Problem setting up a multi-level approval for policy violations

IdentityIQ (IIQ) IIQ Discussion and Questions
, , ,
1

Which IIQ version are you inquiring about?

Version 8.3

Share all details related to your problem, including any error messages you may have received.

I need to make approvals for specific identities when an access request has a policy violation.
Goal:
When the requester requests access for an identity to obtain an entitlement that causes a policy violation a list of identities are determined to be approvers.
The approvers are provided the list of access reqeusted items and shows what policies are violated.
The approvers are done in order using serial, identity, and a list of approvingIdentites.
When an approvers denies a request it stops at that requester and continues on in the workflow
If all approvers approve the request the provisioning workflow continues.

I have a script that generates the list of approvers and sets them in the approvingIdentities
I tried setting the owner for an approval step to approvingIdentities. I am able to see work items are generated for the correct identites in order but they are able to deny and it goes to the next approver.
After this I tired to use an approvalAssignmentRule instead. I used the same script but updated it to create approval but my problem is I cannot get the rule to launch.
The rule type is set to ApprovalAssignment and is based on another ApprovalAssignmentRule we have that launches correctly.

How do I properly set an approvalAssignmentRule in a workflow? Is there a better way to accomplish this?

2

Hi @nag6917 ,

Have you added the argument for approvalAssignmentRule, declaring your rule name in your Approval step of LCM workflow, as below?

Regards,
Uday Kilambi

1 Like
3

Hi @nag6917,

As mentioned by other experts please check if you have mapped the rule as shown below. Let us know if you still face issue.

image
image843×199 20.2 KB

Thanks

1 Like
4

Yes, I have the argument set to approvalAssignmentRule with the value set to my rule. I have the rule type set as ApprovalAssignment as that is what the other approvalAssignmentRule we have is set to.

It is on an approval step, the approval works as I am able to get the work item for approving but the approvalAssignmentRule does not run. I have loggers in the rule so I can tell if it runs or not.

Do I need to set anything else for the rule to run?

5

Hi @nag6917,

Please check below points. Some points may look absurd but please validate once.

  1. Approval Scheme is set.
  2. What is the value of approvalSplitpoint
  3. Your workflow which you are triggering is configured for manage access.

If still it is not solving, if possible, please share your workflow xml by removing personal details so that the same can be validated.

Thanks

1 Like
6

I was able to get the approvalAssignmentRule to work, I think there was some configuration on my sub process that was causing my problem.

Thanks

2 Likes
7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.