entitlement on account suspended from import service

[saoual]

Hello,
We see that user entitlement remain on the account "suspended from import service", and when we look at the account in its active state, no entitlement are linked to this right. I saw an article on the forum https://forums.saviynt.com/t5/identity-governance/how-to-remove-entitlements-inactive-suspended-from... but it doesn't work.

Could you please help me?

[dgandhi]

Are you saying that entitlements remains on SUSPENDED FROM IMPORT SERVICE accounts?

[saoual]

Yes, indeed, they remain on the IMPORT SERVICE SUSPENDED accounts. On the active account, the entitlement is empty.

[dgandhi]

Is -Delete appended on the account name?

What is the connector used?

Is the access removed from the account on the target?

[saoual]

yes, -Delete is added to the account suspended from import service.
This is an LDAP connector.

[rushikeshvartak]

Please try after setting the deleteLinks as true in the STATUS_THRESHOLD_CONFIG in your connection.

Refer below for AD Connector-

https://docs.saviyntcloud.com/bundle/AD-v231/page/Content/Configuring-the-Integration-for-Importing-...

share status threshold config

[saoual]

I tried but it didn't work.
I can't open the link you've attached, there's a message saying: We couldn't find the page you were looking for.

[saoual]

Hello rushikeshvartak,
I see that the configuration "deleteLinks" : true", this will only be effective for accounts that have been SUSPENDED after this configuration has been modified.
My problem is mainly with older accounts (accounts before this  configuration "deleteLinks" : true" ). How can I ensure that the entitlement is no longer applied to suspended accounts but to active accounts?

[rushikeshvartak]

Existing accounts one time you can cleanup by REST API

https://documenter.getpostman.com/view/23973797/2s9Ykhh4VH#6eaefa44-7149-4389-8e33-f88e134371a8

{{url}}/ECM/{{path}}/removeAccountToEntitlement

[saoual]

I did the test, access is removed from the suspended account but the entitlement is empty on the active account.

[Darshanjain]

Hi @saoual 

Are you talking about the child account here, if yes please check the child account referenced (REFERENCED_ACCOUNTKEY )account column meaning check if parent account is tagged to which child account, it might be the case that it is still referring to old account which is suspended so you are not able to get the entitlements.

Thanks

Darshan

[saoual]

Hi Darshanjan,

Yes, I am talking about the child account. I checked the REFERENCED_ACCOUNTKEY, the parent account is associated with the child account, it is not referred to the old account which is suspended.

[rushikeshvartak]

You can popupate reference accountkey in child account.

reference key in child account will be parent account key

[saoual]

this is what i already have in place.

[Darshanjain]

Hi @saoual 

Just to reiterate , Now you have the parent account and it has the entitlements but the child account doesnt have any entitlement even though it is present in target and also you have validated the mapping between parent and child account?

Let me know if i am right or not? if yes we will have to check the logs to see what is happening

Thanks

Darshan 

[saoual]

yes, you are right

[Darshanjain]

Have created a ticket-2017937

please share the logs there. we will check.

Thanks

Darshan

[rushikeshvartak]

using import or API

[saoual]

what do you mean by using import or API?