Transfer of timebound role in case job fails

[Kaushik1]

Hi Team,

Recently our saviynt account import job(DB connection) failed with some duplicate entry error. On checking the issue, we did not find any duplicate entry. There were some timebound roles assigned to users, when the job failed it deleted all the accounts present in the endpoint due to high threshold. on next successful run, the new account was created and roles got transferred as non timebound role. could you please help with below queries?

1.   In which scenario do the job fail with error - Duplicate entry '154494-400395017' for key 'PRIMARY'

2.  We will reduce the threshold value but could you please confirm the case when job fails, will all the accounts present in the endpoint will be deleted or it will be like when the job got error the accounts after that will be deleted?

3. Is it the ideal behavior for the job to add role as non timebound access when new account is created because of this issue?

4. In REST based connector, we have one function '"doNotChangeIfFailed' which will ensure not to deleted the account if job fails. Is there similar sort of functionality for DB connector as well?

Regards,

Anshita

[rushikeshvartak]

1.   In which scenario do the job fail with error - Duplicate entry '154494-400395017' for key 'PRIMARY' (Does any mapping change for key field ?)

2.  We will reduce the threshold value but could you please confirm the case when job fails, will all the accounts present in the endpoint will be deleted or it will be like when the job got error the accounts after that will be deleted? - If threshold is very high its expected , threshold number should 10% of total accounts 

3. Is it the ideal behavior for the job to add role as non timebound access when new account is created because of this issue? - This can be defect. if you can reproduce

4. In REST based connector, we have one function '"doNotChangeIfFailed' which will ensure not to deleted the account if job fails. Is there similar sort of functionality for DB connector as well? - Use threshold config for Ent & Account

[Kaushik1]

Hi Rushikesh,

1. No such mapping was updated in connection or accounts.

2. yes- threshold will be reduced. we wanted to know the criteria how DB job will delete the account if fails.  In this case, when job got this error- will it deleted all the accounts that were reviewed by the job before this error, or any other account that was not checked by the job will be deleted.

3.Thanks, we will see if this can be replicated.

4. I tried checking but did not get any such function. could you please share the same or any documentation related to it. In threshold config- no such function was found.

[rushikeshvartak]

{
"statusAndThresholdConfig": {
"deleteLinks": true,
"accountThresholdValue": 55,
"correlateInactiveAccounts": true,
"inactivateAccountsNotInFile": false,
"entThresholdValue": {
"entType": {
"DBROLE": {
"ent": 15
}
}
}
}
}

[Kaushik1]

Hi@rushikeshvartak ,

Thanks. So, below JSON will help to make sure if job fails, then not more than 15 entitlements will be removed?

"entThresholdValue": {
"entType": {
"DBROLE": {
"ent": 15

[rushikeshvartak]

Yes similar like account threshold