Rename Duplicate Entitlements

[malmenon]

Hi Team,

In our lower instances, for some entitlements, duplicate entries were created during testing.

The duplicates are marked as inactive and the original is marked active. However when we upload SOD rulesets, since both entitlements  have the same name, the duplicate is getting picked up, and SOD is not getting evaluated accurately.

There are multiple entitlements that have one or more duplicate entries. Since entitlements cannot be deleted, please let us know if there is a way to bulk rename all the duplicate inactive entitlements to append it with something like DNU (Do not use), so that the original entitlements get picked up in rulesets and SODs can be evaluated accurately.

Thanks

[dgandhi]

SELECT e1.ENTITLEMENT_VALUEKEY as entitlement_values__primarykey,  2 as entitlement_values__status

FROM entitlement_values e1
JOIN (
    SELECT ENTITLEMENT_VALUE
    FROM entitlement_values
    WHERE ENTITLEMENT_VALUE LIKE '%ou=groups,o=example%'
    GROUP BY ENTITLEMENT_VALUE
    HAVING COUNT(*) > 1
) e2
ON e1.ENTITLEMENT_VALUE = e2.ENTITLEMENT_VALUE
WHERE e1.STATUS = 1

SELECT ENTITLEMENT_VALUEKEY as entitlement_values__primarykey,
       CONCAT(ENTITLEMENT_VALUE, '_DUPLICATE') AS entitlement_values___ENTITLEMENT_VALUE
FROM entitlement_values
WHERE STATUS = 2
  AND ENTITLEMENT_VALUE LIKE '%ou=groups,o=EXAMPLE%';

Solution was provided in below thread, copying here for quick reference:

https://forums.saviynt.com/t5/identity-governance/ldap-duplicate-entitlements/m-p/106873#M70884

[rushikeshvartak]

You can rename using enhanced query job

• update limit and entitlement type key as per your requirements 

SELECT ENTITLEMENT_VALUEKEY as entitlement_values__primarykey,
       CONCAT(ENTITLEMENT_VALUE, '_DUPLICATE') AS entitlement_values___ENTITLEMENT_VALUE
FROM entitlement_values
WHERE STATUS = 2
  AND Entitlementtypekey=100 limit 10;