ApprovalItems in manual workitem

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

8.4

Please share any images or screenshots, if relevant.

[Please insert images here, otherwise delete this section]

Please share any other relevant files that may be required (for example, logs).

[Please insert files here, otherwise delete this section]

Share all details about your problem, including any error messages you may have received.

Hi All,

I am using LCM workflow to create manual workitem after getting all the necessary approvals. I am seeing a differnece in the approval items which is getting generated for approvals and manual workitems.

For approvals,

 <entry key="approvalSet">
        <value>
          <ApprovalSet>
            <ApprovalItem application="XXXXXX" assignmentId="*************" displayValue="Some_Access_1" id="***********" name="ROLES" operation="Add" value="ROLE_Some_Role_1">
              <Attributes>
                <Map>
                  <entry key="attachmentConfigList"/>
                  <entry key="attachments"/>
                  <entry key="flow" value="AccessRequest"/>
                  <entry key="id" value="**********"/>
                  <entry key="interface" value="LCM"/>
                  <entry key="operation" value="EntitlementAdd"/>
                </Map>
              </Attributes>
            </ApprovalItem>
            <ApprovalItem application="XXXXXX" assignmentId="*************" displayValue="Some_Access_2" id="***********" name="ROLES" operation="Add" value="ROLE_Some_Role_2">
              <Attributes>
                <Map>
                  <entry key="attachmentConfigList"/>
                  <entry key="attachments"/>
                  <entry key="flow" value="AccessRequest"/>
                  <entry key="id" value="**********"/>
                  <entry key="interface" value="LCM"/>
                  <entry key="operation" value="EntitlementAdd"/>
                </Map>
              </Attributes>
            </ApprovalItem>
          </ApprovalSet>
        </value>
      </entry>

Where in, post approval, below is the approvalset for the manual workitem

<entry key="approvalSet">
        <value>
          <ApprovalSet>
            <ApprovalItem application="RMD Snowflake - Data Access Role" id="*********" operation="Create">
              <value>
                <List>
                  <String>ROLES = 'ROLE_Some_Role_1'</String>
                  <String>ROLES = 'ROLE_Some_Role_2'</String>
                </List>
              </value>
            </ApprovalItem>
          </ApprovalSet>
        </value>
      </entry>

This is only happening, if the user doesn’t have an application account (link). For other scenarioes it’s working fine.

Because of this the identityRequest is not moving to provisioning state after adding the details in the csv and running the aggregation.
The PIMT task is chaging the state to “Failed”.

Any lead will be really helpful.

Thanks,
Soumyakant

2

Hi @soswain_resmed ,

if you see the workitem configuration , for Approval workitem and for Manual Workitem the workitem type is different thats why there is a change in format . but there should not be any issue with that .

do you have optimistic provisioning enabled , if it is , after the approval there will be link attached to the user . verify that how it is looking like . also verify application schema that you marked ent attribute multi valued or not .

After that verify the resource object which is coming after aggregation . Data should be same.

3

Hi @harsh_gupta4 ,

Thank you for your response.

I have checked the items mentioned by you. Optimistic provisioning is true, yet the link is not getting create after I close the manual workitem.

The IdentityRequest moves to verifying state, but the requestItems are in “waiting“ state.

The entitlement attribute is marked as multi valued and all the values are populating correctly. The value of the ApprovalItem shows as “ROLES = ‘ROLE_Some_Role_1’“ where ROLES is the entitlement attribute type and “ROLE_Some_Role_1“ is the attribute value.

Note: This is only happening for the create operation.

For modify operation, it is like below and the IdentityrequestItem moves to “Provisioning“ state as soon as I close the manual work item.

 <ApprovalSummary completer="spadmin" endDate="1758869994962" owner="11111" request="Manual Changes requested for User: XXXXXX" startDate="" state="Finished" workItemId="*********" workItemType="ManualAction">
              <ApprovalSet>
                <ApprovalItem application="XXXXXX" id="******" name="ROLES" nativeIdentity="XXXX@MAIL.com" operation="Add" requesterComments="test" state="Finished" value="ROLE_Some_Role_1">
                  <Attributes>
                    <Map>
                      <entry key="attachmentConfigList"/>
                      <entry key="attachments"/>
                      <entry key="flow" value="AccessRequest"/>
                      <entry key="id" value="************"/>
                      <entry key="interface" value="LCM"/>
                      <entry key="op" value="Add"/>
                      <entry key="operation" value="EntitlementAdd"/>
                      <entry key="provisioningTransactionId" value="*********"/>
                      <entry key="requester" value="222222"/>
                    </Map>
                  </Attributes>
                </ApprovalItem>
              </ApprovalSet>
            </ApprovalSummary>