Click HERE to see how Saviynt Intelligence is transforming the industry. |
09/10/2024 10:30 AM
All group hierarchy, both parent, child and lateral, is presumed to have been brought in due to having the importGroupHierarchy set to true. Within our Active Directory, accounts with membership in a group have inherited membership within the parent group, but they do not inherit membership to other subgroups of the parent or membership group. For example, assume group A has subgroups A.1 and A.2. Then A.1 has subgroups A.1.1 and A.1.2. The Account is defined as a member of Group A.1 within Active Directory. Following a Full Access import, the Account's hierarchy and Associated Entitlement for the account in Saviynt reflects the account's membership in all 5 groups shown in the example below, but in reality, the account is only a member of Group A.1 and Group A via inheritance. Therefore, the account only has accesses for those 2 groups. How do we configure the groupImportMapping so that the account's Accesses/Entitlements are reflected correctly?
Current groupImportMapping configuration:
"importGroupHierarchy": "true",
"entitlementTypeName": "",
"performGroupAccountLinking": "true",
"importnestedmembershipoutofscope": "true",
"incrementalTimeField": "whenChanged",
"groupObjectClass": "(objectclass=group)",
Example:
Group A
Group A.1 Group A.2
Group A.1.1 Group A.1.2
09/15/2024 09:24 PM
When importGroupHierarchy is set to true, it imports the group which is member of the group. Entire hierarchy of the group and associated account is imported. Currently this is how the product is designed.
09/16/2024 07:32 AM
09/15/2024 11:19 PM
Hi @kharalson so you are saying .. even though user is not member of A2 you can still see a reference in saviynt?
09/16/2024 06:50 AM
Correct. Although the account is only a member of Group A1 which would inherit Group A, both the Entitlement Hierarchy and the Associated Entitlement are also showing Group A.1.1, Group A.1.2, and Group A2 which are not inherited memberships.
I have attached a pdf reflecting the 2 groups that should be reflected and the groups that are being reflected in Saviynt.
09/27/2024 12:11 AM
Hi @kharalson did you get a solution?
09/27/2024 06:11 AM
We are still verifying, but setting importGroupHierarchy and importnestedmembershipoutofscope to false in the groupImportMapping prevented the importation of the errant nested/child entitlements.