Is it possible to send an approval work item to one owner, then add an additional owner after 24 hours?

IdentityIQ (IIQ) IIQ Discussion and Questions
, , ,
1

Which IIQ version are you inquiring about?

8.4p2

Please share any images or screenshots, if relevant.

-

Please share any other relevant files that may be required (for example, logs).

-

Share all details about your problem, including any error messages you may have received.

I have received an update request for the following:

Modify secondary approvals for a specific entitlement in the access request workflow (specifically in our modified Identity Request Approve workflow). The approval request should go to a specific owner. If this owner has not completed the approval after 24 hours, then the approval request should ALSO be sent to another owner. In this way, there should be 1 owner for the first 24 hours, and then 2 owners after 24 hours.

The first owner should be notified of the approval request only at the very beginning, and the second owner should be notified of the request when they receive it.

I have tried or considered the following so far:

  • I tried nested approvals where 2 approvals were nested with the setting of mode=“any”. I set the second secondary approval to use Thread.sleep() for a couple minutes. This caused the very first approval (before the secondary approvals), which I am not otherwise modifying, to stall in the “Saving” animation for the duration of the sleep. This makes sense because I put the sleep into the Interceptor script of the modified secondary approval.
    • Is there another script type (e.g. Validator script, which I do not believe would suit this purpose) which could make this work?
  • I inquired into the issue with AI. AI suggested I tried using “” elements within Step elements like so, . I dismissed this train of thought.
  • We are successfully using the Approval class object to assign an owner to these approval requests. I thought perhaps using the setStartTime() function with epoch time might cause the work item to delay being sent until the time was reached. Instead, the work item was sent out immediately. I then googled the function and learned that my intent did not match its purpose.
  • I am considering trying to use the escalation feature. I could send the first secondary approval request to the originally intended owner, coupled with a notification. I thought that perhaps I could escalate the approval request to both the originally intended owner and the new owner, resulting in two owners of this secondary approval. Is this possible?
    • I am also concerned that perhaps this would result in sending an escalation email to both owners, which I only want to send the email to the second owner. If it is possible to escalate the work item to two owners, would doing so also cause the escalation email to be sent to both owners? Is it possible to make the notification only notify the new owner?

I appreciate any and all assistance. Thank you for your time.

2

@michael_mcewan The preferred option is escalation rule and i think you can control the notification also.

here is good doc : IdentityIQ workItem reminders and escalation explained - Content / Community Blog - SailPoint Developer Community

Let me know if this works for you.

Thanks,

Pravin

3

I think you can go with Escalation rule here.

4

Thank you @pravin_ranjan for the recommendation. By happenstance, I already have that link bookmarked - I appreciate the insights of that post.

My solution: I did use an escalation rule. To fulfill my needs, my solution was:

  • I used a string value to set an identity as owner of the approval item.
  • I used the escalation rule to replace that owner with a workgroup which includes that first owner.
    • I also used the escalation rule to send an email to the new identity which also belongs to that workgroup.
  • The escalation was set to trigger in 24 hours from creation of the work item.
  • The escalation was set up to not send out any notifications (I did not provide the escalation with an email template).
    • I did not want to send a follow-up email to the original owner.
5

@michael_mcewan Is this a generic configuration for all entitlements where you’ll map it to same identity and route it to the same workgroup? If no, how are you planning to achieve this for other apps and entitlements?

6

@neel193 This solution was designed to handle provisioning approval for 1 entitlement. Only 2 individuals are involved in this particular ownership handling.

My needs don’t involve making this work for other apps and entitlements. But I can speculate how I would go about it for entitlements:

  1. When it comes to delegating the work to a single individual, I would need a method to determine who is appropriate to delegate the work item to. This individual would belong to the workgroup which owns the entitlements. A few ideas come to mind, including
    1. a map saved to a custom object,
    2. a database table mapping entitlement to owner, and
      1. this owner would be a member of the workgroup which has the iiq-standard ownership of the entitlement
    3. a custom process (rule, java function, etc) which delegates ownership to the highest position among the workgroup. This is predictable but may not be consistent to stakeholder preferences.
  2. Escalation to the owning workgroup would go the same as the current solution.
  3. The email sent from the escalation rule would go to all members excluding the original owner.
7

@michael_mcewan Understood. However, even with your particular entitlement, when you have additional entitlements or role in the same request, your rule become complex to implement this.

You can also consider reviewing SSF where Sailpoint provided a enhanced approval artefacts where you can have more control at the entitlements or at app level. In their words: “Approvals – A single subprocess and set of configuration options that dynamically and iteratively processes approval types required for a given use case”