Hi,
I wanted to create a 2 level approval access request in which any access request for Active Directory Security group would be assigned a custom approval owner stored inside a custom object at second level after manager approval at first level. I have written this approvalAssignmentRule to satisfy the requirement.
The approvalMode is serial, approvalScheme is manager, owner, approvalSplitPoint is owner
However at the second level of approval is being skipped. I have attached the logs as a txt file due to character limitations
Upon looking at the trace, after manager approval the Approval Step ends. Could someone help?
import sailpoint.object.Workflow;
import sailpoint.object.Workflow.Approval;
import sailpoint.object.ApprovalSet;
import sailpoint.object.Identity;
import sailpoint.object.Application;
import sailpoint.object.ManagedAttribute;
import sailpoint.object.Custom;
import sailpoint.object.ApprovalItem;
import sailpoint.tools.GeneralException;
import sailpoint.object.Attributes;
import sailpoint.api.SailPointContext;
import sailpoint.object.IdentityItem;
import sailpoint.api.SailPointFactory;
import sailpoint.tools.xml.XMLObjectFactory;
import sailpoint.api.ObjectUtil;
import sailpoint.tools.Util;
public String getADSecurityGroupOwner(String adSecGroup) {
// Query the custom object by name "ADSecurityGroupsOwners"
String returnValue = null;
try {
Custom customObject = context.getObjectByName(Custom.class, "ADSecurityGroupsOwners");
// Fetch the owner name based on the AD security group name from the custom object
if (customObject != null) {
System.out.println("Initializing ADSecurityGroupsOwners");
Attributes customAttributes = customObject.getAttributes(); //null checks for custom attribues
String owner = (String) customAttributes.get(adSecGroup);
System.out.println("******************Custom Owner= " + owner);
if (owner != null) {
returnValue = owner;
}
}
}
catch (Exception e){
System.out.println("Exception Occured: " + e.getMessage());
e.printStackTrace();
}
return returnValue;
}
// Helper method to fetch the value from the custom object "ADSecurityGroupsOwners"
public String getADSecurityGroupId(String adGroupName) {
// Query the custom object by name "ADSecurityGroupsOwners"
String returnValue=null;
try {
Custom customObjectId = context.getObjectByName(Custom.class, "ADSecurityGroupID");
// Fetch the owner name based on the AD security group name from the custom object
if (customObjectId != null) {
System.out.println("Initializing ADSecurityGroupID");
Attributes customAttributesId = customObjectId.getAttributes();
String adGID = (String) customAttributesId.get(adGroupName);
System.out.println("******************adGID= " + adGID);
if (adGID != null) {
returnValue = adGID;
}
}
} catch (Exception e){
System.out.println("Exception Occured: " + e.getMessage());
e.printStackTrace();
}
return returnValue;
}
try {
Approval newApproval = new Approval();
List newApprovalList = new ArrayList();
ApprovalSet newSet1=new ApprovalSet();
ApprovalSet newSet2=new ApprovalSet();
newSet1=approvalSet.clone();
System.out.println("******************newSet1= " + newSet1.toXml());
// Validating approvalSet
if (newSet1!= null) {
// Fetch Approval Items from approvalSet
List<ApprovalItem> aItems = newSet1.getItems();
if (aItems != null){
// Iterating through ApprovalItems from approvalSet
for (ApprovalItem aItem : aItems) {
System.out.println("******************aItem = " + aItem.toXml());
if (aItem != null) {
// Fetch the application name of the ApprovalItem
String app1 = aItem.getApplicationName();
Application app = context.getObjectByName(Application.class, app1);
System.out.println("******************Application Name = " + app);
// if the application name is equal to AD perform the block
if (app1 != null && app1.equalsIgnoreCase("AD")) {
String adGroupName = aItem.getDisplayValue();
adGroupName=adGroupName.replace("\\","\\\\");
//System.out.println("******************ADGroup = " + adGroup1 + value);
String adGroupID = getADSecurityGroupId(adGroupName);
System.out.println("******************Printing GroupID = " + adGroupID);
ManagedAttribute adGroup = context.getObjectById(ManagedAttribute.class, adGroupID);
System.out.println("******************ADGroup = " + adGroup);
if (adGroup != null) {
String groupType = adGroup.getAttribute("GroupType");
System.out.println("******************ADGroup Type = " + groupType);
if (groupType != null) {
if (groupType.toLowerCase().contains("security")) {
String adSecGroup = adGroup.getDisplayName();
adSecGroup=adSecGroup.replace("\\","\\\\");
System.out.println("******************AD Group Display Name = " + adSecGroup);
String ownerName = getADSecurityGroupOwner(adSecGroup);
System.out.println("******************AD Group Custom Owner Name = " + ownerName);
if (ownerName != null){
System.out.println("******************ApprovalItem = " + aItem);
aItem.setOwner(ownerName);
System.out.println("******************ApprovalItemOwner = " + aItem.getOwner());
//removedapprovalset.add
newSet2.add(XMLObjectFactory.getInstance().clone(aItem, context));
} else {
System.out.println("****************** Custom object Owner*************** Custom object owner could not be resolved");
}
} else {
aItem.setOwner(adGroup.getOwner());
newSet2.add(XMLObjectFactory.getInstance().clone(aItem, context));
//removedapprovalset.add
}
}
}
} else if (app1 != null && app1.equalsIgnoreCase("healthds")){
aItem.setOwner(app.getOwner());
newSet2.add(XMLObjectFactory.getInstance().clone(aItem, context));
} else {
String aItemOwner = aItem.getOwner();
if (aItemOwner != null){
aItem.setOwner(aItemOwner);
newSet2.add(XMLObjectFactory.getInstance().clone(aItem, context));
} else {
aItem.setOwner(app.getOwner());
newSet2.add(XMLObjectFactory.getInstance().clone(aItem, context));
}
}
}
}
}
newApproval.setApprovalSet(newSet2);
System.out.println("****************** ApprovalSet NewSet2*************** " + newSet2.toXml());
System.out.println("****************** Approval*************** " + newApproval.toXml());
newApprovalList.add(newApproval);
System.out.println("****************** New Approval List*************** " + newApprovalList.size());
System.out.println("****************** New Approval List*************** " + newApprovalList);
return newApprovalList;
}
} catch (GeneralException e) {
// Handle the GeneralException (or any other exception) here
System.out.println("Error: " + e.getMessage());
e.printStackTrace();
}
Logs Attached as txt file here
Heimdall LCM Provisioning Trace.txt (247.2 KB)