Hi Team,
We have a requirement that when an AD entitlement’s OU is updated in Active Directory, SailPoint should compare the old Distinguished Name (DN) with the new DN and automatically update the DN value in the corresponding IT Role. We are chaning OU name only
Ex; RES_APP_TEST OU=XYZ,DC=sailpoint,DC=com - OLD
RES_APP_TEST OU=ABC,DC=sailpoint,DC=com - NEW
Is there any kind of configuration or rule which can achieve it.
Try workaround :ObjectGUID or ObjectSid as value and Distinguished Name as Displayable name for entitlement. aggregate with ObjectGUID.
On active Directory, AD entitlement must be updated instead of recreate entitlement in new OU else it will consider as new entitlment
Hi @sureshbomm , Are you trying to update from the entitlement catalog or another process?
If you are going through the entitlement catalog, that is straightforward. It will update in AD if you enable group provisioning in the application schema level.
Thanks,
PVR.
Utilise the Group aggregation refresh rule, since this is the only rule where entitlement OU information you can compare with old DN and new DN.
Use the managedAttribute class to fetch the old value and use resourcesObject class to fetch the new value and compare it in the rule and take action
Hi @sureshbomm
You can try to update it with code in GroupAggregationRefresh Rule. Here you can get the OLD entitlement which be already saved and available in accountGroup variable. And compare it with NEW entitlement coming from group aggregation(obj variable). Comparing these both, you can customize the group DN
@ymail145 Sailpoint doesn’t recommend setting objectguid as native identity. They introduced it in the past but it didn’t work well. AD will internally ise objectguid for accessing AD objects but native id should be DN. Please check this thread: https://community.sailpoint.com/t5/IdentityIQ-Blog/Active-Directory-ObjectGUID-move-rename-support-FAQ/ba-p/206646
@sureshbomm In the Group Refresh rule, please make an entry in custom object which entitlement OU has been modified, basically old and new values.
Then write a separate rule to check all bundles which are still with old value and update them to use new value.
This is a known issue with all the apps not just AD. Having a separate rule runner job will help you address it for all apps having this issue.
I am using the NativeIdentityChangeEvent object to automate OU updates whenever there are changes in Active Directory. In this object, I can see both oldNativeIdentity and newNativeIdentity values.
I noticed that the event has three statuses: Waiting, Processing, and Completed.
My questions are:
When does the status change to Completed?
Which status should I use in my filter to ensure the update is processed correctly?
Dear @sureshbomm ,
Thanks, please mark it as solution if issue fixed.
@sureshbomm AFAIK NativeIdentityChangeEvent is not going to update Bundles. It is only for AD.
Role-Entitlement Associations → This task is introduced to scan all associations between role and entitlement.. you need to enable logs to figure out which entitlement is removed.
@sureshbomm - Use the Group aggregation rule to update the entitlement in the role. Then run a “propagate role changes” task to update the role and entitlement membership to identities.
@r_pragati Role propagation will not update the entitlements on the role. It’s being used to update the assignments on the users whenever an ent is added or removed to/from the role.
Ensure that the native identity change event propagation is enabled for the event to be processed and it should update the roles once the event is processed
@BhuvaneshGeddam Could you please share the reference article for the same?
Supporting Active Directory Native Move / Rename - SailPoint IdentityIQ - here is the doc
I gone through the document but I’m not sure which task should we trigger to change the status. Could you please let us know more details
There is no task to process them (there exists a task to retrigger the failed events), the events in pending state should be pickup automatically and processed in the background, once the event starts processing a taskresult should showup (couldn’t find the task result name now), which would be a refresh task run.
Please check if the event processing is enabled as per the docs.
There is no out-of-the-box configuration in SailPoint IdentityIQ that automatically compares an entitlement’s old DN with its new DN and updates the corresponding IT Role when only the OU portion of the DN changes.
However, this can be achieved through customization:
Run an Entitlement Aggregation to detect the updated AD group DN.
Use a Rule (such as a Post-Iterate Rule, Aggregation Rule, or custom Task) to compare the current DN with the previously stored DN.
If the CN (e.g., RES_APP_TEST) remains the same and only the OU changes, update the associated IT Role entitlement/profile programmatically via the IdentityIQ API or object model.
Alternatively, maintain a mapping table of old DN vs. new DN and update the IT Role definitions through a scheduled task.
Old DN:
CN=RES_APP_TEST,OU=XYZ,DC=sailpoint,DC=com
New DN:
CN=RES_APP_TEST,OU=ABC,DC=sailpoint,DC=com
Logic:
CN=RES_APP_TEST is unchanged.In most implementations, this is handled through a custom rule or scheduled task, as IdentityIQ does not natively synchronize IT Role entitlement references when an AD group is moved to a different OU.
@sureshbomm AFAIK during aggregation, IIQ creates a Request object for each Native Identity Change Propagation Request to update identities, bundles, policies, group definitions, etc. and this is scheduled for immediate execution. It basically do a search and replace rename operations across the systems.
There are two other tasks for: Reset Failed NativeIdentityChange Events to retry the failed propagation request and Perform Maintenance → to prune old/completed/failed records from the system.