Initial Load Rule Repair

[Chamundeeswari]

Hi,

We have technical rules that creates new accounts as a birth right, let's say AD account and adds a bunch of accesses. When we perform an Initial Load in production, how do we ensure Saviynt doesn't try to create new accounts for existing users who already have an AD account ? And make sure Saviynt is not creating any duplicate "Add Access" tasks for user's who have existing accesses ? Is "Repair Rule to User mappings" the solution for this ?

Thanks and Cheers!

[NM]

Hi @Chamundeeswari saviynt handles it automatically.. if account is present it won't create a task.

[Chamundeeswari]

And what about accesses ? Of course the accesses are already existing without the rule. So, will Saviynt automatically recognize them as rule-based and only add additional access that the users do not have ?

[NM]

@Chamundeeswari yes

[indra_hema_95]

Hi @Chamundeeswari For initial  data load make sure your account name rule is matching with the existing account names in AD otherwise it can create duplicate accounts. For example if you account name rule is FirstName.LastName(John.Doe) but you have same user in AD with FirstName First Initial+LastName(J.Doe).

For access it doesn't add duplicates if the access is already there.

Regards,

Indra 

[rushikeshvartak]

• Keep rule disabled during initial load. 
• if rules are enabled, missing user with account will be get created
• if you have to fix existing all users, keep rules enabled

[Chamundeeswari]

My plan is to not add any rules in the beginning. Only import users and accounts. Then, after imports, then I will have the rules created and run the HR import one more time to see if any new tasks are created.

[rushikeshvartak]

That's perfect plan

[NM]

Sounds good.

[Chamundeeswari]

Great! 😄 Could someone explain how "Repair Rule to User mappings"  works in the backend ? It might help a lot going forward. And how have you configured it in your environments ?

[stalluri]

@Chamundeeswari 

It is a retrofit job that can be used to populate a few values in the Account_entitlement1  table.

1. https://docs.saviyntcloud.com/bundle/EIC-Admin-v24x/page/Content/Chapter05-Policies/Repairing-Rule-U...
2. https://docs.saviyntcloud.com/bundle/EIC-Admin-v24x/page/Content/Chapter02-Identity-Repository/Repai...

• After running these jobs, the association are getting populated in the account_entitlement1 table (assignedFromRule,assignedFromRole  and assignedFromRoles). If they are populated, then on the next run, if the condition fails, it will remove access. If the new condition matches, it will assign the new access.

Saviynt suggests running these jobs every week.

[rushikeshvartak]

• If there any missing mapping on entitlement from where its assigned (assignedfromrule column in account_entitlements1 table) then its get populated from above job.
• Why its important ?
  • During detective rule - remove existing access if birth rule fails this flag needs assigned from rule value to identify which was assigned previously by rule