Manual workitem created via custom Quicklink does not appear under acccess request Interactions

IdentityIQ (IIQ) IIQ Discussion and Questions
, , , ,
1

Which IIQ version are you inquiring about?

8.4p3

Share all details about your problem, including any error messages you may have received.

Workflow step:

<Step icon="Task" name="Create sanitizedAppName group resource sharing work item for sanitizedIIQ operator" posX="161" posY="41">
    <Approval mode="serial" owner="sanitizedIIQ Operator" renderer="lcmManualActionsRenderer.xhtml" send="approvalSet,groupNameForWorkitemDescription,identityName">
      <Arg name="requester" value="ref:launcher"/>
      <Arg name="identityRequestId" value="ref:identityRequestId"/>
      <Arg name="approvalSet">
        <Script>
          <Source>
            import sailpoint.object.ApprovalItem;
            import sailpoint.object.ApprovalSet;
            import sailpoint.object.Identity;
            import sailpoint.object.IdentityRequest;
            import sailpoint.object.ProvisioningPlan.AccountRequest;
            
            log.error("sanitizedWorkflowName: Create sanitizedAppName group resource sharing work item for sanitizedIIQ operator");
            log.error("sanitizedWorkflowName: identityrequestid = " + identityRequestId);
            IdentityRequest identityRequest = context.getObjectByName(IdentityRequest.class, identityRequestId);
            if (identityRequest == null) {
              log.error("sanitizedWorkflowName: identityRequest is NULL");
              return;
            }


            private void processsanitizedAppNameGroupSharingRequest(String sanitizedAppNameGroupName, String selectedNamespace, Identity identity, ApprovalSet approvalSet) {
              String applicationName = "sanitizedAppName";
              String accountRequestOperation = "Share group to namespace: " + selectedNamespace;

              String approvalItemValue = String.format("GroupName: %s | Operation: %s", sanitizedAppNameGroupName, accountRequestOperation);
            
            	if (identityName == null) {
            		log.error("sanitizedWorkflowName: identityName is null");
            	}
            	
            	log.error("sanitizedWorkflowName: identityRequestId = " + identityRequestId);

              ApprovalItem approvalItem = new ApprovalItem();
              approvalItem.setApplication(applicationName);
              approvalItem.setNativeIdentity(identityName);
              approvalItem.setOperation("Add");
              approvalItem.setValue(approvalItemValue);
              approvalSet.add(approvalItem);

              return;

            }

            Identity identity = context.getObjectByName(Identity.class, identityName);
            if (identity == null) {
            	log.error("sanitizedWorkflowName: identity is NULL");
              return;
            }

            ApprovalSet approvalSet = new ApprovalSet();
            String selectedNamespace = (String) identityModel.get("selectedNamespace");
            //String sanitizedAppNameGroupName = (String) identityModel.get("groupName");
            
            processsanitizedAppNameGroupSharingRequest(groupNameForWorkitemDescription, selectedNamespace, identity, approvalSet);

            return approvalSet;
          </Source>
        </Script>
      </Arg>
      <Arg name="workItemDescription" value="Group namespace sharing requested for sanitizedAppName group: $(groupNameForWorkitemDescription)"/>
      <Arg name="workItemType" value="ManualAction"/>
      <Arg name="workItemRequester" value="$(requesterDisplayName)"/>
      <Arg name="level" value="Normal"/>
      <Arg name="handler" value="sailpoint.api.Workflower"/>
    </Approval>
    <Description>Send manual work item to sanitizedIIQ Operator to share sanitizedAppName group to another namespace.</Description>
    <Transition to="Update Identity Request Status"/>
  </Step>

Workitem XML:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE WorkItem PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<WorkItem created="1781518661955" handler="sailpoint.api.Workflower" id="a9fef4d99eb41f34819ecac9794331a1" level="Normal" modified="1781519358150" name="0000050058" renderer="lcmManualActionsRenderer.xhtml" significantModified="1781519358150" type="ManualAction">
  <Attributes>
    <Map>
      <entry key="approvalSet">
        <value>
          <ApprovalSet>
            <ApprovalItem application="TechPass" id="158867f602ab4f43ade9b9eb4eb21f6e" nativeIdentity="sanitizedRequesterName" operation="Add" value="GroupName: sanitizedGroupName | Operation: Share group to namespace: sanitizedNamespace"/>
          </ApprovalSet>
        </value>
      </entry>
      <entry key="groupNameForWorkitemDescription" value="sanitizedGroupName"/>
      <entry key="handler" value="sailpoint.api.Workflower"/>
      <entry key="identityName" value="sanitizedRequesterName"/>
      <entry key="identityRequestId" value="0000021757"/>
      <entry key="level" value="Normal"/>
      <entry key="requester" value="sanitizedRequesterName"/>
    </Map>
  </Attributes>
  <Description>Group namespace sharing requested for TechPass group: sanitizedGroupName</Description>
  <Owner>
    <Reference class="sailpoint.object.Identity" id="a9fef4d992471c5d81926f4439fa6a46" name="sanitizedIIQ Operator"/>
  </Owner>
  <Requester>
    <Reference class="sailpoint.object.Identity" id="a9fe8e16958b12c68195a1dbf91140f8" name="sanitizedRequesterName"/>
  </Requester>
  <WorkflowCaseRef>
    <Reference class="sailpoint.object.WorkflowCase" id="a9fef4d99eb41f34819ecac887d6316d" name="QuickLink Launch for identity sanitizedRequesterName - 468"/>
  </WorkflowCaseRef>
</WorkItem>

IdentityRequestXML:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE IdentityRequest PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<IdentityRequest completionStatus="Pending" created="1781523321955" endDate="1781523352553" executionStatus="Completed" id="a9fef4d99eb41f34819ecb1094633226" modified="1781523352553" name="0000021758" priority="Normal" requesterDisplayName="sanitizedRequesterName" requesterId="a9fe8e16958b12c68195a1dbf91140f8" significantModified="1781523352553" source="GroupManagement" state="Finished" targetClass="sailpoint.object.Identity" targetDisplayName="sanitizedRequesterName" targetId="a9fe8e16958b12c68195a1dbf91140f8" type="AD Group Management">
  <Attributes>
    <Map>
      <entry key="approvalSummaries">
        <value>
          <List>
            <ApprovalSummary completer="sanitizedRequesterName" endDate="1781523344479" owner="sanitizedRequesterName" request="Supervisor Approval for AD Group Creation - sanitizedGroupName" startDate="1781523322116" state="Finished" workItemId="a9fef4d99eb41f34819ecb1094dd3227" workItemType="Approval">
              <ApprovalSet>
                <ApprovalItem application="sanitizedAppName" approver="sanitizedRequesterName" id="616918feb9c34e2ea1e8154667c1a954" operation="Create" state="Finished">
                  <Attributes>
                    <Map>
                      <entry key="Owner:sanitizedFirstApprover"/>
                      <entry key="application:null"/>
                      <entry key="details:null"/>
                      <entry key="environment:PRD"/>
                      <entry key="groupDescription:test4"/>
                      <entry key="groupName:sanitizedGroupName"/>
                    </Map>
                  </Attributes>
                  <value>
                    <List>
                      <String>groupName = 'sanitizedGroupName'</String>
                      <String>groupDescription = 'test4'</String>
                      <String>Owner = 'sanitizedFirstApprover'</String>
                      <String>environment = 'PRD'</String>
                    </List>
                  </value>
                </ApprovalItem>
              </ApprovalSet>
            </ApprovalSummary>
            <ApprovalSummary completer="sanitizedRequesterName" endDate="1781523352176" owner="sanitizedFirstApprover" request="Entitlement Owner Approval for AD Group Creation - sanitizedGroupName" startDate="1781523344736" state="Finished" workItemId="a9fef4d99eb41f34819ecb10ed1e322c" workItemType="Approval">
              <ApprovalSet>
                <ApprovalItem application="sanitizedAppName" approver="sanitizedRequesterName" id="616918feb9c34e2ea1e8154667c1a954" operation="Create" owner="sanitizedRequesterName" state="Finished">
                  <Attributes>
                    <Map>
                      <entry key="Owner:sanitizedFirstApprover"/>
                      <entry key="application:null"/>
                      <entry key="details:null"/>
                      <entry key="environment:PRD"/>
                      <entry key="groupDescription:test4"/>
                      <entry key="groupName:sanitizedGroupName"/>
                    </Map>
                  </Attributes>
                  <value>
                    <List>
                      <String>groupName = 'sanitizedGroupName'</String>
                      <String>groupDescription = 'test4'</String>
                      <String>Owner = 'sanitizedFirstApprover'</String>
                      <String>environment = 'PRD'</String>
                    </List>
                  </value>
                </ApprovalItem>
              </ApprovalSet>
            </ApprovalSummary>
          </List>
        </value>
      </entry>
      <entry key="provisionedProject">
        <value>
          <ProvisioningProject identity="sanitizedRequesterName">
            <Attributes>
              <Map>
                <entry key="disableRetryRequest">
                  <value>
                    <Boolean>true</Boolean>
                  </value>
                </entry>
                <entry key="identityRequestId" value="0000021758"/>
                <entry key="optimisticProvisioning" value="false"/>
                <entry key="requester" value="sanitizedRequesterName"/>
                <entry key="source" value="GroupManagement"/>
              </Map>
            </Attributes>
            <MasterPlan>
              <ProvisioningPlan>
                <AccountRequest application="sanitizedAppName" op="Create">
                  <AttributeRequest name="groupName" op="Set" value="sanitizedGroupName"/>
                  <AttributeRequest name="groupDescription" op="Set" value="test4"/>
                  <AttributeRequest name="Owner" op="Set" value="sanitizedFirstApprover"/>
                  <AttributeRequest name="application" op="Set"/>
                  <AttributeRequest name="details" op="Set"/>
                  <AttributeRequest name="environment" op="Set" value="PRD"/>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="identityRequestId" value="0000021758"/>
                    <entry key="requester" value="sanitizedRequesterName"/>
                    <entry key="source" value="GroupManagement"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </MasterPlan>
            <Messages>
              <Message key="No account creation template for application: sanitizedAppName" type="Info"/>
            </Messages>
            <ProvisioningPlan targetIntegration="sanitizedAppName" trackingId="b436eec568d44a98a5ca096c2e36fa22">
              <AccountRequest application="sanitizedAppName" op="Create">
                <AttributeRequest name="groupName" op="Set" value="sanitizedGroupName"/>
                <AttributeRequest name="groupDescription" op="Set" value="test4"/>
                <AttributeRequest name="Owner" op="Set" value="sanitizedFirstApprover"/>
                <AttributeRequest name="environment" op="Set" value="PRD"/>
              </AccountRequest>
              <Attributes>
                <Map>
                  <entry key="identityRequestId" value="0000021758"/>
                  <entry key="requester" value="sanitizedRequesterName"/>
                  <entry key="source" value="GroupManagement"/>
                </Map>
              </Attributes>
            </ProvisioningPlan>
            <ProvisioningTarget assignmentId="7be973c70dc94fe58956670e6ba28f65" retain="true" role="UAT_Birthright_Dept2">
              <AccountSelection applicationId="a9fef4d992bd18228192bd9b75a40008" applicationName="sanitizedIIQ Workgroup" selection="sanitizedRequesterName">
                <AccountInfo displayName="sanitizedRequesterName" nativeIdentity="sanitizedRequesterName"/>
                <Followers>
                  <String>UAT_Birthright_Dept2_IT</String>
                </Followers>
              </AccountSelection>
            </ProvisioningTarget>
          </ProvisioningProject>
        </value>
      </entry>
      <entry key="taskResultId" value="a9fef4d99eb41f34819ecb1093ad321d"/>
    </Map>
  </Attributes>
  <RequestItems>
    <IdentityRequestItem application="sanitizedAppName" approvalState="Finished" created="1781523321953" id="a9fef4d99eb41f34819ecb109461321f" modified="1781523352506" name="groupName" operation="Set" provisioningState="Commited" significantModified="1781523352506" value="sanitizedGroupName">
      <Attributes>
        <Map>
          <entry key="managedAttributeType" value="Entitlement"/>
          <entry key="provisioningPlan">
            <value>
              <ProvisioningPlan trackingId="d1c4b52a0b2f45578371e1c8d38513cc">
                <AccountRequest application="sanitizedAppName" op="Create">
                  <AttributeRequest name="groupName" op="Set" trackingId="d1c4b52a0b2f45578371e1c8d38513cc" value="sanitizedGroupName"/>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="source" value="GroupManagement"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </value>
          </entry>
        </Map>
      </Attributes>
    </IdentityRequestItem>
    <IdentityRequestItem application="sanitizedAppName" approvalState="Finished" created="1781523321953" id="a9fef4d99eb41f34819ecb1094613220" modified="1781523352506" name="groupDescription" operation="Set" provisioningState="Commited" significantModified="1781523352506" value="test4">
      <Attributes>
        <Map>
          <entry key="managedAttributeType" value="Entitlement"/>
          <entry key="provisioningPlan">
            <value>
              <ProvisioningPlan trackingId="dd8e343b8d5f44bf9a405e7460a3b876">
                <AccountRequest application="sanitizedAppName" op="Create">
                  <AttributeRequest name="groupDescription" op="Set" trackingId="dd8e343b8d5f44bf9a405e7460a3b876" value="test4"/>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="source" value="GroupManagement"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </value>
          </entry>
        </Map>
      </Attributes>
    </IdentityRequestItem>
    <IdentityRequestItem application="sanitizedAppName" approvalState="Finished" created="1781523321953" id="a9fef4d99eb41f34819ecb1094613221" modified="1781523352506" name="Owner" operation="Set" provisioningState="Commited" significantModified="1781523352506" value="sanitizedFirstApprover">
      <Attributes>
        <Map>
          <entry key="managedAttributeType" value="Entitlement"/>
          <entry key="provisioningPlan">
            <value>
              <ProvisioningPlan trackingId="c3fc0e72649e4a1c87930838cf27ea1b">
                <AccountRequest application="sanitizedAppName" op="Create">
                  <AttributeRequest name="Owner" op="Set" trackingId="c3fc0e72649e4a1c87930838cf27ea1b" value="sanitizedFirstApprover"/>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="source" value="GroupManagement"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </value>
          </entry>
        </Map>
      </Attributes>
    </IdentityRequestItem>
    <IdentityRequestItem application="sanitizedAppName" approvalState="Finished" created="1781523321953" id="a9fef4d99eb41f34819ecb1094613222" modified="1781523352506" name="application" operation="Set" provisioningState="Commited" significantModified="1781523352506">
      <Attributes>
        <Map>
          <entry key="managedAttributeType" value="Entitlement"/>
          <entry key="provisioningPlan">
            <value>
              <ProvisioningPlan trackingId="f6c8dcb0dd434a129ab12655dbb942dc">
                <AccountRequest application="sanitizedAppName" op="Create">
                  <AttributeRequest name="application" op="Set" trackingId="f6c8dcb0dd434a129ab12655dbb942dc"/>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="source" value="GroupManagement"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </value>
          </entry>
        </Map>
      </Attributes>
    </IdentityRequestItem>
    <IdentityRequestItem application="sanitizedAppName" approvalState="Finished" created="1781523321953" id="a9fef4d99eb41f34819ecb1094613223" modified="1781523352506" name="details" operation="Set" provisioningState="Commited" significantModified="1781523352506">
      <Attributes>
        <Map>
          <entry key="managedAttributeType" value="Entitlement"/>
          <entry key="provisioningPlan">
            <value>
              <ProvisioningPlan trackingId="2b02a33f58154fc293de3a8e24c555ac">
                <AccountRequest application="sanitizedAppName" op="Create">
                  <AttributeRequest name="details" op="Set" trackingId="2b02a33f58154fc293de3a8e24c555ac"/>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="source" value="GroupManagement"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </value>
          </entry>
        </Map>
      </Attributes>
    </IdentityRequestItem>
    <IdentityRequestItem application="sanitizedAppName" approvalState="Finished" created="1781523321953" id="a9fef4d99eb41f34819ecb1094613224" modified="1781523352507" name="environment" operation="Set" provisioningState="Commited" significantModified="1781523352507" value="PRD">
      <Attributes>
        <Map>
          <entry key="managedAttributeType" value="Entitlement"/>
          <entry key="provisioningPlan">
            <value>
              <ProvisioningPlan trackingId="d752f1a3dfb245ee8a3eb55730921b7d">
                <AccountRequest application="sanitizedAppName" op="Create">
                  <AttributeRequest name="environment" op="Set" trackingId="d752f1a3dfb245ee8a3eb55730921b7d" value="PRD"/>
                </AccountRequest>
                <Attributes>
                  <Map>
                    <entry key="source" value="GroupManagement"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </value>
          </entry>
        </Map>
      </Attributes>
    </IdentityRequestItem>
    <IdentityRequestItem application="sanitizedAppName" approvalState="Finished" created="1781523321953" id="a9fef4d99eb41f34819ecb1094613225" modified="1781523352507" operation="Create" provisioningState="Commited" significantModified="1781523352507">
      <Attributes>
        <Map>
          <entry key="provisioningPlan">
            <value>
              <ProvisioningPlan trackingId="1d292b361c6d4776bbbb460adf4460a9">
                <AccountRequest application="sanitizedAppName" op="Create"/>
                <Attributes>
                  <Map>
                    <entry key="source" value="GroupManagement"/>
                  </Map>
                </Attributes>
              </ProvisioningPlan>
            </value>
          </entry>
        </Map>
      </Attributes>
    </IdentityRequestItem>
  </RequestItems>
</IdentityRequest>

Hi everyone, I have a custom Quicklink which launches a workflow for users to request for application group creation. There is a step in this workflow where for a particular application, a manual workitem should be generated for the IIQ Operator to complete. This workitem generates correctly and appears under Work Items but it does not appear under the Interactions section of the Access Request.

Has anyone faced any similar issues or is able to advise on how to resolve this? Thank you.

2

Can you verify identityRequest in debug page or log

3

Hi @tim089 ,

Can you Check if the IdentityRequest id is getting printed in the logs. If the identity request id is getting printed, then check in the debug page if an Identity Request exists with that id.

If the IdentityRequest id is null, then the identity request may not be getting created. So it is not visible in access requests

4

Yes the IdentityRequestId is printed and the XML exists. I have added a sample to the original post

5

Hi @Chathuryas ,

Yes the identityRequest ID is being printed. It exists in the debug page - I have added a sample for a new request I created.

6

base domain /identityiq/identityRequest/identityRequest.jsf#/request/0000026074
update identityRequest and past url directly in browser and verify its loaded or not

7

@tim089 Instead of creating new approvalSet, use the existing approvalSet which is already available in the step.

8

base domain/identityRequest/identityRequest.jsf#/request/0000021758

this is able to load

9

hi @SivaprakashRNTBCI ,

thanks for the suggestion. i have implemented this but it does not fix the issue

10

@tim089 Can you share your workflow?

11

@tim089 - This could be because the provisioning object in this case is a group. As a test, try provisioning an entitlement to the identity cube through the same process and check whether it appears under Access Requests. If it does, that would indicate that group-based provisioning requests are not displayed under Access Requests.

12

@tim089 Could you please also share the custom quicklink artefacts to understand how are you creating the workitems and what happens before and after that in your workflow. Possibly there are additional steps causing the issues.

13

Hello, could you please share the artifacts as suggested by Neel?