Activity in Other Resources
Endpoint Filter for Active Directory connection using group attributes
Detailed Question: Is there any way to use the ENDPOINT FILTER attribute in AD connection, but instead of using the memberOf attribute, it uses any other attribute in an AD group ? The filtering for child endpoints will be done based on that attribut...
Saviynt servicenow app errors on test connection
The Problem Statement:We are configuring the Saviynt IGA app in Service now and when running a test or saving the connection configuration, errors are generated but we receive a successfully connected to the ‘Saviynt Service’ message.Error - Not allo...
Will AD/LDAP ‘CheckForUnique’ feature check for uniqueness across multiple domains
The scope of the Active Directory connector is limited to a single domain. Alternatively, you can use an ADSI connector for requirements around multiple domains/forests.Reference: https://docs.saviyntcloud.com/bundle/Saviynt-for-AD-v2020x/page/Conte...
SAP Account/Access Import Job Creates Multiple Backup Temp Tables
Problem Statement: During SAP Account/Access imports, several backup tables for default tables such as agr_agrs, agr_1251, etc. get created during each import cycle which contributes to performance issues...Sample BackUp Temp Tablesdistinct_temprolet...
Can you connect to SQL DB(via DB Connector) by authenticating against an AD service account?
Detailed Question: Using a DB connector, can you connect to SQL DB by authenticating against an AD service account provided the AD and DB are in the same domain and provided the service account is not present in the database?Answer: Database connecto...
Access Request form is not showing Entitlement Value for the entitlements being requested
SymptomsUser facing issues when one of the target applications utilizing the Access Request module in SSM. While requesting Access user unable to view entitlement value details.DiagnosisWe tired replicating the same issue from our end and we noticed ...
Getting file import error uploading database driver
SymptomsDriver file upload failed.Getting the following error in v2022: Getting the following error in v5.5: DiagnosisFile size is larger than 10mb file size limit currently configured.SolutionGo to: Settings > configuration files > external.properti...
Account name gets changed when disableAccountJson is triggered with "ManuallyDeleted"
SymptomsWe are setting accounts to "Manually Suspended" in Saviynt. The status change is working as expected but the account name is also getting changed after the Disable account task has been completed.Logs will show 2022-12-22 10:07:23,689 [quartz...
Cannot attach certain file types in an ARS request
Symptoms Cannot attach certain file types in an ARS request. File Types attempted and *failed...* PNGJPEGPDFPPT / PPTXDOC / DOCXRTF Only working File Types include... TXTCSVXLS / XLS Solution We need to mention the type of files accepted in...
Workflow: Check if App Role Owner is submitting the Request for someone and if so auto approve
SymptomsUse case: Application Role workflow with two levels of approval: User's manager then Role OwnerIf role owner is submitting the request for someone, then skip BOTH levels of approvals. Issue:If Role owner is requesting, Saviynt skips the secon...
Salesforce connector, Error during setup - Access token is not generated successfully
SymptomsDuring the integration with Salesforce, you may come across the following error2023-01-11 16:36:18,051 [http-nio-8080-exec-8] DEBUG provisoning.SalesForceProvisioningService - Access token is not generated successfully2023-01-11 16:36:17,510 ...
Invalid Token when viewing request history
SymptomsWhen reviewing the request history we can only ever view one request before receiving an invalid token error and clicking other requests loads the initial one we selected. This makes getting request ids, viewing old requests, and investigati...
ConnectionJson - Generate token using Cookies stored in Response Headers for Rest Connector
SymptomsWe are trying to onboard an application named Triskell using REST based connection into Saviynt. As an initial step we are trying to establish connection and import existing accounts but we are facing below issues: Triskell needs cookies to ...
AddAccesJSON in REST Connection sending calls twice
Symptoms We are seeing in our Add Access JSON in the Duck Creek Claims - QA REST connection is sending duplicate calls resulting in duplicate entitlements being listed on the system Diagnosis This error was caused by Multithreading instant provi...
Unable to view the Delete button on Workflow List Page
SymptomsIn order to delete any workflow from the system, you might run into an issue where the delete option is not visible on the workflow list page.DiagnosisThere is config present in the externalconfig.properties file as below which needs to be se...
Workflow - Lexical Error - encountered invalid character '{'
SymptomsA 'Lexical Error' is seen in the logs when a workflow is triggered.Example : ERROR services.WorkflowService - Exception in workflow servicede.odysseus.el.tree.TreeBuilderException: Error parsing '#{(requestedby.XYZ.collect { it.X}.contains("A...
"Error Occurred" popup while clicking on Campaign Config Entitlement Owner or selecting the type of the campaign as Entitlement Owner while creating the campaign
Issue: Getting a pop-up error occurred while clicking on Campaign Config Entitlement Owner or selecting the type of the campaign as Entitlement Owner while creating the campaign Solution: This is a known issue in the 2022.0.0 version and we ...
Rename ARS tile - Create User Request
Solution: You can rename the tiles from the Admin->User Interface Branding Configuration.
Service Account campaign moves directly to the completed state and has no certifications
SymptomsOn launching an SA campaign, it immediately moves to the completed state and there are no certifications within the campaignDiagnosisThe reason we don't have any certifications is because there are no certifiers.A certifier for a service acco...
Few variables are missed to generate under application catalog items in Saviynt Servicenow app
SymptomsWe have few issues reported where the variables under application catalog items are not completely generated. Few variables are missing as out of 11 variables that needed to be generated under the catalog item, only 7 were generated.Diagnosis...
User Status not updating from UI (Active to Inactive or Inactive to Active)
SymptomsWhile we are disabling any user from UI, it is not making an Active user, In-active or an Inactive user, Active.DiagnosisThe statuskey Attribute in the Global Configuration was not set to 'Editable on Update'. After making this active, the us...
Base accounts not included in the Campaign
SymptomsWe had a campaign with multiple applications configured. Base accounts were showing up for other applications, but we were not seeing base accounts for one particular endpoint in the campaign.DiagnosisThere is a config at the endpoint level w...
Getting error while AD provisioning ( Create Account Task)
SymptomsActive Directory Create account task in saviynt results in an error after running the provisioning job.Error DetailsExample 1Checking DN for CN=lastname\, firstname (firstlast),null.Error while searching for DN-CN=lastname\, firstname (firstl...
Entitlements not showing up on Request Form
SymptomsUsers are unable to view entitlements while requesting access for an application.DiagnosisBelow config is set at the Global Config level where it is restricting the entitlements without owners to not be visible. Solution The above config sho...
Request Access not moving further for action
SymptomsRequest Access page not moving ahead for further action. The Request page keeps on loading.DiagnosisThis issue can happen if the endpoint has Dynamic Attributes configured which references the '$(requestor)' or '$(requestee)' binding variable...
Campaign Stuck in Launching State
SymptomsCampaign not moving from Launching state to Preview / In progress state.DiagnosisThis issue can happen when there are multiple campaigns in progress or the campaign has large data for review.SolutionUpdate the ES timeout configuration to mini...
Saviynt Active Directory Connector supported versions
SymptomsThe Saviynt AD connector documentation states the AD version supported is 2012 and 2016. My customer has a requirement to upgrade their AD infrastructure from 2012 to 2019. In view of this I wanted to know if the current connector will be sup...
Azure AD Group Management- Group Owner Assignment
Symptoms:1. when we are creating AAD group and assign the owner , for which endpoint we are trying to create AAD group under that same endpoint owners AAD account also should be present.2. In this case you are trying to create AAD group under AZURE ...
Certifier unable to consult accounts outside of his direct reports list.
SymptomsIn Campaigns, when Certifier trying to consult the request then User list is not available DiagnosisFirstly, we tired to replicate the same request from our end with Role_Admin savrole and able to view the user list from our end. Later we che...
Revoke Tasks for Base Account not getting created - Application Owner Campaign
SymptomsRevoke tasks for Base accounts are not getting created for Application Owner Campaign. This causes an audit issue since the access has not been revoked even after the revoke action has been taken in the Campaigns.DiagnosisThis issue happens w...
new Date() function not working in JSON
SymptomsAccounts are not getting created in target application and we see the below error messageDEBUG println.PrintlnToLogger - Println :: | Error Caused by: com.fasterxml.jackson.core.JsonParseException: Unexpected character ('"' (code 34)): was ex...
Access token generation failing for REST connector
SymptomsRequirement is to integrate SAP concur as REST connected application using Oauth authentication to connect to Concur.Connectivity works for 1 hour but after that access token is getting expired.Using same refresh token we are able to generate...
Writeback user's information to Workday (REST Connector)
SymptomsRequirement is to writeback email from any Saviynt's attribute to Workday. The workday endpoint is a REST endpoint because the email is being written back to a custom object on Workday which cannot be updated through SOAP API.DiagnosisThe use...
Need to send yesterday's date as End date in REST json
SymptomsThe application should be able to send yesterday's date in the End date field. Currently it is sending todays date when using <endDate>${(new Date()).format('MM-dd-yyyy')}</endDate> SolutionWe need to use SUB function in order to send Yesterd...
AD Connector Full Import Job fails with “Threshold was met” error message
SymptomsAD Connector Full Import Job fails with “Threshold was met” error on savresponse. For customer performing bulk updates in application and mass deletion of accounts is required, the job will fail with below error as example:DiagnosisAs per dis...
Inactive Accounts not getting activated and creating duplicates (post sp3.9)
SymptomsREST Connector is unable to Activate Inactive accounts post sp3.9. Instead, it creates additional entry of Active Account and creates current Inactive account additional entry as Suspended from Import Service on the import date. Thereby causi...
AD Access Import Failure due to NULL error SAVResponse
SymptomsAD Access Import Failure due to null errors on Connecting-or-Importing-AD. The import is going to report savresponse as below: DiagnosisOne of the pre-requisites that must be checked for these errors are notation used on Customproperties unde...
ODBC support for DB Connectors
SymptomsQuestion : Can you please confirm if Saviynt supports ODBC connection?DiagnosisSolutionThis is possible using the db connection with JDBC-ODBC bridge driver. This is mentioned in the Database Connector documentation linked below. https://docs...
Active Directory Connection Failure after Certificate Upload
SymptomsActive Directory connection failure with error: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targetDiagnosisTh...
Handling Closure of Task in CreateTicketJson for Ticket Based Provisioning based on User Status
SymptomsConnection type: RESTApplication name - Ex: Ariba Requirement : It is a ticket-based Provisioning application, when user request Ariba application it should not create ticket in target and the task status should be auto complete in Saviynt.an...
Remove Account tasks for Application Owner Campaigns
SymptomsAccount removal tasks for the Application Owner Campaigns are not getting created when there are child entitlements involved.Logs would show similar errors as below: 219 [quartzScheduler_Worker-7]DEBUG campaigns.CampaignService - listOfReject...
Best Practices for Job Scheduling to avoid conflicts
From release v5.5SP3.15 and v23.1 onwards, Saviynt blocks the concurrent execution of certain conflicting jobs to prevent job failures. If you select a conflicting job type in the Create Trigger page, EIC displays an alert indicating that the job may...
Best Practices for Analytics v2 Health
Over time, v2 Analytics results can build up and cause outages due lack of space on the Elasticsearch nodes that handle the v2 Analytics. In order to mitigate this risk, we recommend taking the following actions.Analytic Control SettingsWhen creating...
ElasticSearch Alerts - Disk space optimization
Issue/IntroductionYou have received an email from Saviynt regarding emergency cleanup action required on the Elasticsearch service to prevent an outageCauseElasticsearch has accumulated too much data and is approaching disk space exhaustion. This low...
Mapping Data in JSON based on date type response from target application field
Symptomswe are developing ImportAccountEntJSON we have a requirement such as handling the status(Active/Inactive) in the JSON, The requirement is if enddate as 01/01/4000 then Active and if enddate is less than current date then it should be Inactive...
AD Import Failures due to timeout issues
SymptomsAD Import failure due to system errors like Deadlock, timeouts causes accounts to be Suspended. Because of connection timeout the import inferences number of accounts that are received from AD is way less than the # of total actual accounts.T...
Create Security System in CPAM
To create a security system, perform the following steps: Go to ADMIN > Identity Repository > Security Systems.The Security System List page is displayed.On the Security System tab, click the Actions arrow, and then select Create Security System.The...
Attribute Precedence for User Imports
SituationThis is an example situation for the solution below. The solution also applies to different situations.Let’s say you have workers that can have multiple working relationships with your organization. For example, employees and contingent work...
How to fix No Action required Task when, removing entitlements from user on targeted endpoint
When you request access via enterprise role it will give entitlements associated with that role to the end user. Issue when trying to remove the role access sometime it remove the role but doesn't remove end user group membership in the target system...
Create Connection for CPAM
Connection refers to the configuration setup for connecting to target applications. You create connections by specifying the connection parameters. Because connection parameters are different for different connection types, connections are the subset...
