New Service Account added to Security Group not included when group is deployed to higher environment

RE: New Service Account added to Security Group not included when group is deployed to higher environment

judym598 — Thu, 26 Sep 2019 12:11:48 GMT

Thank you!

RE: New Service Account added to Security Group not included when group is deployed to higher environment

Robert Shankin — Wed, 25 Sep 2019 23:03:37 GMT

You're right, Judy: Service Accounts are still basically user accounts first.
When a user is added to the Service Accounts user role (group), it becomes a service account.
According to current product functionality, user accounts must be created in each environment where they are to be used.
They cannot be moved from one environment to another like other Appian objects.
When a group object is exported from a system, member users are not also exported.

RE: New Service Account added to Security Group not included when group is deployed to higher environment

judym598 — Wed, 25 Sep 2019 14:44:19 GMT

You may be right - If I had included the Service Account group and promoted it that way- It would have included the user but because this new Service Account is a 'user account', it is likely that it needs to be added manually. I didn't really think of the Service Account as being like a user account but I suspect that's the case.

RE: New Service Account added to Security Group not included when group is deployed to higher environment

Mike Schmitt — Wed, 25 Sep 2019 14:33:33 GMT

[quote userid="2799" url="~/discussions/f/administration/17667/new-service-account-added-to-security-group-not-included-when-group-is-deployed-to-higher-environment/69559"]that group can be promoted to higher environments.[/quote]

My reading of it was that the group / "permission" is promoted, not actually the account, though I do see where you're coming from. I don't have much experience yet with this new service account construct, all I know is that traditional user accounts are never transferred between environments. Hopefully someone with more detailed technical knowledge about this new functionality can weigh in as well.

RE: New Service Account added to Security Group not included when group is deployed to higher environment

judym598 — Wed, 25 Sep 2019 14:22:18 GMT

But the next sentence implies that once the it is in the same group - that group can be promoted to higher environments.

"so that permissions can be promoted to higher environments"

To me it seems as though If I create ABC.Service (as a new Service Account) in each environment and add it to GroupXYZ in DEV, when I create a patch in DEV with this updated group and import it into TEST (where ABC.Service already exists) - GroupXYZ in TEST should include ABC.Service. I shouldn't have to manually add it to the group.

https://docs.appian.com/suite/help/19.3/Web_API_Authentication.html#

RE: New Service Account added to Security Group not included when group is deployed to higher environment

Mike Schmitt — Wed, 25 Sep 2019 14:15:33 GMT

[quote userid="2799" url="~/discussions/f/administration/17667/new-service-account-added-to-security-group-not-included-when-group-is-deployed-to-higher-environment"]Service accounts should be created in each environment with the same username and placed in the same groups[/quote]

Actually, this implies to me (without further clarification at least) that the service account *does* need to be manually placed into the appropriate group in each environment.