Click HERE to see how Saviynt Intelligence is transforming the industry. |
09/12/2024 05:06 AM
I want to integrate MS Fabric with Saviynt.
We are only interested in the workspaces and their members.
We have in in hand a REST api that provdes 2 endpoints :
1 - GET Workspaces : Example : https://api.fabric.microsoft.com/v1/workspaces
An example result is the following :
{
"value": [
{
"id": "8744c9a-3e90-8842e-b976-e83ade1561f9",
"displayName": "MynWorkspace",
"description": "My second workspace",
"type": "Workspace"
},
{
"id": "c642d0cb-3329-45b5-8e32-00a1655f20c5",
"displayName": "Mine",
"description": "Mine Test Workspace",
"type": "Workspace",
"capacityId": "6dd79388-3627-4bdb-9987-e91ef0c2e029"
}
]
}
2- GET access details per workspace : Example : https://api.fabric.microsoft.com/v1/admin/workspaces/8744c9a-3e90-8842e-b976-e83ade1561f9/users
An example result is the following :
{
"accessDetails": [
{
"principal": {
"id": "af5114a9-0949-4b455-b988-8741ezfdf920",
"displayName": "John Smith",
"type": "User",
"userDetails": {
"userPrincipalName": "johnsmith@johnsmith.com"
}
},
"workspaceAccessDetails": {
"type": "Workspace",
"workspaceRole": "Admin"
}
},
{
"principal": {
"id": "09311b7a6-ade-4ada-a7eb-77783ZZs",
"displayName": "My App",
"type": "ServicePrincipal",
"servicePrincipalDetails": {
"aadAppId": "d539808-0e81-dd-c1a47006fa72"
}
},
"workspaceAccessDetails": {
"type": "Workspace",
"workspaceRole": "Admin"
}
}
]
}
This means 8744c9a-3e90-8842e-b976-e83ade1561f9 workspace has two members.
The idea is to get workspaces as entitlements and to get workspaces members (principals) as the corresponding accesses.
What would be the ImportAccountEntJSON config look like.
Thanks for helping.
09/12/2024 08:45 AM
@Ibiza you can use dependent call in entitlement import.
You will find the example in developer handbook.
09/12/2024 08:47 AM
Refer samples - https://docs.saviyntcloud.com/bundle/Dev-Handbook-REST-v24x/page/Content/Developers-Handbook.htm
09/12/2024 10:41 AM
When trying the configuration below, neither accounts nor entitlements are being pulled in Saviynt :
{
"acctEntParams":{
"entTypes":{
"Workspace":{
"call":{
"call1":{
"callOrder":0,
"processingType":"entToAcctMapping",
"stageNumber":0
}
}
}
}
},
"entitlementParams":{
"entTypes":{
"Workspace":{
"call":{
"call1":{
"callOrder":0,
"stageNumber":0,
"http":{
"url":"https://api.fabric.microsoft.com/v1/workspaces",
"httpHeaders":{
"Authorization":"${access_token}",
"Accept":"application/json"
},
"httpParams":"",
"httpContentType":"application/json",
"httpMethod":"GET"
},
"listField":"value",
"keyField":"entitlementID",
"colsToPropsMap":{
"entitlementID":"id~#~char",
"entitlement_value":"displayName~#~char"
},
"disableDeletedEntitlements":true
}
},
"acctEntMappings":{
"keyField":"entitlementID",
"listField":"value",
"importAsAccount":false
},
"entTypeOrder":1
}
},
"processingType":"SequentialAndIterative",
"connection":"userAuth"
},
"accountParams":{
"call":{
"call1":{
"keyField":"entitlementID",
"callOrder":0,
"stageNumber":0,
"listField":"value",
"http":{
"httpParams":"",
"httpContentType":"application/json",
"httpHeaders":{
"Authorization":"${access_token}",
"Accept":"application/json"
},
"httpMethod":"GET",
"url":"https://api.fabric.microsoft.com/v1/workspaces"
},
"colsToPropsMap":{
"customproperty23":"id~#~char"
}
},
"call2":{
"callOrder":1,
"stageNumber":3,
"http":{
"url":"https://api.fabric.microsoft.com/v1/admin/workspaces/${customproperty23}/users",
"httpHeaders":{
"Authorization":"${access_token}"
},
"httpContentType":"application/json",
"httpMethod":"GET"
},
"inputParams":{
"dependentCall":true
},
"listField":"accessDetails",
"keyField":"accountID",
"nextApiKeyField":"accountID",
"colsToPropsMap":{
"accountID":"principal.id~#~char",
"name":"principal.displayName~#~char",
"customproperty12":"principal.userDetails.userPrincipalName"
}
}
},
"processingType":"SequentialAndIterative",
"connection":"userAuth",
"statusAndThresholdConfig":{
"inactivateAccountsNotInFile":true,
"activeStatus":[
1
],
"deleteAccEntForActiveAccounts":true,
"statusColumn":"customproperty11",
"accountThresholdValue":1000,
"correlateInactiveAccounts":false,
"deleteLinks":true
}
}
}
09/12/2024 10:46 AM
Did you validated logs
09/12/2024 11:44 AM - edited 09/12/2024 11:44 AM
Hi @Ibiza , I could see you have defined keyfield as entitlementID in account param..
09/12/2024 11:59 AM
I was having a 401 but my connection test did not show it. That's sorted now. I was able to pull entitlements but accounts job fails with the following error : Field 'NAME' doesn't have a default value
Here is my current accountImportJSON :
{
"acctEntParams":{
"entTypes":{
"Workspace":{
"call":{
"call1":{
"callOrder":0,
"processingType":"entToAcctMapping",
"stageNumber":0
}
}
}
}
},
"entitlementParams":{
"entTypes":{
"Workspace":{
"call":{
"call1":{
"callOrder":0,
"stageNumber": 0,
"http":{
"url":"https://api.fabric.microsoft.com/v1/workspaces",
"httpHeaders":{
"Authorization":"${access_token}",
"Accept":"application/json"
},
"httpParams":"",
"httpContentType":"application/json",
"httpMethod":"GET"
},
"listField":"value",
"keyField":"entitlementID",
"colsToPropsMap":{
"entitlementID":"id~#~char",
"entitlement_value":"displayName~#~char"
},
"disableDeletedEntitlements": true
}
},
"acctEntMappings":{
"keyField":"entitlementID",
"listField":"value",
"importAsAccount":false
},
"entTypeOrder":1
}
},
"processingType":"SequentialAndIterative",
"connection":"userAuth"
},
"accountParams":{
"call":{
"call1":{
"keyField":"customproperty23",
"callOrder":0,
"stageNumber":0,
"listField":"value",
"http":{
"httpParams":"",
"httpContentType":"application/json",
"httpHeaders":{
"Authorization":"${access_token}",
"Accept":"application/json"
},
"httpMethod":"GET",
"url":"https://api.fabric.microsoft.com/v1/workspaces"
},
"colsToPropsMap":{
"customproperty23":"id~#~char"
}
},
"call2": {
"keyField": "accountID",
"callOrder": 1,
"stageNumber": 3,
"http": {
"url": "https://api.fabric.microsoft.com/v1/admin/workspaces/${customproperty23}/users",
"httpHeaders": {
"Authorization": "${access_token}"
},
"httpContentType": "application/json",
"httpMethod": "GET"
},
"inputParams": {
"dependentCall": true
},
"listField": "accessDetails",
"nextApiKeyField": "customproperty23",
"colsToPropsMap": {
"accountID": "principal.id~#~char",
"name": "principal.displayName~#~char",
"customproperty12" : "principal.userDetails.userPrincipalName"
}
}
},
"processingType":"SequentialAndIterative",
"connection":"userAuth",
"statusAndThresholdConfig":{
"inactivateAccountsNotInFile":true,
"activeStatus":[
1
],
"deleteAccEntForActiveAccounts":true,
"statusColumn":"customproperty11",
"accountThresholdValue":1000,
"correlateInactiveAccounts":false,
"deleteLinks":true
}
}
}
09/12/2024 01:22 PM
Hi @Ibiza is display name present for each user? Or we do have null values?
09/12/2024 01:33 PM
@NM they all have values. See first post by me.
09/12/2024 01:39 PM
share full logs in text format
09/12/2024 01:54 PM
@rushikeshvartak Full logs attached.
09/12/2024 01:57 PM - last edited on 09/13/2024 02:21 AM by Sunil
09/12/2024 12:56 PM - edited 09/12/2024 12:58 PM
@Ibiza
Is the value that you are getting on id unique stored in customproperty23?
You have issue with accountParams
Are you gettting the association entilements to account correct?
09/12/2024 01:04 PM
Thank you for having a look at this.
What I want in the accountParams, is that in the first call, I get all workspaces and then, for each workspcae (second call), I retrieve its accesses. In the first call, I don't need to store anything. But I used the customproperty23 to store the id so that I can use it in the second call as I saw in other dependent calls samples that we use an attribute from the first call.
Welcoming any better ideas.
Are you gettting the association entilements to account correct? --> Not yet, cause I did not get the accounts yet. I was having the Field 'NAME' doesn't have a default value error when I run account import job.
09/12/2024 01:15 PM
It seems account name is null which mandatory so validate your mapping
09/12/2024 01:29 PM
@Ibiza
Remove the first call from accountParams.
Hard code the one of the workspaces value on second call and try the import.
"https://api.fabric.microsoft.com/v1/admin/workspaces/<XXXXXXXXXX>/users",
09/12/2024 01:46 PM
@stalluri Hardcoded one workspace. The job is succeeding without accounts imported.
09/12/2024 02:23 PM
@Ibiza
Can you share the import JSON you are using and longs in text file
09/13/2024 12:30 AM - edited 09/13/2024 02:50 AM
09/13/2024 05:57 AM
Change mapping for account name from display name to userPrincipalName name which will be always unique
09/13/2024 09:28 AM
@Ibiza, Give this a try.
"name": "principal.userDetails.userPrincipalName~#~char",