Generic Workflow to Auto-Approve/Reject an access request

Bassem_Mohamed · August 29, 2023, 2:50pm

This workflow will auto-Approve/reject an access request based on some access request attributes. In situations where the access request doesn’t meet the workflow use-case, the request will be kept assigned to the individual for approval.

Why did we build this workflow?

We wanted a way to show automated governance, which is possible with SailPoint workflows and APIs.

In reality, some requests should be automatically approved based on some access request attributes like requester, requestFor, approver or accessItem. This workflow also allows the approvers to focus on the higher risk requests and not be burdened by the low-risk or pre-define approved requests.

What is the high-level design?

This solution is implemented as a workflow process: The workflow’s trigger is Scheduled Trigger (runs automatically based on CRON setting).

The workflow runs on an hourly schedule. It retrieves all pending approvals in the IdentityNow tenant, and then loops over the ones as per the defined condition in the loop node. The loop simply calls the Approve Access Request node, passing details of the request approval id, then approves it and with a comment.

Be aware of Workflow Limitations

As of August '23, a workflow loop only supports 100-items.
- If you had > 100 pending approvals, some won’t be processed when the workflow runs. This isn’t an issue in demos, but something to remember.
As of August '23, the fastest a scheduled workflow can run every 1-hours.
- In production, this could factor into the #-pending approvals, which could accumulate > 100
- In demos, you can either update the CRON statement (in the Scheduled Trigger of the master workflow) so it runs at about the right time in your demo, or you can run it manually in test mode after creating the access requests.
Visibility into the loop/executions isn’t great.

Deploying Instructions

Note: Deploy on your sandbox tenant first, then perform all the testing and validate all the sandbox testing results before moving the workflow to the production.

Download the Workflow json files (see below)
Log into IdentityNow with Admin rights and create a Personal Access Token (PAT). In the PAT, assign the scope sp-scopes-all. This client ID/secret pair will be needed for all API calls in the child workflow.
Upload the Workflow json files into your IdentityNow tenant
Edit the workflow in the Workflow Builder
Update the schedule trigger with a proper Cron value as per the business need
Change the HTTPRequest API URLs for the API calls to refer to your IdentityNow tenant
Change the Client ID/Secret values (for the API calls) to use your PAT token.
Update the loop list filter with the object.id and its value:
1. Objects can be:
1. requester.ID
2. requestFor.id
3. owner.id
4. requestObject.id
  
  image1076×958 94.7 KB
Update the Compare String node with the loop input object and its value as in the previous step
Enable the workflow

Test Steps

Generate a Test Execution for the workflow.
Edit the workflow (select the workflow name and then press [Edit in Builder])
On the workflow details page, press [Test Workflow]
In the Workflow Test Input text area, replace the default text with the following text:
{}
Verify the results
Check the status of requests items for auto-approved and the comment.

Screen shots from the approved request in IdentityNow:

Here are the workflow definition file : “Access Requests Auto-Approve/Reject Workflow"
Access Requests Auto-approval Workflow.json (2.5 KB)

kaveh_ahmadian · September 5, 2023, 12:45pm

Great content @Bassem_Mohamed thank you for sharing!

johnpaul_tran · October 27, 2023, 1:34pm

Can this workflow be used to auto-reject access request older than 60 days?

Bassem_Mohamed · October 31, 2023, 12:18am

Hi @johnpaul_tran,
yes, you can use the same workflow just need to change the loop input to
$.hTTPRequest.body to get all the pending access requests and replace the compare string with compare date to compare the request creation $.loop.loopInput.requestCreated with Is Before X days ago where x = 90 days

Please, keep in mind the workflows loop limitations.

dongrenfei · December 7, 2023, 1:14am

Great content @Bassem_Mohamed, I have enabled this workflow in our SandBox and how to know if the workflow running or not? I have setup scheduled time but it seems nothing happen at scheduled time.

Bassem_Mohamed · December 7, 2023, 1:14pm

Hi @dongrenfei, you can go to admin → Workflows then Click on the workflow and go to Executions tab, there you can check if the workflow was executed successfully or failed, Also you can download a report with the workflow processing

Please, let me know if it’s not clear.

harishhaleon · February 16, 2024, 4:55am

@Bassem_Mohamed - Is it possible to use requiredComment in a compare string. I have updated above code but it’s not entering into Loop.

{
“name”: “Auto-approved Requests testing”,
“description”: “Testing Auto-Approve WF”,
“modified”: “2024-02-15T15:40:24.783849721Z”,
“modifiedBy”: {
“type”: “IDENTITY”,
“id”: “495aa92b91xxxxxxxxxxxxxxxxxxxx”,
“name”: “hxxxxxxx”
},
“definition”: {
“start”: “HTTP Request”,
“steps”: {
“End Step — Success”: {
“type”: “success”
},
“HTTP Request”: {
“actionId”: “sp:http”,
“attributes”: {
“authenticationType”: “OAuth”,
“jsonRequestBody”: {
“input”: “{{$.loop.loopInput}}”
},
“method”: “get”,
“oAuthClientId”: “f6exxxxxxxxxxxxxxxxxxxxxxxxx”,
“oAuthClientSecret”: “$.secrets.d571f33xxxxxxxxxxxxxxxxxxxxx”,
“oAuthCredentialLocation”: “oAuthInHeader”,
“oAuthScope”: null,
“oAuthTokenUrl”: “https://coxxxxx-dev.api.identitynow.com/oauth/token”,
“requestContentType”: “json”,
“requestHeaders”: {
“Accept”: “application/json”
},
“url”: “https://coxxxxx-dev.api.identitynow.com/v3/access-request-approvals/pending”
},
“nextStep”: “Loop”,
“type”: “action”,
“versionNumber”: 2
},
“Loop”: {
“actionId”: “spiterator”,
“attributes”: {
“input.$”: “$.hTTPRequest.body[?(@.requesterComment == “Request submitted by the Role Access Management Tool”)]”,
“start”: “Compare Strings”,
“steps”: {
“Approve Access Request”: {
“actionId”: “sp:approve-request”,
“attributes”: {
“approvalId.$”: “$.loop.loopInput.id”,
“comment”: “Auto-Approved by the Workflow”
},
“nextStep”: “End Step — Success 1”,
“type”: “action”,
“versionNumber”: 1
},
“Compare Strings”: {
“choiceList”: [
{
“comparator”: “StringEquals”,
“nextStep”: “Approve Access Request”,
“variableA.$”: “$.loop.loopInput.requesterComment”,
“variableB”: “Request submitted by the Role Access Management Tool”
}
],
“defaultStep”: “End Step — Success 2”,
“type”: “choice”
},
“End Step — Success 1”: {
“type”: “success”
},
“End Step — Success 2”: {
“type”: “success”
}
}
},
“description”: null,
“nextStep”: “End Step — Success”,
“type”: “action”,
“versionNumber”: 1
}
}
},
“creator”: {
“type”: “IDENTITY”,
“id”: “495aaxxxxxxxxxxxxxxxxxxxx”,
“name”: “hgxxxxx”
},
“trigger”: {
“type”: “SCHEDULED”,
“attributes”: {
“cronString”: “10 21 * * *”,
“frequency”: “cronSchedule”,
“timeZone”: “Asia/Calcutta”
}
}
}

Thanks,
Harish G

DeepanshuBisht · February 16, 2024, 5:35am

Great Content.
Thanks for sharing @Bassem_Mohamed

Bassem_Mohamed · February 16, 2024, 12:42pm

Hi @harishhaleon, I think you json filter is not correct, Can you please try this json filter?

$.hTTPRequest.body.requesterComment[?(@.comment == “Request submitted by the Role Access Management Tool”)]

baoussounda · February 17, 2024, 9:16am

Thanks @Bassem_Mohamed for sharing. We a similar use case and we want to auto approve the manual sources provisioning tasks.

harishhaleon · February 19, 2024, 5:44am

Yes, It worked. Thank you!

vambrale · February 19, 2024, 5:47am

This is very useful content.
Great Work

abills · September 18, 2024, 9:27pm

@Bassem_Mohamed is it possible to have 2 approve access requests in the same workflow? I ask because I am trying to have it approve a request and then request another role and have it approve that role all within the same workflow

Bassem_Mohamed · September 19, 2024, 11:42am

Hi @abills, This is a schedule workflow, it means the workflow runs in defined time, then it check the current active approval items that match the workflow criteria, it loops on these items and approve them.
So, if I understood your question correctly, the two requests won’t be approved in the same workflow. As when the first request got approved, the second request will be raised and it should wait for the next scheduled workflow to get approved. Please let me know if I’m missing something.

abills · September 20, 2024, 1:41pm

@Bassem_Mohamed that answers my question thank you!

Topic		Replies	Views
Governance group approval ISC Discussion and Questions identity-security-cloud , access-requests	2	1034	July 19, 2023
Access Request Auto Approvals and Multi Approvals ISC Discussion and Questions identity-security-cloud , access-requests	2	1066	July 19, 2023
Workflow - Auto Deny/Reject Access Request based on a Condition ISC Discussion and Questions workflows , identity-security-cloud	5	170	August 18, 2024
Automatic Approvals for Roles? IIQ IIQ Discussion and Questions identityiq , provisioning	5	52	October 1, 2024
Access Request Process sends approval to the wrong identity Bugs identity-security-cloud , access-requests	0	558	August 28, 2023