In the IGA system target application provisioning, it is the common use cases to populate the attributes dynamically at runtime as per business logic/calculation.
For example. scenarios of provisioning to AD domain, where the AD OU account attribute is calculated based on the user’s department as defined against AD structure as per business rules (If user’s department is this than OU is X, and so on).
This requirement is well supported for Saviynt using the dynamicattributes feature, where the dynamicattribute defined at endpoint can be configured to calculate value at runtime as per the logic (SQL query lookups using user context) as defined by business.
However, dynamicattribute calculation only kicks-in on the context of ARS access request process, where it works well as per expectation and dynamicattributes are runtime calculated and be used in provisioning task mappings.
Ideally as per the documentation, if the provisioning task is generated as rule action for birthright/automated provisioning, the default value of dynamicattribute will be calculated. Refer https://docs.saviyntcloud.com/bundle/AD-v23x/page/Content/Configuring-the-Integration-for-Provisioni...
However, we find this is the bug, as during our testing we found out that dynamicattributes are not at all calculated/available during provisioning task operation if the operation is result of rules action.
This creates issue in provisioning tasks created by automated provisioning rules. The case with dynamicattributes works perfectly well with ARS request scenarios.
Due to this bug, we are left with no avenue to perform runtime calculation of attributes for automated provisioning operations.
We know that we can use groovy logical conditions in the connector Create Account/provisioning operation configuration, however it doesn’t scales well, our example use case is that there is the lookup of ~300 values of OU-department mappings which we are storing in dataset and depending on user’s department OU is calculated, the if else logic there will be to long and difficult to maintain/administer. Also, there is no access to query database table lookup in the connector Create Account/operation. Similar open queries in Saviynt forums.
Calling Dataset from connector
Eventually, as the only workaround is to use the User property and user-import pre-processor to do calculation, however, we are have almost utilized all available customproperty and also this is technical overhead if multiple other applications requires similar calculation.
Request to fix the dynamicattributes calculations for the automated provisioning tasks generated by rules or provide some other avenue (pre-processor) to enable this dynamic calculation in provisioning plan.
