Manual Task For Account Selection Generated After Access Request

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

I’m running into the same issue that was brought up in this thread. It does not seem that a solution was ever mentioned in that thread.

To quickly summarize: Role Requests are generating manual tasks that cannot be approved. Role Assignments using Define Assignment provision accounts as expected.

For some additional detail on my specific issue:

  • These Tasks are generating across multiple Sources. Here are two sources with this issue
    • Salesforce SaaS connector with no SSBPR or any other provisioning rules outside of a Create policy
    • JDBC Connector with no Before Provisioning rules

The feature for my Salesforce Saas Connector is here:

"features": [
    "PASSWORD",
    "DIRECT_PERMISSIONS",
    "AI_AGENT_AGGREGATION",
    "GROUP_PROVISIONING",
    "PROVISIONING",
    "ENABLE",
    "AUTHENTICATE",
    "MANAGER_LOOKUP",
    "SEARCH",
    "SYNC_PROVISIONING"
],

Here is the feature string for my JDBC Connector:

"features": [
    "UNLOCK",
    "PROVISIONING",
    "DISCOVER_SCHEMA",
    "GROUP_PROVISIONING",
    "DIRECT_PERMISSIONS",
    "SYNC_PROVISIONING",
    "ENABLE"
],

It is also worth noting that this is something that only happens when I request a role for an identity that does not already have an account on that source. If I utilize the “Define Assignment” feature, the Role will assign and an account will be provisioned as expected.

Some other potential variables here:

1 - We do have Service Now Service Catalog set up, although I do not believe that this should interfere

2 - Here is our Access Request Config

{
“approvalsMustBeExternal”: false,
“autoApprovalEnabled”: false,
“reauthorizationEnabled”: false,
“requestOnBehalfOfConfig”: {
“allowRequestOnBehalfOfAnyoneByAnyone”: true,
“allowRequestOnBehalfOfEmployeeByManager”: false
},
“approvalReminderAndEscalationConfig”: {
“daysUntilEscalation”: null,
“daysBetweenReminders”: null,
“maxReminders”: null,
“fallbackApproverRef”: null
},
“entitlementRequestConfig”: {
“allowEntitlementRequest”: false,
“requestCommentsRequired”: false,
“deniedCommentsRequired”: false,
“grantRequestApprovalSchemes”: null,
“revokeRequestApprovalSchemes”: null
},
“govGroupVisibilityEnabled”: false,
“fallbackAccessDurationInDays”: null
}

Pretty much grasping at straws here, as I can find basically no other articles or any other documentation on people who see this problem, so any help is appreciated.

2

What are the type of access items in the role? Entitlements or APs or combination of both? I have a feeling your create policy is causing this.

4

Oh that’s not an angle that I had considered.

As a general rule, our requestable business roles will be 1 Role that is requestable. That will contain at least 1 access profile, which can have 1 to many entitlements.

What about a Create Policy would cause this?

5

maybe the attribute on the create policy which would be mapped to name of the account is not being generated/selected during account creation.

just for testing, see how the account creation works when you have only entitlements in the role for the same source you have trouble with.

6

Ok, I have been testing primarily with single source roles here. For example:
Role: Salesforce Test, which contains only a “Salesforce Test” access profile.

I have attempted to have the Account ID and Account Name on the schema of my connectors to be set to “Id”, which is a Salesforce Generated value that our Create policy does not touch.

I have also attempted to have the Account Name be tied to “Username”, which is just the email on the Identity with a concatenated value at the end of it for the sake of cross-environment uniqueness in SailPoint. I’ll paste that create policy below.

    {
        "name": "Username",
        "transform": {
            "type": "static",
            "attributes": {
                "Email": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "type": "identityAttribute",
                                "attributes": {
                                    "name": "email"
                                }
                            },
                            {
                                "attributes": {
                                    "value": "none"
                                },
                                "type": "static"
                            }
                        ]
                    }
                },
                "value": "#if($Email != 'none')${Email}.qa#{else}#end"
            }
        },
        "attributes": {},
        "isRequired": true,
        "type": "string",
        "isMultiValued": false
    },

Thus far, I’m still generating these empty tasks

Screenshot 2025-12-11 at 7.35.02 AM
Screenshot 2025-12-11 at 7.35.02 AM659×848 10 KB

Screenshot 2025-12-11 at 7.34.59 AM
Screenshot 2025-12-11 at 7.34.59 AM1652×196 8.48 KB

7

add task id to this view. take that task id and use this API : {{baseUrl}}/work-items/:id

to get more info on what this task has. you should see form:{ then in this you should what the available selections are : "sections": [

lets review this data and take it from there.

8

Ok pasting the response below.

Attempting to parse this out myself, the main thing that jumps out at me is that all values in “Target Identity” are null. For reference, the identity that I am attempting to assign this role to is fully created, has all values populated, and has a few other Accounts on other sources.

{
    "id": "512d46730902437aa353422b1e40d87f",
    "requesterId": "35bff0ede9534b42a0eadabe4148e770",
    "requesterDisplayName": "Conor Lamb",
    "ownerId": "35bff0ede9534b42a0eadabe4148e770",
    "ownerName": "Conor Lamb",
    "created": "2025-12-11T14:30Z",
    "modified": "2025-12-11T14:30Z",
    "description": "Complete provisioning form for Greg salepointforce",
    "state": "Pending",
    "type": "Form",
    "remediationItems": [],
    "approvalItems": null,
    "name": null,
    "completed": null,
    "numItems": null,
    "form": {
        "id": null,
        "name": "Identity Update",
        "title": null,
        "subtitle": null,
        "sections": [
            {
                "label": null,
                "formItems": [
                    {
                        "displayName": null,
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "\n          Please supply initial values for account attributes in the forms below.\n        ",
                        "name": null
                    }
                ],
                "name": null
            },
            {
                "label": "Request Information",
                "formItems": [
                    {
                        "displayName": "Requester",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "ref:launcher",
                        "name": null
                    },
                    {
                        "displayName": "Requested Roles",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "ref:newRoles",
                        "name": null
                    }
                ],
                "name": null
            },
            {
                "label": "Target Identity",
                "formItems": [
                    {
                        "displayName": "Account ID",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "script:(identity != null) ? identity.getName() : null",
                        "name": null
                    },
                    {
                        "displayName": "First Name",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "script:(identity != null) ? identity.getFirstname() : null",
                        "name": null
                    },
                    {
                        "displayName": "Last Name",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "script:(identity != null) ? identity.getLastname() : null",
                        "name": null
                    },
                    {
                        "displayName": "Assigned Roles",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": null,
                        "name": null
                    }
                ],
                "name": null
            },
            {
                "label": "Salesforce QA [source]",
                "formItems": [
                    {
                        "displayName": null,
                        "displayType": null,
                        "required": true,
                        "allowedValuesList": null,
                        "value": null,
                        "name": "Salesforce QA [source]:UserType"
                    }
                ],
                "name": "Salesforce QA [source]"
            }
        ],
        "targetUser": "Conor Lamb"
    }
},
9

@ConorL11 : can you post your create policy here for salesforce connector you have configured. I am assuming you may have not configured what type of account needs to be created which is expected by the connector.

10

CreatePolicy.json (22.2 KB)

Chelsea,

I’ve attached my create policy to this message. Upon your suggestion, I took a look at the “UserType” field, which I previously did not have in my Create Policy. With this field not in the policy, I was able to create users by assigning them roles through the Assignment Criteria field. Salesforce would create them and auto assign them “Standard” in that UserType field.

After adjusting it, I’m still seeing the same issue with Requests creating that work item. Here’s the JSON snippet of the work item that was created:

{
    "id": "5a346223db224507b3589dee6b9c10d6",
    "requesterId": "35bff0ede9534b42a0eadabe4148e770",
    "requesterDisplayName": "Conor Lamb",
    "ownerId": "35bff0ede9534b42a0eadabe4148e770",
    "ownerName": "Conor Lamb",
    "created": "2025-12-12T14:22Z",
    "modified": "2025-12-12T14:22Z",
    "description": "Complete provisioning form for Greg salepointforce",
    "state": "Pending",
    "type": "Form",
    "remediationItems": [],
    "approvalItems": null,
    "name": null,
    "completed": null,
    "numItems": null,
    "form": {
        "id": null,
        "name": "Identity Update",
        "title": null,
        "subtitle": null,
        "sections": [
            {
                "label": null,
                "formItems": [
                    {
                        "displayName": null,
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "\n          Please supply initial values for account attributes in the forms below.\n        ",
                        "name": null
                    }
                ],
                "name": null
            },
            {
                "label": "Request Information",
                "formItems": [
                    {
                        "displayName": "Requester",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "ref:launcher",
                        "name": null
                    },
                    {
                        "displayName": "Requested Roles",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "ref:newRoles",
                        "name": null
                    }
                ],
                "name": null
            },
            {
                "label": "Target Identity",
                "formItems": [
                    {
                        "displayName": "Account ID",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "script:(identity != null) ? identity.getName() : null",
                        "name": null
                    },
                    {
                        "displayName": "First Name",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "script:(identity != null) ? identity.getFirstname() : null",
                        "name": null
                    },
                    {
                        "displayName": "Last Name",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "script:(identity != null) ? identity.getLastname() : null",
                        "name": null
                    },
                    {
                        "displayName": "Assigned Roles",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": null,
                        "name": null
                    }
                ],
                "name": null
            },
            {
                "label": "Salesforce QA [source]",
                "formItems": [
                    {
                        "displayName": null,
                        "displayType": null,
                        "required": true,
                        "allowedValuesList": null,
                        "value": null,
                        "name": "Salesforce QA [source]:UserType"
                    }
                ],
                "name": "Salesforce QA [source]"
            }
        ],
        "targetUser": "Conor Lamb"
    }
},
11

just for testing. can you make all attributes in create policy either static or direct from identity profile instead of using transforms and test this for a new identity who has all the required attributes and never been provisioned any account on this source?

12

Yeah I’m still seeing the same issue with a Create policy containing only statics and Identity Attributes. Potentially worth noting now that the form wants me to fill out Username instead of UserType, but I do have Username filled out through an Identity Attribute.

CreatePolicyTest.json (10.5 KB)

{
    "id": "a8386a21e248407f966b85cc26fb15fd",
    "requesterId": "35bff0ede9534b42a0eadabe4148e770",
    "requesterDisplayName": "Conor Lamb",
    "ownerId": "35bff0ede9534b42a0eadabe4148e770",
    "ownerName": "Conor Lamb",
    "created": "2025-12-12T17:21Z",
    "modified": "2025-12-12T17:21Z",
    "description": "Complete provisioning form for Hank salepointforce",
    "state": "Pending",
    "type": "Form",
    "remediationItems": [],
    "approvalItems": null,
    "name": null,
    "completed": null,
    "numItems": null,
    "form": {
        "id": null,
        "name": "Identity Update",
        "title": null,
        "subtitle": null,
        "sections": [
            {
                "label": null,
                "formItems": [
                    {
                        "displayName": null,
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "\n          Please supply initial values for account attributes in the forms below.\n        ",
                        "name": null
                    }
                ],
                "name": null
            },
            {
                "label": "Request Information",
                "formItems": [
                    {
                        "displayName": "Requester",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "ref:launcher",
                        "name": null
                    },
                    {
                        "displayName": "Requested Roles",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "ref:newRoles",
                        "name": null
                    }
                ],
                "name": null
            },
            {
                "label": "Target Identity",
                "formItems": [
                    {
                        "displayName": "Account ID",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "script:(identity != null) ? identity.getName() : null",
                        "name": null
                    },
                    {
                        "displayName": "First Name",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "script:(identity != null) ? identity.getFirstname() : null",
                        "name": null
                    },
                    {
                        "displayName": "Last Name",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": "script:(identity != null) ? identity.getLastname() : null",
                        "name": null
                    },
                    {
                        "displayName": "Assigned Roles",
                        "displayType": null,
                        "required": false,
                        "allowedValuesList": null,
                        "value": null,
                        "name": null
                    }
                ],
                "name": null
            },
            {
                "label": "Salesforce QA [source]",
                "formItems": [
                    {
                        "displayName": null,
                        "displayType": null,
                        "required": true,
                        "allowedValuesList": null,
                        "value": null,
                        "name": "Salesforce QA [source]:Username"
                    }
                ],
                "name": "Salesforce QA [source]"
            }
        ],
        "targetUser": "Conor Lamb"
    }
}
13

Ok I am not sure what ended up resolving this issue but it appears as though the Salesforce Create Policy was indeed the problem.

I accidentally saved off a Create Policy for a Salesforce Connector to another environment.

When I pasted that Create policy into my QA Salesforce Connector policy, my requests started going through, but with a couple of minor errors. I cleaned up those errors, and now it’s up and running, working as expected. I’m unsure on what exactly in my create policy was the root cause here, but we at least have a solution and know the general area that was causing the problem.

14

I am glad it worked. I bet you have same issue with JDBC connector too. make sure your create queries are configured. Good Luck.