How to update the manager approval form during access request

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

We have updated the access request where the additional info needed form is letting user select additional entitlements.

We need to show these entitlements during the manager approval

Currently it only shows the initial role selected by the requester

Where all do I need to make the changes so that the manager can see the entitlements selected by the requester in the form

Thanks

image
image1876×471 26.1 KB

2

Heello Manisha,

The additional entitlements the requester picks on the form get stored with the ProvisioningProject, but the manager’s approval page only shows what’s in the approvalSet. IIQ doesn’t automatically surface those form answers to the approver.

To fix this, I would work with a copy of the Provisioning Approval Subprocess (don’t edit the OOTB one). After the provisioning form step completes, read the selected values from the project into a workflow variable and include that variable in the Approval step’s send list. Then attach a read-only Form object to display them:

<Arg name="workItemForm" value="Manager Access Details"/>
<Arg name="workItemType" value="Approval"/>

Create that “Manager Access Details” as a standalone Form object with readOnly="true" in its attributes. The fields in it should pull from the workflow variable you passed via send. This gives the manager a “View Form” button showing exactly what the requester selected. The send attribute is what copies your workflow variables into the work item, and workItemForm tells IIQ which Form to render. (Approval Steps, Form Components)

If the manager also needs to approve or reject each entitlement as a separate line item (not just view them), you would need to add those selections as ApprovalItems to the approvalSet before the approval step. The read-only form approach is just for visibility.

3

Hi @guptaMani ,

Kindly take “LCM Create and Update” workflow as reference.

Once the form added, you need to pass the variables in “send” of Approval step in “Provisioning Approval Subprocess” as suggeted by @punna0001

Thank you

Harikrishna

4

Hi @punna0001 , thanks for the detailed explanation.

So from what you said, I understand

  1. Create a new workflow variable for example, areas (those are the entitlements I am fetching, note that it will be a list of areas)
  2. Once the provisioning form completes, fetch the areas list from the provisioningProject object and add them to the new workflow variable areas
  3. Create a workflow form called Manager Access Details (I need your help here to see how this form look like)
  4. Attach the two arguments in the approval step <Arg name="workItemForm" value="Manager Access Details"/>
    <Arg name="workItemType" value="Approval"/>
  5. Add the workflow variable areas to “send” in the approval step

Does this look correct and if you can please share the form

Thanks again

5

Hi @Harikrishna_06, thanks for taking time to answer my question

Can you please help me which field should I look for reference in the “LCM Create and Update” workflow

Thanks

6

Hello Manisha. Yes, that flow looks correct. After the provisioning form is submitted, the Assimilate Provisioning Form step stores the completed form answers with the provisioning questions in the ProvisioningProject. You can read the areas answer after that step and place it in a workflow variable.

Since areas is a List, I would keep it for provisioning and create another string variable like areasDisplay. Join the selected values into readable text and pass areasDisplay to the approval form. The standalone Form object can be:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE Form PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Form name="Manager Access Details">
  <Attributes>
    <Map>
      <entry key="pageTitle" value="Additional Access Details"/>
      <entry key="readOnly" value="true"/>
    </Map>
  </Attributes>

  <Section name="requesterSelections"
           label="Selections made by requester">
    <Field name="areasDisplay"
           displayName="Areas"
           type="string"
           value="ref:areasDisplay"/>
  </Section>
</Form>

Import it as a standalone Form object through Debug Pages. In the existing Approval step, append areasDisplay to the current send list and add:

<Arg name="workItemForm" value="Manager Access Details"/>
<Arg name="workItemType" value="Approval"/>

Don’t replace the variables already present in send, just add areasDisplay. Also check whether workItemType is already configured before adding it again.

For reference, look at the Assimilate Provisioning Form step in the Do Provisioning Forms subprocess for how the answers are stored, and the Approval step in the Provisioning Approval Subprocess for the send and workItemForm pattern. (Approval Steps, Processing Provisioning Requests)

This should make the selected areas available to the manager through the form attached to the approval work item. The exact BeanShell for retrieving areas depends on how that field appears in your provisioning policy and project.

7

Thanks @punna0001

I am able to see the areas in the manager approval

One issue I see is, I am getting the form with no areas for the requests where there wasn’t any additional information needed pop-up form was added as I am pulling the areas from what the requestor has selected. In this case, it should not have the view form available to the approver

image
image1888×514 31 KB

<Step icon="Approval" name="Approval" posX="158" posY="22">
    <Approval mode="ref:approvalMode" owner="call:buildCommonApprovals" renderer="lcmWorkItemRenderer.xhtml" send="identityDisplayName,identityName,approvalSet,flow,policyViolations,identityRequestId,areasDisplay">
      
      <Arg name="areasDisplay">
        <Script>
          <Source>

          import java.util.List;
          import java.util.ArrayList;
          import java.util.Iterator;
          import sailpoint.tools.Util;
          
          StringBuilder sb = new StringBuilder();
          
          for(ExpansionItem item : project.getExpansionItems()) {
            if(null != item.getName() @and "areas".equals(item.getName())) {
              sb.append(item.getValue() + " ");
            }

          }
          workflow.put("areasDisplay", sb);
          wfcontext.getWorkflowCase().put("areasDisplay", sb);
          

          return sb.toString();
          
        	</Source>
        </Script>
      </Arg>
    </Approval>
    <Transition to="Process Approval Decisions" when="script:(step.getApproval() != null &amp;&amp; step.getApproval().containsApprovalItems())"/>
	<Transition to="end"/>
  </Step>

How do I make sure areas are only available for use-cases where we have additional information needed pop-up form available

Thanks

8

Hello Manisha. The empty View Form appears because workItemForm is currently attached to every approval, even when no areas were collected. I would suggest calculating areasDisplay in a separate step before the Approval and attaching the form only when that variable has a value.

Make sure the variable is declared once at the workflow level (if it is not already there):

<Variable name="areasDisplay"/>

Then add this step before Approval:

<Step name="Prepare Areas for Approval"
      resultVariable="areasDisplay">
  <Script>
    <Source>
      import java.util.Collection;

      StringBuilder sb = new StringBuilder();

      if (project != null &amp;&amp;
          project.getExpansionItems() != null) {

        for (ExpansionItem item : project.getExpansionItems()) {
          if (item == null ||
              !"areas".equals(item.getName()) ||
              item.getValue() == null) {
            continue;
          }

          Object value = item.getValue();

          if (value instanceof Collection) {
            for (Object area : (Collection) value) {
              if (area != null &amp;&amp;
                  area.toString().trim().length() > 0) {
                if (sb.length() > 0) {
                  sb.append(", ");
                }
                sb.append(area.toString().trim());
              }
            }
          } else {
            String area = value.toString().trim();

            if (area.length() > 0) {
              if (sb.length() > 0) {
                sb.append(", ");
              }
              sb.append(area);
            }
          }
        }
      }

      return sb.toString();
    </Source>
  </Script>

  <Transition to="Approval"/>
</Step>

Also update any existing transition that currently goes directly to Approval so it routes through this step first:

<Transition to="Prepare Areas for Approval"/>

Then make the form conditional in the Approval step:

<Approval
    mode="ref:approvalMode"
    owner="call:buildCommonApprovals"
    renderer="lcmWorkItemRenderer.xhtml"
    send="identityDisplayName,identityName,approvalSet,flow,policyViolations,identityRequestId,areasDisplay">

  <Arg name="workItemForm">
    <Script>
      <Source>
        if (areasDisplay != null &amp;&amp;
            areasDisplay.trim().length() > 0) {
          return "Manager Access Details";
        }

        return null;
      </Source>
    </Script>
  </Arg>

  <Arg name="workItemType" value="Approval"/>
</Approval>

Remove the existing static entry:

<Arg name="workItemForm" value="Manager Access Details"/>

When areas are found, IIQ will attach the Manager Access Details form. When no areas were collected, workItemForm returns null, so the approval should render without the empty View Form option.

You can also remove the workflow.put() and wfcontext.getWorkflowCase().put() calls from your current script. The resultVariable="areasDisplay" on the preparation step stores the returned value as the workflow variable. (Editing Workflow XML, Approval Steps)

I would suggest doing a quick test in your environment to confirm the View Form button behavior when workItemForm evaluates to null, since that specific rendering is not explicitly called out in the docs. It should work, but worth verifying once.