Employee Self certification multiple level access review

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

8.4P2

Share all details about your problem, including any error messages you may have received.

We have a requirement for an event-based employee transfer certification.

The process should allow the employee to perform self-certification before manager.

If the employee rejects an access, it should be automatically removed without any manager review. If the employee approves the access, it should then be routed to the manager for a second-level review.

Currently, a pre-delegation rule is configured so that all access reviews are initially delegated to the employee. However, regardless of whether the employee approves or rejects the access, the items are being routed to the manager for review. I need to adjust this behavior so that manager review only occurs when the employee has approved the access.

Any guidance or best practices on how to configure this flow would be appreciated

Thanks in Advance!

Swetha.

2

Hi @Swetha_kaipa ,

This is the expected behaviour of pre delegation rule irrespective of decisions it is always forward to manager for final sign off

So I recommend to use signoff approval instead of pre delegation rule

sign off approval rule logic will

boolean hasApprovedItems = false;

for (CertificationItem item : certification.getItems()) {
if (item.isApproved()) {
hasApprovedItems = true;
break;
}
}

if (hasApprovedItems) {

return identity.getManager();

}

return null;

Thanks in advance

Avinash Mulpuru

3

Hi @Swetha_kaipa

you cb use multi-level sign-off instead:

Make the employee the actual reviewer (reassignment, not delegation

  • In your Pre-Delegation rule, set reassign = true and set the recipient to the certifiee (employee).
  • That makes the employee the owner of the review decisions.
  • Add a Sign-Off Approver Rule that routes to the manager only if anything was approved
  • If the employee revoked everything (or there are no approved items), return null → no manager step.
  • Then remediation runs based on the employee’s revoke decisions.

Sign-Off Approver Rule logic (simple):

  • if any item is Approved → return employee’s manager

  • else → return null

That gives you:

  • Employee rejects → goes straight to remediation (no manager review)

  • Employee approves → manager gets a second-level sign-off (review of the certification decisions)

If you also need the manager to re-review each approved line item (not just sign-off), that’s a different requirement and typically means two separate certifications (employee campaign first, then manager campaign filtered to approved items) or a custom workflow.

4

Thank you for your quick responses avinashmulpur and @amrdodani . I will try this sign-off approve rule approach.

5

Hello, is this approach working? I’m currently looking into the same approach. Could you please respond to this message?

6

@amrdodani how to make employee actual reviewer?

7

Hi, this approach quite didnt workout for our requirement.

8

@Swetha_kaipa By default user’s can’t certify their own access. Buttons will be greyed out. However in your case, where you want o users to certify themselves and then move the items to Manager review., you need to make following changes (I have done it in Target Certification):

  1. In the Advanced Options under Choose Certifier section, set Allow self certification for to “All Certifiers”. Doing this user’s can approve/revoke their own access.
  2. Write a certifier rule, where you need to return the entity target id as the certifier. Sample Code:
if(entity!=null)
return entity.getTargetName();

return “spadmin”;
  1. Then you need to write a sign off rule to move the items to the certifier’s manager. Sample Code:
log.error(“certification::”+certification.toXml());

List history = certification.getSignOffHistory();
log.error(“history::”+history);

if (history == null || history.isEmpty()){
return null;
}
else if (history.size()==1){
String userName = certifier.getName();
log.error(“certifier name::”+userName);
Identity identity = context.getObjectByName(Identity.class, userName).getManager();
log.error(“identity::”+identity);

if (identity != null) {
  log.error("identity name::"+identity.getName());
  Map results = new HashMap();
  results.put("identity", identity);
  log.error("results::"+results);
  return results;
} else {
  return null;
}

}
return null;

Please review these samples and add additional conditions based on your usecase, like only approve items should go to the next reviewer. You already have certiication object available in the rule, using which you can validate if decision is approved or revoked.

Note: Found a fix? Help the community by marking the comment as solution. Feel free to react(:heart:, :+1:, etc.) with an emoji to show your appreciation or message me directly if your problem requires a deeper dive.