Approval hanging in the Provisioning stage

We have a user access request that was approved by the governance group, but appears to have gotten hung in the provisioning phase:

Access has not been provisioned to the requested app for any of the users and when the requestor attempts to cancel the request he gets the following error:
“Trace ID: 5191e831bab74ea092b7986870d0415d
Details:
An error occurred. If you are unable to continue your work, please contact SailPoint support.
An internal fault occurred.”

Not understanding what would cause approval to hang like this?

Haver you tried adding the traceid to search and see what events come back

Hey @jared-fox,

There can be certain corner scenarios wherein the provisioning might be stuck. I might not be able to help out in identifying for which reason it has been stuck.

But to close the request you can try this API request here: close-access-request | SailPoint Developer Community

Marking the following items:
executionStatus as Terminated
completionStatus as Failure

Additionally have you checked the AccountRequest page and check what’s being sent in the plan?

Regards,
Aman

It didn’t return anything.

Thanks Aman, that’s really helpful. For the time being we have manually provisioned the access. Still trying to figure out why it is hanging.
I assume I can use this API call to cancel them and have the requestor repeat the request?

Yes, and I think there been a recent update wherein an admin now has the capability to govern the access requests initiated from Request Center.

For the request being stuck at provisioning tab I think you have to first begin with the connector type and if there are any rules involved and additionally monitor the logs on the VA.

Regards,
Aman

how did you search for it?

if the trace id is valid you should get associated events

Thank you Aman. I’m gonna test out using that new feature.

I just copied and pasted “5191e831bab74ea092b7986870d0415d” into search. I tried it with and without quotations. I’m looking at wuery documentation but not seeing anything for trace ids.

you might find it as ‘tracking id’, you can also give these to sailpoint via support request and they may be able to look it up.

I tried traceid, trace.id, and a few other things, but got nothing. I’ll try tracking id. I did put in a ticket, because it’s been causing some issues. Thanks for the advice.

Hey Aman,
I seem to have missed this when I initially replied. Can you tell me what exactly you mean by AccountRequest page? We had the user show us his pending request, that’s where I got the screen shot from. Is there somewhere else I should look?

Hey Jared,

We can check the AccountActivity within the search tab for the affected user and check if there was a plan generated (AccountRequest) for them. That info might help us out in determining what might have happened.

Regards,
Aman