Instant provisioning not working properly

[vermark]

Hi Team,

I have enbaled the 'Instant Provisioning' in Security System and added the only task type 'Change Password' in Global Config --> Instant Provisioning Tasks.

I see all type of tasks are getting provisioned instantly instead of just the 'Change Password' task

Please suggest. We are on V2021

[rushikeshvartak]

Instant provisioning is enabled under security system for that application ?

Do you see any error in logs ?

[vermark]

Yes, Instant provisioning is enabled under security system.

[sahajranajee]

Hi @vermark ,

Please check the logs when a task is created and see if the Instant provisioning task query is being printed ? Ideally it should have the task types listed along with the security system for which instant provisioning is enabled.

Also, please recheck your Provisioning Job Schedule and ensure that there aren't any job scheduled which are  running in short intervals.

[vermark]

Hi Sahaj,

I don't see the instant provisioning task query printed in logs. I also ensured no other provisioning job is running during the time when task is created. Still all other type of task (enable/disable/add access/remove access) are provisioning instantly.

Sharing the issue summary again to be on the same page:

We want only "Change Password" task to be provisioned instantly and not any other type of task for a particular endpoint. Other type of tasks will be provisioned by WSRETRY job.

In Global Config under 'Instant Provisioning Tasks' we have added 'Change Password'

In security System we have enabled the 'Instant Provisioning'

Issue:

1. For existing users all type of tasks(enable/disable/add access/remove access) are completing instantly along with change password task

2. For new users (New Account and Add access) are not completing instantly but after when this new user is created and we try to enable/disable/add access then these tasks are completing instantly.

[rushikeshvartak]

select * from configuration where name like '%INSTANTPROVISION%'

Can you check value in database

[vermark]

Hi Rushikesh,

Sharing the query output for your reference:

NAME

CATEGORY

CHILD_KEYS

CONFIGDATA

CONFIG_GROUP

CONFIG_GROUP_ORDER

CONFIG_ORDER

CONFIG_SUB_GROUP

CONFIG_SUB_GROUP_ORDER

DESCRIPTION

DISABLE_ELEMENT

HELPICONENABLE

ICON

DEPRECATED

OBJECT_LABEL

OBJECT_TYPE

POSSIBLE_VALUES

INSTANTPROVISION_TASKTYPES

Tasks

UI_WAIT_FOR_INST_PROV

5

Settings

2

1

Select the tasks for which instant provisioning needs to be enabled

FALSE

Instant Provisioning Tasks

4

1=AddAccess,2=RemoveAccess,3=NewAccount,5=ChangePassword,6=EnableAccount,8=RemoveAccount,9=UpdateUser,12=UpdateAccount,14=DisableAccount,15=EntitlementManagement,24=Create Entitlement,25=Add Access Entitlement,26=Remove Access Entitlement,27=Update Entitlement,28=Delete Entitlement,31=Update Access End Date,32=Lock Account,33=Unlock Account,34=Emergency Access Instance Grant Access,35=Emergency Access Instance Revoke Access

[Fatrick]

Hello,

Got the same problem. Trying instant provision Passwords to AD, but the Password won't update until WSretry job has been run. Judging from logs the instant provisioning for passwords is noticed, but the provisioning just doesn't happen.

[sahajranajee]

Hi @Fatrick @vermark 

Please raise this issue with Saviynt Support on Freshdesk to get it checked for a bug.

[Fatrick]

This problem was encountered because it is actually mandatory to enable instant provisioning from Security system side as well. Enabling it only from global properties will completely break the instant provisioning for the selected tasks.

So problem solved