import groups with different entitlement types but same endpoint

[Robbe_Cronos]

Hello,

We are trying to import groups from Active Directory so they are requestable in Saviynt. We have OU's for department groups and OU's for application groups (Jira, Gitlab,..). 

Is there a possibility to import all of the groups using the same endpoint, but have split requests for them i.e departments request, Jira requests, Gitlab requests?

I added a screenshot which shows how we want to do it. We tried using entitlement types to differentiate the requests, but when importing groups from AD it will automatically use the "Groups" entitlement type.

Any help would be appreciated.

Robbe

[Srinivas]

Hi Robbe

Please refer to the AD Connector documentation and check the sections under groupImportMapping which shows how to import groups from different OU's.

https://saviynt.freshdesk.com/support/solutions/articles/43000615764-active-directory-ad-connector-g...

Hope this helps you

Thanks & Regards

Srinivas

[avinashchhetri · Accepted solution]

Hello Robbe,

The concept of Endpoint Filter might help in your case. This is a logical grouping of applications based on the AD  Groups. You could read the Groups at the base OU and import all groups under AD Security System and Endpoint. However if you also configure the ENDPOINTS_FILTER parameter in the connector this will also create "specific endpoints" which can be made requestable.

If your groups are all under the same OU, then something as simple as the config shared below will create 2 endpoints, Gitlab and Jira under the same parent AD Security System and Endpoint. The entitlements available in these two applications will only consist of the groups defined in it.

{
"Gitlab": [
{
"memberOf": [
"CN=%,OU=Gitlab,OU=Groups,DC=myCompany,DC=com"
]
}
],
"Jira": [
{
"memberOf": [
"CN=%,OU=Jira,OU=Groups,DC=myCompany,DC=com"
]
}
]
}

AD connector documentation : https://saviynt.freshdesk.com/support/solutions/articles/43000615764-active-directory-ad-connector-g...

Regards,

Avinash Chhetri

[avinashchhetri]

Hello Robbe,

Does this feature help solve your requirement ?

Regards,

Avinash Chhetri