Custom Deprovisioning Form, Quicklink and Workflow

sjagirdar1580 · July 20, 2025, 10:58am

Which IIQ version are you inquiring about?

8.1,8.2

Please share any other relevant files that may be required (for example, logs).

accountDeprovisionWorkflow.xml (16.3 KB)
accountDeprovisionForm.xml (1.6 KB)
Account Deprovisioning.xml (1.0 KB)

Share all details about your problem, including any error messages you may have received.

I have a Form, QuickLink and Workflow. I have attached them. My problem statement is:
Deprovision User Account

I will like to have a Quicklink displayed under Manage Access
Name of the quick link should be Account Deprovisioning
Click on Account Deprovision to request the account that needs to be deprovisioned (A search box to query for account name)
On the form you should have Normal account disable button, Emergency account disable button, Temporary disable
All disabling process should require a reason (text box)
Once submitted normal account disable, then it should go through multiple approval process (Manager, Application Owner, Security Officer)
If there is a rejection, there should be a reason (text box)

I have worked on the forms and workflows. I had success executing the workflow, but without doing it from the form. Now, my problem is: when I click on the QuickLink it is asking me to select identities and once I select an identity it is just flashing the form for a moment and coming back to the ‘select identities’ page. I have no way to access and deprovision users from the form and eventually through the workflow. I am not even sure, if the workflow is doing what is needed in my problem statement.

Can someone help me debug.

I appreciate your kind help in this matter.

Regards,
Suresh

sjagirdar1580 · July 20, 2025, 11:11am

seems like I forgot to initialize the workflow variables.

sjagirdar1580 · July 20, 2025, 11:20am

Nope, despite initializing the workflow variables it is getting stuck at
http://xxx.xxx.x.xxx:8080/identityiq/lcm/chooseIdentities.jsf

appreciate your kind help in this matter.

sjagirdar1580 · July 20, 2025, 2:31pm

I re-worked on the form, quicklink and workflow. I wasn’t sure of how to put de-provision logic in the workflow and implement provisioning plan. in the attached files. I was able to put the plan and implement de-provisioning. However, the workflow is continuously executing without any response. Can you please help me as to where I am doing wrong.

Thanks,
Suresh
accountDeprovisionWorkflow.xml (19.2 KB)
Account Deprovisioning QuickLink.xml (1.6 KB)
Account Deprovision Form.xml (942 Bytes)

sjagirdar1580 · July 20, 2025, 2:41pm

@Arun-Kumar

can you please help me with my workflow? Please.

asharma65 · July 21, 2025, 6:05am

Hello @sjagirdar1580

After reviewing your issue regarding quicklink I think you need to check your form approval step in workflow confirm owner value should be correct one and not something like spadmin. Sample code for form step is given below:-

<Step name="Sample Network Access Request Form" posX="310" posY="9">
    <Approval name="Sample Network Access Request Form" owner="ref:launcher" return="identityModel" send="identityModel,identityDisplay">
      <Arg name="identityName"/>
      <Arg name="identityDisplay"/>
      <Arg name="workItemType" value="Form"/>
      <Arg name="workItemDescription" value="Network Access Request Form"/>
      <Arg name="workItemForm" value="Form-EmployeeAccessRequestForm"/>
      <Arg name="workItemFormBasePath" value="identityModel"/>
    </Approval>
    <Transition to="Update Identity Object" when="approved"/>
    <Transition to="Stop" when="!approved"/>
  </Step>

Let me know if it helps in finding solution

sjagirdar1580 · July 21, 2025, 7:12am

thank you for the response.

My actual requirement is as below:
lets forget about the previous workflow..it seems that in my case the lcm type of provisioning does not seem to work and I might actually be looking for a more simpler option.

Let me rephrase the requirement..

“Deprovision User Account”

I would like to have a Quicklink displayed under Manage Access
Name of the quick link should be Account Deprovisioning

when I click on Click on Account Deprovision QUicklink to request the account that needs to be deprovisioned (A search box to query for account name) should be displayed in the Form.

On the form I should have Normal account disable button, Emergency account disable button, Temporary disable button

All disabling process should require a reason (text box)

Once submitted normal account disable, then it should go through multiple approval process (Manager, Application Owner, Security Officer)

If there is a rejection, there should be a reason (text box)

else if approved by all parties Manager, Application Owner and security officer the identity should be disabled permanently for normal account disable, based on what is chosen in the form and emergency disable based on what is chosen in the form, and a temporary disable which should disable temporarily for 2 weeks once again based on what is chosen in the form.

Is it doable?

Please let me know!

Cheers,
Suresh

sjagirdar1580 · July 21, 2025, 7:40am

Ok. Here is my current config.
accountDeprovisionWorkflow.xml (5.3 KB)
accountDeprovisionForm_withButtons.xml (1.2 KB)
accountDeprovisionQuickLink.xml (785 Bytes)

When I launch the QuickLink attached it is not going to the Form attached. And Executing the Workflow Directly without any input.

Here is the Screenshot:-

The Workflow is executing as a success. But when I look at the workflow logs. This is what I have:

2025-07-21T00:28:30,700 ERROR http-nio-8080-exec-8 WorkflowLogger:166 - Prepare Deprovisioning Request: Cannot resolve identity. Aborting.
2025-07-21T00:28:30,771 ERROR http-nio-8080-exec-8 WorkflowLogger:166 - Provisioning failed for identity: null, null
java.lang.NullPointerException: null
	at sailpoint.api.Provisioner.execute(Provisioner.java:1643) ~[identityiq.jar:8.1 Build 8cbeb0e-20200220-143938]
	at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
	at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:?]
	at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]

Basically, this part of the Workflow Config is not receiving an identity to de-provisiong:
Prepare Deprovisioning Request: Cannot resolve identity. Aborting.
2025-07-21T00:28:30,771 ERROR http-nio-8080-exec-8 WorkflowLogger:166 - Provisioning failed for identity: null, null
java.lang.NullPointerException: null

I am not able to pass the identity through a form since, after clicking on the QuickLink the control is bypassing the form and executing the Workflow without picking up the identity which is what I am supposed to do. Can you help fix this issue! I am not an expert. Just a mid level developer.

Regards,
Suresh

sjagirdar1580 · July 21, 2025, 8:03am

Hi @asharma65,

the version of the workflow which you are referring to never worked. It kept on executing. May be you are right. What do you suggest the owner value to be other than spadmin?

Regards,
Suresh

sjagirdar1580 · July 21, 2025, 9:09am

This is how my workflow looks like..

I even made sure all the variables are initialized to dummy values to make sure the workflow executes. but I still get the same error in logs:
2025-07-21T02:00:27,044 ERROR http-nio-8080-exec-7 WorkflowLogger:166 - Provisioning failed for identity: null, null
java.lang.NullPointerException: null

This is the part of the code where it is failing:

<Step icon="Task" name="Deprovision Identity" posX="380" posY="10">
    <Script>
      <Source>
        <![CDATA[
          import sailpoint.api.Provisioner;
          import org.apache.commons.logging.Log;
          import org.apache.commons.logging.LogFactory;

          Log log = LogFactory.getLog("WorkflowLogger");

          try {
              Provisioner provisioner = new Provisioner(context);
              provisioner.execute(plan);
              log.info("Deprovisioning executed for identity: " + identityName);
          } catch (Exception e) {
              log.error("Provisioning failed for identity: " + identityName + ", " + e.getMessage(), e);
              provisioningFailed = true;
          }
        ]]>
      </Source>
    </Script>
    <Transition to="ProvisioningFailed" when="script:isTrue(provisioningFailed)"/>
    <Transition to="Completed" when="script:!isTrue(provisioningFailed)"/>
  </Step>

Can you please help debug.

thanks,
suresh