Logical Application Issue - Creating new account when requesting for child endpoint

[RanjithSaiM]

Hi

We have a requirement to onboard applications which are actually managed by Active Directory groups. We have onboarded Active Directory as an application and then used endpoint filter option to create child endpoints. The child endpoints were created successfully as expected with the list of entitlements filtered in the endpoint filter.

As per the link, I even tried setting the parent Security System with entitlement only task action.

https://docs.saviyntcloud.com/bundle/KBAs/page/Content/Logical-Active-Directory-Applications.htm

Now during Access Request when we try to select the new child application, it is trying to create new account. I do not have to create new account as the parent endpoint already has the account.

[NM]

Hi @RanjithSaiM , in the child endpoint do you see active directory tagged as parent?

Keep create account json empty and use entitlement only config in security system.

[rushikeshvartak]

• As per product design every application needs own account irrespective child or normal .
• If in your case requesting child / logical application is creating new account it means you have select different account name than parent endpoint

[RanjithSaiM]

@NMYes, I have mapped it as Parent endpoint. The only problem I see with keeping Create Account empty is Joiners use case for AD, as we need to createAccount in Active Directory for new users. Once user has Active Directory account, then he/ she can submit request for these child applications.

@rushikeshvartak, As per your first point, is it supposed to submit request for the account in Parent endpoint? If I am creating a new account wouldnt it will beat the purpose of calling it a Logical application? Regarding your second bullet, I did try mapping the parent endpoint in the Mapped endpoints. Even then it was trying to create account, in fact it even complains that the accountName is already used.

How are you guys creating a Logical Application for customers, it would be greatly appreciated if you can bullet some high level steps, like create connection with endpoint filter, create security system etc. Thanks!

[rushikeshvartak]

For us Account Management is outside of Saviynt so working as expected

[dgandhi]

Hi @RanjithSaiM 

Were you able to resolve this? We have similar kind of situation.

[adarshk]

Does Parent and Child endpoints have different accountnamerule ? 

If a logical application is requested for a user who do not have account on parent endpoint, new account task for parent endpoint will be created and account will be provisioned for target. Also, an account will be created under logical endpoint which wont be provisioned. 

The new account which is getting created in your case is for parent endpoint or child endpoint? Validate the accountnamerule