I have Service Catalog integrated and had set up the User Account Configuration following this link (User Account Configuration).
According to this, once configured, every user needs to authenticate before raising a request, and the “Requested By” field should show the requesting user in SailPoint. However, even though we have integrated this, when different users raise a request, the request always shows under the same name (the person who created the authenticated API in API Management).
Hello Ravi. This may be happening because the request is still being submitted to ISC using the service account token. ISC sets Requested By from the identity tied to that token, not directly from the ServiceNow session or catalog form.
I would suggest checking the following under SailPoint Identity Security Cloud for Service Catalog > Setup:
User Authorization is set to authorization_code (Logged In User Account), not client_credentials.
Application Registries OAuth Provider Name exactly matches the OAuth Application Registry configured under System OAuth > Application Registry.
After that, try submitting a new request with another user. They should be prompted to authorize using their own ISC account, and the new request should then show that user under Requested By.
You can keep the service account configured, since the integration still uses it for background and approval-related actions. (SailPoint documentation)
If users are already getting the individual ISC authorization prompt but new requests still show the API creator, I would suggest checking the installed Service Catalog app version and opening a SailPoint Support case, as the request may still be falling back to the service account token.
Is there any way to dynamically set the RequestedBy value when making SailPoint API calls from within a Workflow? If so, what would be the recommended approach? I’d like to explore the best way to implement this.
@Gopi2000 I don’t see a supported way to pass requestedBy dynamically in the Access Request API. The request body lets you set requestedFor and the requested items, but it doesn’t expose a requestedBy field. ISC evaluates the request using the user context of the API token, so “Requested By” will always reflect the identity tied to that token.
The Workflow HTTP Request action also uses the authentication configured on that action (PAT or OAuth client credentials). It doesn’t automatically make the call as the user who triggered the workflow.
For this use case, I would suggest submitting the request from ServiceNow using the logged-in user’s authorization_code token. If the Workflow must submit it using a service credential, I don’t believe Requested By can be overridden. You could still include the original requester in the request comment for audit purposes.
I understand your point. However, in our current scenario, I’m triggering an access request through a form launched from the Launcher. The person who launches the form should be the requester, and the target identity should be the requestee.
Since the access request is being initiated from a workflow using a client ID and client secret, SailPoint sets the requester to the identity associated with those credentials (my account), rather than the actual user who launched the form. However, the client’s expectation is for the “Launched By” user’s display name to appear as the requester.
I understand that the Access Request API doesn’t allow us to override the requestedBy attribute. Are there any other approaches within SailPoint Workflows to achieve this requirement?