Announcing the Saviynt Knowledge Exchange unifying the Saviynt forums, documentation, training,
and more in a single search tool across platforms. Read the announcement here.

Issue with ServiceNow OOTB remove accessJSON

SumathiSomala
All-Star
All-Star

Hi Team,

I have used default remove access Json provided in the documentation to remove role type entitlements from user account.

I am getting below error when provisioning job is executed.

Call response: {"error":{"detail":"Record doesn't exist or ACL restricts the record retrieval","message":"No Record found"},"status":"failure"}

Also uuid values are not getting populated for accont_entitlements1 table. Could you please let me know what could be the issue and how to fix?

{
"call": [{
"name": "Group",
"connection": "userAuth",
"url": "https://<hostname>.service-now.com/api/now/v1/table/sys_user_grmember?user=${account.accountID}",
"httpMethod": "GET",
"httpHeaders": {
"Authorization": "${access_token}" },
"httpContentType": "application/json",
"successResponses": {
"statusCode": [200]
},
"unsuccessResponses": {
"statusCode": [403]
}
}, {
"name": "Group",
"connection": "userAuth",
"url": "https://<hostname>.service-now.com/api/now/v1/table/sys_user_grmember/${for (Map map : response.Group1.message.result){if (map.group.value.toString().equals(entitlementValue.entitlementID)){return map.sys_id;}}}",
"httpMethod": "DELETE",
"httpHeaders": {
"Authorization": "${access_token}" },
"httpContentType": "application/json",
"successResponses": {
"statusCode": [204]
},
"unsuccessResponses": {
"statusCode": [403]
}
}, {
"name": "Roles",
"connection": "userAuth",
"url": "https://<hostname>.service-now.com/api/now/v1/table/sys_user_has_role/${account_entitlements.uuid}",
"httpMethod": "DELETE",
"httpHeaders": {
"Authorization": "${access_token}" },
"httpContentType": "application/json" }]
}

Any help would be appreciated.

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.
20 REPLIES 20

rushikeshvartak
All-Star
All-Star

Does API working from postman ?


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

Yes @rushikeshvartak 

Tested in Postman able to remove role type entitlement from account.

 

 

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.

Manu269
All-Star
All-Star

@SumathiSomala check this once api explorer in SNOW and validate

Regards
Manish Kumar
If the response answered your query, please Accept As Solution and Kudos
.

@Manu269 Checked in postman and in REST API Explorer in ServiceNow working as expected.

Unable to remove access in Saviynt.

 

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.

Also I see Solved: Servicenow Rest - Remove Access - Saviynt Forums - 1955 this is solved but unable to get hold of json

Regards
Manish Kumar
If the response answered your query, please Accept As Solution and Kudos
.

@Manu269 Yes ,already checked this post.

unable to find the attachment.

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.

Manu269
All-Star
All-Star

@SumathiSomala you are correct. I could see the revocation for Group works perfectly and the problem is with roles.

@uthra_rahul we need assistance at this.

Regards
Manish Kumar
If the response answered your query, please Accept As Solution and Kudos
.

uthra_rahul
Saviynt Employee
Saviynt Employee

@Manu269 Let me check with the team and revert. 

SumathiSomala
All-Star
All-Star

Hi Team, 

Any update on this? 

 

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.

puneetkhullar
Saviynt Employee
Saviynt Employee

${account_entitlements.uuid} is accessible in REMOVE access JSON which you're already using but can you check this is getting reconciled and mapping id done as an example below during reconciliation. 

Example :

"colsToPropsMap": {
"uuid": "item.id~#~char"
}

@puneetkhullar I have mapped sys_id to uuid ,still getting the same error

"colsToPropsMap":{
"description":"description~#~char",
"customproperty3":"elevated_privilege~#~char",
"entitlementID":"sys_id~#~char",
"uuid":"sys_id~#~char",
"entitlement_Value":"name~#~char",
"displayname":"sys_name~#~char"
}

 

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.

Is it mapped in saviynt entitlement?


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

@rushikeshvartak Could you please elaborate

I have used above mapping in Entitlementparms ,Ran the account and access import then performed the remove entitlement.

 

 

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.

Did uuid populated in entitlement_values table


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

@rushikeshvartak unable to see uuid column in entitlement_values table

do we need analytics report to check this?

SumathiSomala_0-1706018917616.png

 

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.

select ENTITLEMENTID_LONG from entitlement_values


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

@rushikeshvartak Checked in data analyzer

EntitlementID is populates with sys_id.

"entitlementID":"sys_id~#~char",

 

 

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.

What about in account_entitlements1 table


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

SumathiSomala
All-Star
All-Star

@puneetkhullar @uthra_rahul Any update on this?

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.

puneetkhullar
Saviynt Employee
Saviynt Employee

uuid field is present under  account_entitlements1 table. Can you check if the value is populated there. If the value is not present under the account_entitlements1 for that specific accountkey then this will fail.

"url": "https://<hostname>.service-now.com/api/now/v1/table/sys_user_has_role/${account_entitlements.uuid}",

 

Also Show logs config has to be true in the connector and logs can help identify more what is going as a value in the complete URL. Please raise FD ticket as well for the same.