Hi @neel193 & @santhirajumunganda ,
For the use case, there should be an approval from Policy Violation Owner, either after the requester’s submit with violation in the access request, or on the last approval.
For the policy, below is my configuration:
I am using LCM Provisioning for Access Request as the business process. My approvalScheme is manager and owner as seen below:
<Variable initializer="manager, owner" input="true" name="approvalScheme">
Below is my code for ApprovalAssignment rule
<Rule language="beanshell" name="Rule-Workflow-ApprovalAssignment" type="Workflow">
<Description>A rule used by a Workflow to determine a step action or variable value.</Description>
<Signature returnType="Object">
<Inputs>
<Argument name="log" type="org.apache.commons.logging.Log" />
<Argument name="context" type="sailpoint.api.SailPointContext" />
<Argument name="wfcontext" />
<Argument name="handler" />
<Argument name="workflow" />
<Argument name="step" />
<Argument name="approval" />
<Argument name="item" />
<Argument name="policyViolations" />
</Inputs>
<Returns>
<Argument name="Object" />
</Returns>
</Signature>
<Source>import sailpoint.object.*;
import sailpoint.api.*;
import java.util.*;
System.out.println("Rule-Workflow-ApprovalAssignment policyViolations: " + policyViolations); //Returns the 2 policies
for (HashMap policy : policyViolations) {
String name = (String) policy.get("policyName");
System.out.println("Rule-Workflow-ApprovalAssignment name: " + name); // Returns the first policy name
Policy v = (Policy) context.getObjectByName(Policy.class, name);
System.out.println("Rule-Workflow-ApprovalAssignment v: " + v); //Returns the policy object that contains owner
if (v != null && v.getOwner() != null) {
System.out.println("Rule-Workflow-ApprovalAssignment v.getOwner().getName(): " + v.getOwner().getName()); //Returns the policy owner name
return v.getOwner();
}
}
System.out.println("Rule-Workflow-ApprovalAssignment return " + wfcontext); //Return the wfcontext instead of null
return wfcontext;</Source>
</Rule>
For the ApprovalAssignment rule, I applied it to the scenarios below:
First, I added the approvalAssignmentRule for “Approve and Provision”. I can see the values of the Policy Violation Owner in the logs, but it does not create a work item for the policy owner. The workflow goes only to the Requester/Requestee’s Submit with Violation, then the Manager.
Second, in “Pre-Split Approve”, the result is the same as in “Approve and Provision”.
Third, even when both steps have the rule applied, the result is still the same.
Below is the result in the interactions tab for all scenarios mentioned above:
The issue is that it works correctly for the detective part of the policy, but for the preventive part—which runs through access request—it does not create a work item for the policy violation owner.
