mapping of managedBy to entitlement owner != OOB certifier

[Kerasit]

Hi.

When using the AD connector groupImport key value pair: 

customproperty2:managedBy_char",
"entitlementOwnerAttribute":"managedBy","tableFieldAttribute":"accountID"

1. I would expect it to set the Owner property of the entitlement=the Identity correlated to the account DN in managedBy AD attribute.
2. I would expect then that executing entitlement owner certification campaign - without customization - would correctly then generate certifier tasks for each and everyone who is entitlement owner.

I do not see the owner property being set.

I do not get certifiers=those entitlement owners set in Owner (I manually configured a few as Rank 1, as Rank 1 is the rank they are set with using above documented setting). To make the entitlement owner certification work without the need for making a customized certification campaign, it needs to be an Owner of rank "Primary certifier" (or rank 26 in nummeric).

This is somewhat stupid, and I think we are either doing something wrong, or there is an unknown extra key value pair, not documented, for setting the rank during import aswell.

[rushikeshvartak]

You need to use saviynt 4 saviynt to map owners. use table account_entitlements_privilege with attribute_value as Owner

[Kerasit]

THat makes sense as a solution to my goal, however I am interested in the Out of the box solution for this, now that the out of the box mapping of ownership exists.

There is:

1. An OOB feature for importing entitlement ownership from AD and assigning ownership to Identities.
2. An OOB Entitlement Owner certification type for creating certification campaigns.

If those two above is NOT able to be used together without the need for a customized Sav2Sav DB connector, then why even bother having the OOB mapping feature to entitlement owner? After all the entitlement owner is NOT the target of Certifier in the "Entitlement Owner Certification". Either the logic is wrongly implemented, or the certification type (Entitlement Owner) is wrongly named and the koncept not really working. Which of the OOB features are faulty? The Import of entitlement owners or the Entitlement Owner certification Type?

[rushikeshvartak]

This is known defect of saviynt. Please raise saviynt ticket to get working in your environment 🙂

[Kerasit]

I did, and was asked to bring it as a question for forum. Saviynt does not acknowledge this a defect in support tickets, so I am now asking again. How to fix this?

[rushikeshvartak]

Use saviynt entitlement owner import and write internal saviynt database query to fetch owner from account entitlement privileges table and run after ad import job. I am using this workaround and working as expected 

[Kerasit]

Thank you. Got any example? I am new to Saviynt, but enough of a nerd that I can get things working, if I have something to work with.

[Mike_Kirby]

Hi Rushikeshvartak,

Can you please share the defect number please to allow me to check and validate.

Thanks, Mike

[rushikeshvartak]

https://saviynt.freshdesk.com/support/tickets/1561753

[Kerasit]

Using CSV bulk file upload for doing this, shows interesting results.

1. To many records and the service dies. It litterally times in the GUI and I recieves an error 503. Reloading the page, and it seems all is good. However the upload has completely failed, and no records has been updated (no entitlements updated). Doing this in chunks works.
2. Not all Entitlements where correctly updated, but making a rather complex Powershell script to make a csv file with only the discrepencies, worked.
3. Uploading a new CSV file with only a "few" entitlements pointing to a new Primary Certifier, does not change Primary Certifier, but instead adds a new so there is now two.

The only good and solid way I have found to re-assign ownership of entitlements are through a certification campaign as the CSV method is not working as expected. How can I REMOVE an entitlement owner through a CSV bulk file?

I have tried making a rule in the product which could do this, however no rules can trigger on Entitlement updates with an action to change attribute values. On top of that I cannot find the correct entitlements through the out of the box policy "Entitlement Update Rule". In fact I have found no way to use that type of policy for setting up rules for entitlements which makes sense......