How to provision multiple owners for AD groups

[Aashish-Handa]

Hi Team,

We would like to provision multiple group owners to AD while creating or updating the group from Saviynt.

We were able to find the below code snippet from docs but looks like it didn't work properly.

"otherManagedBy":"${ownerAccountListMap.get(allOwnerList?.get(1)?.userkey.username).get(0)?.accountID}"

When reconciled, the group came without any users. We have tested the recon for other groups and it works fine for multiple owners. 

Request you to please let us know if we are missing something in the code snippet, or provide a working code snippet to provision multiple group owners in AD.

Thanks

[adarshk]

Please refer the below post and use ownerAccountListMap 

Sample:

"managedBy": "${allOwnerList?.size()>0 && ownerAccountListMap.size()>0 && ownerAccountListMap.get(allOwnerList?.get(0)?.userkey.username)!=null && ownerAccountListMap.get(allOwnerList?.get(0)?.userkey.username).size()>0?ownerAccountListMap.get(allOwnerList?.get(0)?.userkey.username).get(0)?.accountID:null}"

Referance: https://forums.saviynt.com/t5/identity-governance/ad-group-management-group-owner-in-createupdatemap...

[Aashish-Handa]

Hi @adarshk ,

Thanks for the response.

We actually have been using the same kind of code snippet for managedBy attribute, and this works for a single owner. Now, we want to provision multiple owners in a single group request. Is there a way we can loop this code snippet to achieve it?

Thanks

[adarshk]

can you retest with the above shared sample and let us know the results. 

[Aashish-Handa]

Yes, I did retest. Only the first owner was updated in AD as owner out of the 3 owners in Saviynt.

[adarshk]

Only owner with Rank1 will be provisioned as managedby at AD is single valued attribute. 

[Aashish-Handa]

Yes correct. This is the reason we are using an extended attribute otherManagedBy instead of managedBy to store multiple owners which is a multivalued attribute. Please advise.

Thanks

[rushikeshvartak]

"otherManagedBy":"${ownerAccountListMap.get(allOwnerList?.get(1)?.userkey.username).get(1)?.accountID}"

[Aashish-Handa]

Hi @rushikeshvartak ,

The above code snippet will provision the second owner in the list, correct? What if there are more than two that we need to provision, and the number of owners to be determined at runtime.

I tried working on a looping code but the createupdatemappings does not support it.

Thanks 

[rushikeshvartak]

ownerAccountListMap.get(allOwnerList?.get(1)?.userkey?.username)?.collect { it?.accountID.join(', ') }

[Aashish-Handa]

Nothing gets provisioned with this snippet.

[This message has been edited by moderator to mask sensitive info]

[rushikeshvartak]

"otherManagedBy": "${allOwnerList?.size() > 1 && ownerAccountListMap.size() > 0 && ownerAccountListMap.get(allOwnerList?.get(1)?.userkey?.username) != null && ownerAccountListMap.get(allOwnerList?.get(1)?.userkey?.username).size() > 0 ? ownerAccountListMap.get(allOwnerList?.get(1)?.userkey?.username).get(0)?.accountID : null}"

[Aashish-Handa]

No @rushikeshvartak , I need to provision n number of owners to my group.

The above mentioned code snippet will provision only one of them, which has been tested earlier as well.

[rushikeshvartak]

Does above snippet works ?

[Aashish-Handa]

"otherManagedBy": "${allOwnerList?.size() > 1 && ownerAccountListMap.size() > 0 && ownerAccountListMap.get(allOwnerList?.get(1)?.userkey?.username) != null && ownerAccountListMap.get(allOwnerList?.get(1)?.userkey?.username).size() > 0 ? ownerAccountListMap.get(allOwnerList?.get(1)?.userkey?.username).get(0)?.accountID : null}"

Yes, this one does.

Thanks

[Aashish-Handa]

But as mentioned earlier, need to provision n number of owners to my group.

[rushikeshvartak]

How many owners are exists accordingly you need to join and change index

[Aashish-Handa]

You mean something like this:

"otherManagedBy": "${allOwnerList?.size() > 9 && ownerAccountListMap.size() > 0 && ownerAccountListMap.get(allOwnerList?.get(9)?.userkey?.username) != null && ownerAccountListMap.get(allOwnerList?.get(9)?.userkey?.username).size() > 0 ? ownerAccountListMap.get(allOwnerList?.get(9)?.userkey?.username).get(0)?.accountID : null}"

But this snippet will only provision the 10th owner on the list, not the previous nine.

Thanks

[rushikeshvartak]

Yes