How to show shopping cart again for unconnected endpoints

[Riku]

Hi

We have ticketing based "manual" applications, with no account import back to Saviynt.

Those Accounts go to "Manually Suspended" status when user for example leaves company.

When user is rehired, those users don't see those endpoints shopping cart icon in ARS, as account is in this "Manually Suspended" status.

How is this supposed to work with endpoints which doesn't have import back to Saviynt? Shopping cart is shown only if Account is in "suspended from import service" status. And manual endpoints accounts never go to that status.

We have version 5.5SP3.x

Regards

Riku

[sahil]

You can try the below config for this scenario. In this case the accountname should be appended with ManuallyDeleted and on raising the request again, you should get the option of creating a new account.

Update Recon Application value to No under Security System

[Riku]

Hi

i have tested that setting, but i still can't see shopping cart.

Regards

Riku

[rushikeshvartak]

What is status of account when button not visible ? 

[Riku]

Hi

Manually suspended.

Regards

Riku

[sahil]

Can you confirm if the prev account name in your case changed to something like "abc-ManuallyDeleted on-01-24-2023 20:52". 

The account name should change in order for you to submit a request for the new account with same name.

Can you also share a screenshot of the screen you see? 

[sk]

Was Account name of Manually Suspended appended with -Deleted On-timestamp? or not?

Can you share the screenshot? Also additionally do you have below configuration enabled on endpoint level?

Disable New Account Request if Account Already Exists

[Riku]

Hi

Account name was appended with -ManuallyDeleted On-timestamp.

Disable New Account Request if Account Already Exists configuration on that endpoint is set to ON. As we don't want users to create many accounts.

Regards

Riku

[Riku]

Hi

Here is the account:

Regards

Riku

[sk]

Can you try setting Disable New Account Request if Account Already Exists to off and see it that works.

Not sure if you have end user request process on this endpoint. Let me tell this as well, problem with disabling this is that it will also allow you to create new account even if user has active account. 

[Riku]

Hi

We don't want to set Disable New Account Request if Account Already Exists to off, as this allows users to create new account even if user has active account. 

Regards

Riku

[sahil]

If this still does not work, I would suggest you to open a ticket with Saviynt support. 

I have myself tested this Use case (though on the latest version) and using the config suggested, it should work. If it is still not - it will require additional troubleshooting and our the support team can help with the same.

Suggested Config - Update Recon Application value to No under Security System

Also, if you could share a screenshot of the Request Access screen for me to know what you are seeing instead of the cart icon.

[rushikeshvartak]

This does not work in v.5.5

[Riku]

Hi

Thank you. Should i create FD ticket to get this working in v.5.5 or what do you suggest?

Regards

Riku

[rushikeshvartak]

Create Freshdesk ticket, as its replicable in our instance also

[Riku]

Hi

This is what users see, no shopping cart icon.

Regards

Riku

[sahil]

Can you please create a FD ticket with support team for this.

[Riku]

Hi

I made FD ticket #1597346 of this issue, but their answer was not what i expected to hear.

They replied:

"

We have taken up this issue with our engineering team and they confirmed that this is an expected behavior.

As mentioned earlier, we have checked with our engineering team for this behavior.

Import from UI on adhoc basis to suspend such accounts is one of the possible workaround.

"

Can you Sahil help me to get this FD ticket solved?

Regards

Riku

[sahil]

Hi @Riku 

I just tried this on 5.5 version and if you enable the option Disable New Account Request if Account Already Exists it should allow you to see the cart button. Can you try and see if it works for your env.

[Riku]

Hi

That works, but it generates us new issues.

We dont' want users to create multiple accounts per endpoint. They should have only one account.

Regards

Riku

[Darshanjain]

Hi @Riku

Let me explain you how it works

If you have selected the Global config ( show inactive account in ARS as true )-  Then when you try to request the application with one account as manually suspended status then in the backend it takes this account as inactive and new add to card button is not shown as you have enabled the config with disable new account request if account already exists . Now if you make it to false Add to cart button is shown.

Now if you want this config to be true ( disable new account request if account already exists ) and want to achieve then you can mark the other config in globla config as ( show inactive account in ARS as false ),, now this will only check for active status and if its not present then ADD to card button is shown.

( Note: Manually suspended is still taken as inactive account in​​​​ saviynt and not as deleted )

@rushikeshvartak This is not a bug in v5.5, you can also validate on the above use case

Let me know if you have any questions on this, happy to answer

[Riku]

Hi

These option changes are not good option for us, we like how those settings are now, everything else is working as should except requesting permissions again. 

We need to show some endpoints disabled accounts in ARS. We don't want users to request new accounts if they already have account.

What is the function of this Security Systems / Recon Application -setting? I would have guessed it changes how Saviynt handles manual endpoints accounts statuses and showing Shopping Cart again?

Regards

Riku

[Darshanjain]

Hi @Riku  Right now Recon Application is only used to check if the data is imported from connected endpoints.

Although i agree generally for remove account in disconnected App, if we make the status to manually deleted/suspended from import service would be better. Right now the product is not supporting this, But i would request you to raise a request in a IDEAS portal ( Enhancement request ) which can be taken care off in coming versions.

Thanks

Darshan

[sk]

Looking at it I feel in older version it is not considering manually suspended status for disconnected apps to allow request for new account which looks like fixed in new version as confirmed by @sahil .

Not sure if they can provide you backport patch to your current version as it is already fixed in newer version. if not then you left with two options

1. Do bulk upload of Manually suspended accounts to update status to SFIS or uncorrelated them from the respective user
2. Enable  Disable New Account Request if Account Already Exists option but downside it it will  users to create new account even if user has active account. 

[Darshanjain]

@sk  Please check my posts it's not a bug it's checking the other config. It's same in 3.x as well as 23.x. It should clear the confusion 

[sk]

Okay so show inactive account in ARS is set to true and Disable New Account Request if Account Already Exists is set to true hence it is not showing cart icon if any one of it it is set to false it should show the icon?

@Riku : Can you confirm the same, if so try setting it to false on show inactive account in ARS in global configuration as suggested by @Darshanjain  and see it works for you

Global Configuration -> Request -> Show Inactive Accounts in ARS

[Darshanjain]

Yes @sk  that's correct. Its been validated as well. 

[sk]

Understood. As long as they don't have Enabling Account use case on any other endpoints it should be fine. Otherwise he will still fall under same trap.

Only way they can solve the issue is doing an account import for disconnected application with latest accounts snapshot so the accounts will be marked as SFIS if they don't exist in target or use the two options I suggested in my previous comment. 

[Darshanjain]

Yes , correct. Also i have explained clearly in my above comment about how the product logic as well ( if they want two config to be true - then they can change the status of accounts by csv or custom query ) 

[Riku]

Hi

We want to show Inactive Accounts in some of our automated endpoints, so we can't set this global config off.

Regards

Riku

[Riku]

Hi

1. Bulk manual upload is not an option for us, we have over 100 manual endpoints.

2. This is not option for us either, as we don't want users to create new accounts every time they request something.

Regards

Riku

[ejeong]

I want to suggest two options

1) change account status to suspended from import service using custom query or Sav4sav

2) correlate to another user

[Riku]

Hi

Thanks ejeong for these suggestions.

We have also thought using your option nro 1. Actually we already had sav4sav batchrun running but it marked in some cases wrong accounts deleted. 

But i am still hoping this would be normal use case, and handled by Saviynt system without any custom batchruns or manual csv imports.

Regards

Riku