How to remove the requestor from being an approver if the requestor is in the owner workgroup

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Hello,

I am trying to determine how best to prevent the requestor from approving his/hers own access requests if he/she is in the workgroup for a particular role. I would think the answer would be to create a new managed attribute and use that as a flag to remove the identity from the workgroup when the approvals are determined. It appears though that a workgroup is being treated as a identity for approvals so I am struggling to see how I can remove an approver from the list of approvers as the lcm workflow seems to just hand the workgroup name off for approvals rather then looping through the workgroup to determine approvals. Any help is appreciated!

2

Hi @chaynes2434 - you wouldn’t want to remove the user from the workgroup given that workgroup could have other functions within IIQ, and you’d be stripping that user of certain functionality.

Instead, I would recommend using a ValidationScript within the Provisioning Approval Subprocess to validate the approver of the work item is not the target user.

I’d refer to this post for an example: https://community.sailpoint.com/t5/IdentityIQ-Forum/Identity-Can-Approve-Own-Request-if-in-Approval-Workgroup/m-p/187831#M148720

FYI, you are correct that workgroups are identity objects. This is useful when setting owners of roles/entitlements/applications so you can use workgroups instead of sole identities.

Hope this helps!

This post was answered by a Palyrian Solutions Architect. Feel free to message me directly if your problem requires a deeper dive.
:globe_with_meridians: palyrian.com | :telephone_receiver: ‪(301) 284-8124‬

1 Like
3

Hi Christian,

We have the same requirement, where a requestor if he/she is part of the workgroup as part of approval they should not be able to approve it. We can’t remove the approver from the workgroup, as again adding them will be task.

We have achieved it using a validation script and the provisioning and subprocess workflow, where it will validate , if the requestor is also part of the approval workgroup, they will get an error, if they tries to approve the request. Please use the below solution, it works fine, add the below validation script.

<ValidationScript>
  <Source>
    			import org.apache.commons.logging.Log;
					import org.apache.commons.logging.LogFactory;
	
					import sailpoint.tools.GeneralException;
          
					String completer = item.getCompleter();
					Identity wiRequestor = item.getRequester();	
         	log.error("completed and requester" + completer + wiRequestor );		
					try {
			
					Identity requesteeId = context.getObjectByName(Identity.class, identityName);
		    	if (null != requesteeId @and null != completer @and null != wiRequestor) {		
		        if (completer.equalsIgnoreCase(requesteeId.getDisplayName())) {
		            return " Self approval is not allowed";
		        	}
		    		}		
					} catch (Exception e) {
		    	log.error("Error Validation Script.." + e.getMessage());
					}				
				
      </Source>
      </ValidationScript>