

3. We need to provision the requested role and associated entitlement into Saviynt DB only in requisite tables.

4. Please help in sharing the sample query and requisite table name where we have to provision the same.

5. Once the provisioning is completed, our API user will be used by mulesoft to scan for this roles and perform relative operation in another system.

[Manu269]

Hello Team,

Any help would be highly appreciated.

Thanks

[sahajranajee]

Hello,

Since its a disconnected application, you could straightaway go ahead and manually close the tasks (From UI or API) and the account and entitlement would be fulfilled on Saviynt end. You will see the entitlement (role) under the account's hierarchy:

if you still want to provision directly to Saviynt DB, you can try the following GRANTACCESSJSON and see if it works: 

{
"Role": "insert into account_entitlements1(ACCOUNTKEY,ENTITLEMENT_VALUEKEY,updatedate,updateuser) values('${task.accountKey}','${task.entitlement_valueKey}',utc_timestamp(),1);"
}

{
"Role": "insert into account_entitlements1(ACCOUNTKEY,ENTITLEMENT_VALUEKEY,updatedate,updateuser) values((select accountkey from accounts where name='${accountname}' and accounts.ENDPOINTKEY='${task.endpoint}'),'${task.entitlement_valueKey}',utc_timestamp(),1);"
}

[Manu269 · Accepted solution]

Hi,

I was able to resolve the above ask using Instant provisioning setup under Security System.

Thanks