Mapping servicenow entitlement owner using Rest API

[rajesh005]

I am looking for an option to map servicenow group owners directly from REST api call.  I am using entOwnerMappings field in entitlmentparams of importaccountentjson.

PFA the response.txt which shows how the response looks. In the json response manager.value holds the the value of the owner of that group (this value is sys_id). Currenlty I have populated the sys_id value manually in customproperty65 of that owner in saviynt and mapped that value in entitlement value cp2. You can see that as below

Currently after running entitlement import, I am seeing the above user becoming owner for those entitlements. I have attached the importaccountentjson and the logs. I dont see any error on logs. 

[rushikeshvartak]

Please share json & response 

[rajesh005]

I assumed I have added. I jam attaching here  

[Vedanth_BK]

Hi Rajesh,

Since the owner information is part of the GET group API, please add the acctEntMappingInfoColumnFromEnt in colsToPropsMap to store the owner information and the processingType entToAcctMapping in acctEntParams to map the owners to their entitlement values.

Please note that users must be imported in order to be mapped as owners, and if the users are imported from a connector/source other than the REST connector- the UserSource should be specified in the ImportAccountEntitlementJSON. The UserSourcekey information will be available in the user's table.
Please find the attached document containing a sample ImportAccountEntitlementJSON for this use case.

Thank you
Vedanth B.K

[rajesh005]

Vedanth, you mentioned to use processing type as entToAcctMapping in acctEntParams but in the sample you provided I dont see that, I see "SequentialAndIterative" can you confirm that

[rushikeshvartak]

Thats should not be an issue. are you facing any issue

[Vedanth_BK]

@rajesh005 Please check the call2 in acctEntParams.

[rajesh005]

Vedanth, I tried with the option you suggested but it didn't seemed to work. I am attaching the updated importaccountentjson, logs during group import and the rest api response for group import api call.

[GauravJain]

Rajesh - whats the source of "users" data in Saviynt - is it coming from ServiceNow / LDAP or any other system? If its ServiceNow and you have configured "ImportUserJSON" in REST connector then you dont need to use "userSourceList" for sure. Please share source system name.

[rajesh005]

users are coming from workday. 

[Vedanth_BK]

Rajesh,
The UserSourcekey information will be available in the user's table. Please check the sample shared above and add the UserSource under globalSettings.
Thanks 

[GauravJain]

Use following query to get all user sources and put them in global settings

select distinct USERSOURCE, count(*) from users group by username

"globalSettings": {
"userSourceList": [
"1",""2"
]
},

OR use this which will automatically cover all options

"globalSettings": {
"userSourceList": [
"ALL"
]
},

[rajesh005]

Servicenow team had generated scripted api's instead of out of the box rest api's. So I believe mapping entitlment owner will be easy.

However, I am still not seeing entitlement owners getting mapped. I am attaching postman output for entitlement recon, logs and importaccountentjson.

To summarize, the owner I need to map for each entitlement is coming in "manager" parameter (you can see that in attached postman response. In saviynt that value is stored as systemusername for each user in users table. 

Can you let me know what mistake I am doing.

[Vedanth_BK · Accepted solution]

Hi @rajesh005 

Analyzing the attached JSON and response, I observed the below
* Result is mentioned again in listField of entOwnerMappings and the processing type.
Use the below sample:

"entOwnerMappings": {
"listField": "",
"idPath": "Manager",
"keyField": "systemusername"
}
}

* acctEntMappingInfoColumnFromEnt attribute is specified in the colsToPropsMap of entitlementParams.
* The processing type "entToAcctMapping" is not present in acctEntParams.

In case you require additional details,The sample JSON for this scenario is available in the REST Connector guide under Developers Handbook->Importing Entitlement Owners

Also, please verify that the users are present in the users table and since the keyField is mapped to systemusername, ensure that the response(manager attribute) matches the same value.

Thank you
Vedanth B.K

[GauravJain · Accepted solution]

Hi @rajesh005 

You should make following changes :

1) Add "acctEntMappingInfoColumnFromEnt" inside "colsToPropsMap" for Group entType as shown below

"colsToPropsMap": {
"entitlementID": "Sys ID~#~char",
"entitlement_value": "Name~#~char",
"description": "Description~#~char",
"customproperty1": "Active~#~char",
"customproperty2": "Manager~#~char",
"status": "Active~#~char",
"acctEntMappingInfoColumnFromEnt": "STORE#ACC#ENT#MAPPINGINFO~#~char"
}

2) Keep "listField" as blank as you have owner data at results level only

"entOwnerMappings": {
"listField": "",
"idPath": "Manager",
"keyField": "systemusername"
}

3) Inside "acctEntParams" configuration, have another call "call2" 

"call2": {
"connection": "acctAuth",
"callOrder": 0,
"stageNumber": 0,
"showJobHistory": true,
"processingType": "entToAcctMapping",
"ownerKeyField": "systemusername"
}

Note: systemusername must match with "manager" field in your json and must be present in your users dump in Saviynt.

[rajesh005]

Gaurav and Vedanth,

Thanks for your response. I am able to map entitlement owner now, only change I had done is changed owner field "systemusername to "systemUserName" looks like the attribute is case sensitive (PFA the updated json).

However I do have following questions and want to know if it is possible.

1. With the json I attached, currently owner is getting mapped as Rank1. I also want to map same owner as rank 26 (primary certifier for certifications). So after the recon for each entitlement we should have a owner with rank 1 and rank 26.
2. If the servicenow team updates the group owner to a different user, then after group recon Saviynt should update the existing entitlement owner to a new owner.  with the current json, this is not happening, I am seeing a new owner is getting added as rank 1 along with old owner. So after the recon that entitlement is having two owners (old and new) with rank 1.

Please let me know if above things are possible OOTB with the REST connector.

[GauravJain]

Hi @rajesh005 in your updated json, i can see you have followed all the suggestions provided by me and @Vedanth_BK  to make it work. why do you say that you only made changes to "systemusername" field? 

[rajesh005]

What I meant was apart from what you suggested(which I added), the other change I made is on systemusername field.

Can you also let me know the other  questions i had

[rajesh005]

@GauravJain or @Vedanth_BK Do you have any thought above asked things and if it is feasible with rest connector

[SB · Accepted solution]

@rajesh005 

1. Setting the owner rank is currently not supported via REST. You will need to use CSV upload in order to update the owner ranks.

https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter02-Identity-Repository/Uploa...

2. Unfortunately the removal of Previous owner is also not supported but you can certainly log this requirement to our Ideas portal. https://ideas.saviynt.com

For now, we can achieve this via the Schema connector. You can use the delete query to remove the old owner from the entitlement. 

[piyushm]

Hi @SB , On the similar lines but instead of systermusername , the manager.value is sys_id from SNOW in the Entitlement API response. Is it still possible to correlate the owner to an entitlement without manually populating sys_id of each user in the users table(Customproperty)? sys_id can be populated in the accounts customproperty during accounts import. Can we map the owner using accounts customproperty(sys_id)?

[SB]

The owner can be mapped using User's attribute value.