Transfer of Service Account Owner is not happening on termination of actual owner from Import

[sumalatham]

Hi Team,

Transfer of Service Account Owner is not happening on termination of actual owner from Import but its working fine from UI update.

Replication steps:
1.Create a new user update rule(from Import) like below.

      condition :   statuskey isupdated and statuskey=0

    Action : transfer Ownerships : Replace Owner in Service Accounts
2.Add OwnerOnTerminate as Manager and user should have manager.

3.Set this user as owner of service account.
4.Upload user status from Active to Inactive with check rules enabled  via CSV file .
5.Service account ownerships is not transferred to user's manager.

Error:
ERROR changeaction.UserChangeActionService - Error in userList loop in method replaceOwnerInServiceAccounts: {"log":"org.springframework.orm.hibernate3.HibernateSystemException: Provided id of the wrong type for class com.saviynt.ecm.utility.UserLogins. Expected: class java.lang.Long, got class com.saviynt.ecm.utility.UserLogins; nested exception is org.hibernate.TypeMismatchException: Provided id of the wrong type for class com.saviynt.ecm.utility.UserLogins. Expected: class java.lang.Long, got class com.saviynt.ecm.utility.UserLogins\n.

version:v23.5.4

Please can you help me for this issue solving.

Thanks

Sumalatha Markanti

[armaanzahir]

Hi @sumalatham ,

Transfer of Ownership for Service Accounts using import-based user update changes works for us. The only change i see in your steps is assigning manager via the ui on owneronterminate. 

Can you set the owneronterminate as the manager's username either from the ui or set it as the manager's userkey from maybe a Saviynt DB import job? The difference i see in this is that if the dropdown selected is manager, then the owneronterminate field for the user is populated as -1 in the database. 

We usually use a Sav4Sav job to assign the owneronterminate for all user profiles in our instance with the userkey of the manager.

If this resolves the issue, this might still be considered a bug. Let me know if this works

[sumalatham]

Thanks Armaan.

I have updated OWNERONTERMINATE with Manager userkey/username from CSV import and UI Update, still service account ownerships is not assigned manager via import.

Please can you help for this issue.

Thanks

Sumalatha 

[pmahalle]

Hi @sumalatham ,

Even we observed the same behavior in one of our project, that time we used workaround using custom query and proceed. This seems like bug, raise FD ticket and check with Saviynt.

[varunmittal]

Hi @pmahalle 

Could you please provide the custom query you are using for the workaround and provide the details around the workaround as well.

Regards

Varun Mittal

[rushikeshvartak]

update users set owneronterminate=(select case when (owneronterminate!=manager OR owneronterminate is NULL or owneronterminate='') then manager else owneronterminate end) 

[varunmittal]

Hi @pmahalle

Could you please provide the custom query you are using for the workaround and provide the details around the workaround as well ?

[pmahalle]

Hi @varunmittal ,

Here is custom query we used as a workaround. Where we are setting owneronterminate value of user as a new owner when user is terminated.

UPDATE
ACCOUNTS A,
ENDPOINTS E,
ACCOUNTOWNERS AO,
USERS U
SET OWNERUSERKEY=CASE WHEN U.OWNERONTERMINATE=-1 THEN U.MANAGER ELSE U.OWNERONTERMINATE END
WHERE
A.ACCOUNTKEY = AO.ACCOUNTKEY AND
AO.OWNERUSERKEY= U.USERKEY AND
A.ENDPOINTKEY=E.ENDPOINTKEY AND
U.STATUSKEY = 0 AND
AO.RANK=1 AND
UPPER(E.ENDPOINTNAME) = 'AD SERVICE ACCOUNT' AND
UPPER(A.ACCOUNTTYPE) = 'SERVICE ACCOUNT';

[Manu269]

We have even encountered this problem in one of the eic version.

To achieve this use case we created sav4sav db connection to add owner on terminate (based on some business requirements). We populated the userkey for this attribute.

Not sure if this is been called as bug or fixed later