Approvers experiencing delay in actioning the approval request even after clicking multiple times the approve button

[vinnysail (vinod kumar maram)]

Which IIQ version are you inquiring about?

Version 8.3

Share all details related to your problem, including any error messages you may have received.

Recently the system was upgraded from v8.1 to v8.3 p3, after the upgrade the role approvers were complaining that the approve button does not work straight forward.
After clicking multiple times (more than 10 times) the complete approval screen comes and approvals are done. This behaviour is not seen in the earlier version.

Approver having more than 40 approval requests to complete. As there is no bulk approval button in approval screen, approver has to click multiple times which is creating a bad user experience.

Any suggestions on what could be the issue ?

[Remold (Remold Krol)]

It looks like after the approval an provisioning actions is taken place and this provisioning is now running the the foreground, while before the upgrade it was configured to run in the background.

What I would do is to copy the OOTB workflow and change provisioning to run in the background using the following steps (please first test this in a lower non-production environment as a wrongly configured workflow could produce a lazy-initialization error when running in the background):

• Copy workflow/Business process
  • Goto Setup->Business processes
  • Select “LCM Provisioning” Business Process
  • On the bottom right click “Save As”
  • Provide a new name for the Business Process like <customer abbreviation> - LCM Provisioning
• Change foreground to background provisioning
  • For the new Business process goto tab “Process Variables”
  • In section ‘Advanced Settings’ uncheck option ‘Run provisioning in the foreground’
  • Save the Business Process
• Use new Business process for Access Requests
  • Goto the gear → Lifecycle Manager
  • Goto tab Business Processes
  • Change request Access to use the newly created Business Process <customer abbreviation> - LCM Provisioning
  • Save

Test this new setting by requesting a Role and approve the request.

– Remold

[vinnysail (vinod kumar maram)]

Thanks @Remold for your reply.

Currently our system already has the customer LCM provisioning and also we have the option “Run provisioning in the foreground” unchecked.

[Remold (Remold Krol)]

Can you enable logging for the workflow? This might give an indication on what the (adjusted) ‘LCM Provisioning’-workflow is doing during the ‘Approve and Provisioning’-step.

Enable logging by adding the following lines to the log4j2.properties file:

logger.workflowtrace.name=sailpoint.WorkflowTrace
logger.workflowtrace.level=trace

For advanced logging take a look at the following presentation:

Error at Line 0: Advanced Logging for your IIQ Code

Presenters: @alexander_jakimowic Presentation: LoggingFramework_Pres_1_2.pptx (3,2 MB) Here you can find the code of the Framework (Java and RuleLibrary), The log4j2Admin.jsp page, and some admittedly rudimentary javadoc for the Java class. Please feel free to share any criticisms and suggestions for improvements you might have. LoggingFramework.zip (562,3 KB) [Developer Days 2023 - IdentityIQ, Error at Line 0: Advanced Logging for your IIQ Code]

– Remold

[vinnysail (vinod kumar maram)]

Sure will enable the logging and check it out. currently raised a case with Sailpoint support

[kjakubiak (Kamil Jakubiak)]

It’s known issue - Sailpoint is preparing fix for this topic @menno_pieters any details you could share?

[vinnysail (vinod kumar maram)]

Thanks @kjakubiak, will wait for @menno_pieters to confirm.

[menno_pieters]

Normally, the things that @Remold suggested apply, making the submitters’ and approvers’ experience smoother. In this case, if it is related to the upgrade to 8.3, it may indeed be a known issue.
Engineering is working on a fix that will make the plan compilation run faster. We’ve seen that larger requests for identities with already larger amounts of access may take a bit longer than expected. This affects multiple places of the request, approval and provisioning process as the plan is (re-)compiled several times.
If your situation is urgent, work with the CSM team and get the customer name added to SET-15328. There is a temporary, non-official fix that may be applied in the meantime.
UPDATE: The fix is included in the latest patches: https://community.sailpoint.com/t5/IdentityIQ-Server-Software/ct-p/IdentityIQ

[vinnysail (vinod kumar maram)]

Thanks @menno_pieters for the update. We have raised a case for the same. will let the case engineer know if they can add the customer’s name to SET-15328