Provisioning AD group and additional entitlement from REST based application

[varunakarnia]

Hi All,

We have a requirement to provision an AD group first and then assign the requested endpoint's entitlement, I am seeking out help to know how we can achieve this?

The AD group should be assigned automatically since there is only one for whole endpoint, but roles needs to selected via end user only.

For example, AD group name is App_AD_Group and endpoint is  Application_ABC with entitlments ent1, ent and ent3. If someone raises request in Saviynt for ent1 for Application_ABC. Before assigning that ent1 entitlement to user, it should assign App_AD_Group and then assign entitlement.

Any possible workaround to this?

AD app uses Saviynt's OOTB AD connector and Application_ABC uses REST connector

[rushikeshvartak · Accepted solution]

• You can create wsretry for abc application using advanced configuration query that if ad entitlement not assigned then don’t pick task.
• you can create task for ad entitlement using entitlement map feature

[Amit_Malik · Accepted solution]

@varunakarnia , you can use entitlement map in rest connector endpoint entitlements. Map ent 1,2,3 with ad entitlement.

This will make sure if ent1,2,3 is requested a task for ad grp is created.

Schedule wsrety for ad and rest one after another. And keep AD First.

[NM · Accepted solution]

Hi @varunakarnia you can use new account feature in endpoint as well to fulfill your requirements.