Access Request Error

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

8.4 p1

Please share any images or screenshots, if relevant.

image
image1237×291 8.08 KB

image
image1863×520 27.4 KB

image
image1873×619 31.2 KB

image
image1858×626 25.7 KB

image
image1858×421 20.6 KB

Share all details about your problem, including any error messages you may have received.

Hi Community,

We are facing an issue with Access Request failures in SailPoint IdentityIQ.

The requested roles are being successfully assigned to the user account, but the Access Request status remains Incomplete, and we are seeing the following error:

“This request timed out waiting for verification of one or more items.”

Connector Type: Web Service Connector

Could anyone help us understand the possible cause of this issue or suggest how to resolve it?

Please refer to the attached images for more details.

Thanks in advance!

2

@satishbabu Please verify user_name properly set in user account, value mismatch can cause this verification issues.

3

This does not look like a provisioning failure if the role is actually getting assigned on the target system. The error is coming from the verification phase of the Access Request. After provisioning, IdentityIQ waits to verify that the requested access is visible on the user’s account/link in IIQ. If the entitlement or role is not reflected through aggregation/read-back before the timeout, the request remains Incomplete and throws the timeout message.

For a Web Service Connector, please check whether the granted role is returned correctly during account aggregation or account read. Also verify that the entitlement attribute in the application schema matches the attribute/value being provisioned and aggregated. Any mismatch in attribute name, value format, case sensitivity, or correlation can cause verification to fail.

4

The user_name value is the same in both the user account and the access request.

5

The attribute values and role data are matching correctly during aggregation, and the schema attributes are also the same on both sides

6

@satishbabu Could you please share your app xml and sample identity request which failed with this error? Also, you have referenced any form in provisioning policy, please share that too.

7

can you please share your identityrequest object xml and application xml please??

8
<?xml version='1.0' encoding='UTF-8'?> true Exists
9
<?xml version='1.0' encoding='UTF-8'?> true 0 50 200 0 50 200 1 10 200 0 50 200 0 50 200 0 50 200 0 50 200 0 50 200 0 50 200 0 50 200 true true role_id status_id true Modify true true Account Creation Enable Account 
            return identity.getFirstname()+"."+identity.getLastname();
          </Source>
        </Script>
      </AllowedValuesDefinition>
    </Field>
  </Section>
</Form>
<Form name="Unified_Dashboaed_Disable_Account" objectType="account" type="Disable">
  <Attributes>
    <Map>
      <entry key="pageTitle" value="Unified_Dashboaed_Disable_Account"/>
    </Map>
  </Attributes>
  <Description>Disable Account</Description>
  <Section name="User Details">
    <Field displayName="status_id" name="status_id" type="int" value="4"/>
    <Field displayName="UserName" name="user_name" type="string">
      <Script>
        <Source>return identity.getFirstname()+"."+identity.getLastname();</Source>
      </Script>
    </Field>
    <Field displayName="updatedBy" name="updatedBy" type="string" value="SailPoint"/>
  </Section>
</Form>
<Form name="company_Unified_Dashboard_Account_Update" objectType="account" type="Update">
  <Attributes>
    <Map>
      <entry key="pageTitle" value="company_Unified_Dashboard_Account_Update"/>
    </Map>
  </Attributes>
  <Section name="User Details">
    <Field displayName="email" name="email" type="string">
      <AllowedValuesDefinition>
        <Script>
          <Source>return identity.getEmail();</Source>
        </Script>
      </AllowedValuesDefinition>
    </Field>
    <Field displayName="UserName" name="user_name" type="string">
      <Script>
        <Source>return identity.getFirstname()+"."+identity.getLastname();</Source>
      </Script>
    </Field>
  </Section>
</Form>
user_id email phone status_id role_name role_id user_name is_trm_enabled created_at last_updated inviteLinkCreationTime lastChangedPasswordDate lastFailedLoginTime last_logged_in status_name created_by role_id role_name role_description
10

posted below please check.

11

This is a common issue when attribute request values do not match exactly to the Link value (casing, spelling, etc)

Please follow this doc to understand the flow for verifying identity requests. When this error occurs, IIQ is unable to verify 100% of your items by the time the request is verified. This is set based on the maxVerificationDays on the Perform Identity Request Maintenance Task.

Helpful post covering the same: https://community.sailpoint.com/t5/IdentityIQ-Forum/Getting-error-message-on-Access-Request-This-request-timed-out/m-p/31564

I would compare the attributes listed on your identity request via debug to the Link attributes to ensure they match 1 to 1 and are all present on the link.

12

can you please share the identity request object xml.

13

@satishbabu XMLs provided above is not clear. Could you please share it as attachment?

14

@neel193 i have shared the required data over the chat could you please check..

15

I think most probable reason for this issue is:

  1. You need to map the api response when creating and updating the user account in webservices connector.

  2. Add a get object operation in the webservices connector and make sure response mapping is mapped correctly

16

@satishbabu - Hi Sathish, I think this kind of request timed out waiting for verification of one or more items is a common and often frustrating issue particularly when provisioning through Web Services connectors.

I recommended few steps to troubleshoot and resolve this access request error,

  1. Verify API Response Mappings
  2. Implement and Validate the “Get Object” Operation
  3. Enable and Analyze Connector Debug Logs

logger.webservice.name = openconnector.connector.webservice
logger.webservice.level = debug
logger.webservice.additivity = false
logger.webservice.appenderRef.rolling.ref = stdout


logger.webserviceconn.name = openconnector.connector.webservice.WebServiceConnector
logger.webserviceconn.level = debug
logger.webserviceconn.additivity = false
logger.webserviceconn.appenderRef.rolling.ref = stdout
  1. Check maxVerificationDays - setting on the Perform Identity Request Maintenance Task

By addressing these points, you should able to find the issue and solve the error.

Regards,

Kannan

17

Hi @satishbabu ,

Did you add the Get Object connector operation in the web server? If you added this operation, ensure it returns all the application attribute values, and the schema attributes should match. If any of them mismatch, this issue might occur. If you have already added the Get Object check if all attributes are added to the response mapping and add them if they are missing. I hope this resolves your issue.

Thanks,

PVR.