Turn of dynamic attribute evaluation when submitting a create user request via API

[yogesh]

Saviynt v5.5SP3

I am submitting a create user request using the Saviynt API: v5/createUserRequest

below is the request payload:

{
	"username": "r6HNHFS9@wipro.com",
	"firstname": "Guest1",
	"lastname": "Azure",
	"displayname": "Azure, Guest1",
	"customproperty15": "ManAddTool"
}

The response I get from API:

{
	"msg": "An Unexpected error occured. Please try again..",
	"errorCode": "1"
}

Upon inspecting the logs I see below:

DEBUG ws.Restfulv5Controller - Enter createUserRequest 
DEBUG ws.Restfulv5Controller - Params :: [controller:restfulv5, action:createUserRequest, firstname:Guest1, displayname:Azure, Guest1, username:r6HNHFS9@wipro.com, lastname:Azure, customproperty15:ManAddTool, max:50, isFromV5:true]
DEBUG services.UsersService - Params :: [controller:restfulv5, action:createUserRequest, firstname:Guest1, displayname:Azure, Guest1, username:r6HNHFS9@wipro.com, lastname:Azure, customproperty15:ManAddTool, max:50, isFromV5:true]
DEBUG services.SaviyntCommonUtilityService - user response - [msg:, errorCode:0, user:RestUser]
ERROR services.UsersService - Exception 
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '{userid}='' AND (${formType0}='Help Desk' OR ${formType0}='S3 Account Creation' ' at line 1
at com.mysql.jdbc.Util.handleNewInstance(Util.java:400)
at com.mysql.jdbc.Util.getInstance(Util.java:383)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:980)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3847)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3783)
at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:2447)
at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2594)
at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2541)
at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2499)
at com.mysql.jdbc.StatementImpl.executeQuery(StatementImpl.java:1432)
at com.saviynt.ecm.services.UsersService$_createUserRequest_closure49.doCall(UsersService.groovy:3028)
at com.saviynt.ecm.services.UsersService.createUserRequest(UsersService.groovy:2937)
at com.saviynt.ecm.ws.Restfulv5Controller$_closure102.doCall(Restfulv5Controller.groovy:10650)
at grails.plugin.springsecurity.rest.RestTokenValidationFilter.processFilterChain(RestTokenValidationFilter.groovy:118)
at grails.plugin.springsecurity.rest.RestTokenValidationFilter.doFilter(RestTokenValidationFilter.groovy:84)
at grails.plugin.springsecurity.web.filter.GrailsAnonymousAuthenticationFilter.doFilter(GrailsAnonymousAuthenticationFilter.java:53)
at com.saviynt.webservice.SaviyntRestAuthenticationFilter.doFilter(SaviyntRestAuthenticationFilter.groovy:145)
at grails.plugin.springsecurity.web.authentication.logout.MutableLogoutFilter.doFilter(MutableLogoutFilter.java:62)
at grails.plugin.springsecurity.web.SecurityRequestHolderFilter.doFilter(SecurityRequestHolderFilter.java:59)
at com.mrhaki.grails.plugin.xframeoptions.web.XFrameOptionsFilter.doFilterInternal(XFrameOptionsFilter.java:69)
at com.brandseye.cors.CorsFilter.doFilter(CorsFilter.java:82)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)

 From above error it seems that somehow after the API call, the user form dynamic attributes are getting evaluated. I tried changing the attributes that I'm passing in the request and sometimes the query shown in the error changes to some other dynamic attribute.

My questions :

1. How do I turn off the Dynamic Attribute evaluation during this API call?
   Ideally, I want the dynamic attributes to be completely ignored during the API call. As there's a form that is already in place and we don't want to make any changes to the user create/update form's dynamic attributes.
2. Why are these queries throwing errors when they work just fine on the forms?
3. If dynamic attribute evaluation can not be turned off what I can I do to make sure that API doesn't throw any errors?
4. Is there a way to pass the dynamic attributes pre-calculated in the API request possibly to prevent errors? 

[rushikeshvartak]

try checkrules= false / inlineruleevaluation= false

checkrules - true/ false. If true, then rules will be evaluated immediately, if false rules will be evaluated by a job. If checkrulesforapi configuration(true/false/null) is set in the configuration table, then it will take precendence over checkrules parameter.

inlineruleevaluation - true/ false. If true then rules will be evaluated immediately, if false rules will be evaluated by a job.

[avinashchhetri · Accepted solution]

Yogesh,

Try setting the dynamicattrsvalidation to false and then try as shown below.

Also a point to note that since this is a Request,  Workflows are involved. You will have to set the user Modification Workflow under Global Configs > Identity Lifecycle > Modification > User Modification Workflow

If you do not want to do this, you can always use the /createUser API to directy create the users.

Regards,

Avinash Chhetri

[yogesh]

This parameter is not working for me, here is a request I submitted without employeeType:

When I add employeeType to my request I get unexpected errors:

I'm seeing this issue only when using user columns that are being used in the user creation form's dynamic attributes. 
Is "dynamicattrsvalidation" supported in Saviynt v5.5SP3?

When I remove the empoyeeType column mapping from the Dynamic attribute:

Then I can submit the request:

So it seems that the issue is caused by Dynamic Attribute and "dynamicattrsvalidation" doesn't seem to be working

[yogesh]

Upon looking up in Freshdesk it seems "dynamicattrsvalidation" works only above Saviynt v5.5SP4.

Thanks @avinashchhetri 

[avinashchhetri]

@yogesh Thanks for pointing it out.

Yes it is supported from v5.5SP4 and above. Here's the link to the release documents for the beneift of others: https://saviynt.freshdesk.com/a/solutions/articles/43000623885

Perhaps for your use case you can use /createUser API if it doesn't need to be a request ?

[yogesh]

Thanks for the suggestion Avinash but our requirements are to include a workflow before creating the user, we don't want to create the user directly so we have to use this API endpoint only.

We'll have to workaround by using attributes that are either text fields or not being used on the form I guess.