Roles and Entitelments assigment

[userNM]

Hello,

is it possible to assign the entitlement to the account (user) based on user.customproperties?In AD?

For example where user.customproperty1 = 'x' and user.customproperty2 = 'y' and

AD Entitlements = 'CN= 'xy.....' then this entitlement is assigned to an account of a user. 

because each user has a unique AD Entitlement.

Thank you!

[Raghu]

@userNM  yes based actionable analytics report:

Create Anlaytic Report based on your criteria and pass group entiltment_valuekey and create RunAllAnalyticsJob  under job:

select distinct a.accountkey AS 'acctKey', '12313' AS 'entvaluekey', u.enddate AS 'Termination Date', a.accountid, a.name as accName, u.userkey as 'userKey', u.username AS 'GUID', u.FIRSTNAME, u.LASTNAME, u.EMAIL AS USER_EMAIL, SYSDATE() AS RUNTIME, 'provisionaccess' as 'Default_Action_For_Analytics' from users u, user_accounts ua, accounts a, account_entitlements1 ae where a.status in ('ACTIVE','Manually Provisioned','1') and u.userkey = ua.userkey and ua.accountkey = a.accountkey and a.accountkey=ae.accountkey and a.endpointkey=5 and u.customproperty1='x' and u.customproperty1='y'

Refrence :

https://forums.saviynt.com/t5/identity-governance/access-provisioning-aad-groups-through-actionable-...

[This message has been edited by moderator to remove URL hyperlink]

[rushikeshvartak]

You can use technical and user update rule to assign AD Groups dynamically

Refer https://docs.saviyntcloud.com/bundle/EIC-Admin-v24x/page/Content/Chapter05-Policies/Creating-Technic...

[dgandhi]

Can be assigned via Technical rule, below example:

Scenario 2: Provisioning Access (Entitlements) based on Dynamic Values

This scenario provides details of provisioning access (entitlement values) to a user for entitlement values belonging to a particular entitlement type and an endpoint when it matches the condition specified using the dynamic user attributes. For example, let’s assume that there are entitlement values such as: CN=HR,OU=AD (entitlementvalue1 value), CN=Finance,OU=AD (entitlementvalue2 value), and CN=Engineering,OU=AD (entitlementvalue3 value) belonging to an endpoint 'ADTest' and associated to an entitlement type 'Groups'. The departments available in the system are: HR, Finance, and Engineering, which are assigned to a user. There is already an existing Endpoint named 'ADTest' and an entitlement type 'Groups' with above-mentioned entitlement values available.

Using this technical rule, you can assign the entitlement value to the user account for the respective department to which the user belongs, when a user is created or updated in EIC. To achieve this, define the following parameters in the technical rule:

• Object Type: Specify ENDPOINT::ENTITLEMENTTYPE from which you want to assign the entitlement to the user.

• Object: specify the CN=${user.departmentname},OU=AD custom query.

• Attribute: Select Assign.

The critical parameter Object checks dynamic values of user's departmentname (using the user.departmentname) such as HR, Finance, and Engineering to which user belongs and accordingly assigns the respective entitlement for the particular department. For example, when a user joins the HR department then based on the query, the entitlementvalue1 value CN=HR,OU=AD is assigned to the user for Groups entitlement type and ADTest endpoint. Once the tasks are created and are completed for all the entitlements, the respective entitlements are provisioned to the user account.

[userNM]

thank you very much! and also @Raghu  and @rushikeshvartak  !

But the thing is that roles are like CN = role_user.customproperty1_user.customproperty2, OU=AD

so kinda of a combination, not sure if from the syntax I can write smth like this

CN = ${%user.customproperty1%} "_"${%user.customproperty2%}, OU=AD

And @Raghu do you think if the entitlements are already there, we can link it with accounts via analytics?

[rushikeshvartak]

You can use 

CN = ${%user.customproperty1%} "_"${%user.customproperty2%}, OU=AD

[Raghu]

@userNM  yes any we passing endpointkey account level it will  and u can try above syntax it work

[userNM]

thank you! In the reference link which you sent to me

https://forums.saviynt.com/t5/identity-governance/access-provisioning-aad-groups-through-actionable-...

they use Enable Default Action for Analytics and then it is provisioned automatically, but in our case, in the newest version in Saviynt there is no such a Job type 'Run all Analytics-v2 (ANALYTICSESJOB)', do you know if in the newest version it is still exists?

[rushikeshvartak]

Yes exists

[userNM]

hi @Raghu we made analytics and it worked as you described. The Problem is it shows that the task is successfully completed, but in the user account, there is no entitlements assigned...

so, we do not understand where there is an error and how we can fix it... because the entitlement should be assigned...

Thanks!

[rushikeshvartak]

Do you see entry in account_entitlements1 table fr account ?