Duplicate Entitlements from Account Aggregation and Group Aggregation

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi All,

We are configuring Webservice source, the account aggregation returns the accounts with the corresponding entitlements and the group aggregation returns all the entitlements.

the problem we are facing is the when we do both account aggregation and entitlement aggregation we get all the entitlements duplicated.

how can we solve this issue or can how we correlate account entitlements with group aggregation entitlements?

2

Hello,

IDN should correlate automatically, it looks like there might be some minor difference between the entitlements aggregated in Group Agg Operation vs. Acc Agg Operation.

Are the attributes mapped correctly? Are there slight differences in the redundant group objects? Perhaps a screenshot could help.

3

Hi Sebastian,

i cannot find any difference between them.

for example, entitlement name coming from account aggregation (Accounts Admin) and the entitlement coming from group aggregation is (Accounts Admin).

4

Uploading: duplicate entitlements.jpg…

5

I can’t see that picture, says “uploading…”

Anyway, have you tried reseting the source entitlements and accounts and re-aggregate everything?

{{baseUrl}}/cc/api/source/reset/<sourceId>
1 Like
6

Have you created any custom entitlement types? If so, what are the attributes added there and which ones are marked Account ID and Account Name in the group schema?

7

in the account schema, i have username as account ID and full name as account Name and Sgroup with type group (entitlement and multi value).

and for entitlements type configuration i configured attribute Securitykey as entitlement ID and Sgroup as entitlement name

8

Set Sgroup as Entitlement ID and try again after resetting your source for accounts, entitlements

9

i changed Sgroup to be entitlement ID and deleted all the entitlements and aggregated again both account and group aggregation and same issue happened (duplicate entitlements

10

Is type of Sgroup in Account Schema same as the Entitlement Type you have created below?

11

Hi @ahmednasr ,

  1. Please verify the account schema for the “Sgroup” attribute, ensuring it is set to type “group” and supports multivalue.
  2. Also, confirm whether the “Sgroup” attribute matches the one specified in the account schema and if it is correctly mapped as the “entitlement_id” in the entitlement types.

After this, try source reset and reaggregate. Thanks!

12

@ahmednasr,

Please make sure that the entitlement attribute for the groups in the Account Schema is configured to the correct Entitlement Type.

Account Schema - groups attribute

image
image2382Ă—530 23.3 KB

In this image, the groups attribute for accounts is configured as a Multi-Valued Entitlement. Additionally, the Type is set to group, which matches the Entitlement Type you have configured for the web service. You can modify this attribute and see the available Type options in a list; within that list, you will see your entitlement type.

groups Account Attribute Edit View

image
image792Ă—871 17.4 KB

Entitlement Type - group:

image
image2377Ă—682 26.7 KB

:blue_book: Info

When configuring the account schema for a Web Service, when setting an attribute as an Entitlement, a warning will appear if you fail to select an Entitlement Type as the type for the attribute. As seen in the below screenshot, I left the Type as string instead of selecting the appropriate Type for the Entitlement.

Warning Message

image
image1602Ă—840 46.3 KB

Issue Overview & Summary

If the entitlement attribute for the account schema has a Type which does not match the Entitlement Type, there will be duplicate entitlements created. Make the changes as suggested and see if this resolves your issue.