SailPoint Transient Workflow Problem: AD Account Creation Triggering Too Early

IdentityIQ (IIQ) IIQ Discussion and Questions
, , ,
1

Hi Developers,

I have a requirement involving a custom form to onboard a contractor identity.

In the first step, I launch a workflow using a QuickLink. The requester (launcher) fills in all the required fields and submits the request. After submission, the form data is passed to the LCM Create and Update workflow. I then display a success message in the UI along with the access request ID.

Access Request Submitted Successfully 1000964456

After the approval process is completed, I need to create an Active Directory account. However, since the workflow is transient, the Active Directory account creation step is being executed immediately instead of waiting for approvals to finish.

if I remove httpSession variable it is working fine but UI message it is not showing with Access Request ID
**
Does anyone have suggestions on how to ensure that the Active Directory account is created only after the approvals are completed?
**

2

@laxman_angadala Can you confirm which approvals you are referring? access request approval? or form approval. can you explain the process step by step?

3

launcher take by form approvals after that access request approvals going to manager selected in form.

4

@laxman_angadala In that case, you have put some condition in AD account create step or before going to that step. Below are some suggestions.

  1. After form submission, display success message to user and put some intermediate step to check if the identity object created successfully (which means LCM workflow completed) and then move to AD creation. Note: Run this step in the background and loop it until the identity is created.
  2. Else based on the IdentityReqeuestID you got from LCM workflow, you can check approval status and move to AD creation. Having the same intermediate step logic mentioned above.

Thanks,

Sivaprakash.

5

Can you please share your workflow or explain the steps that you have created in your custom workflow.

6

Hi @laxman_angadala

If you still need the UI message with the Access Request ID, keep the transient workflow only for request submission, and let the actual provisioning happen after approvals through the standard LCM flow.

7

@laxman_angadala Have you tried setting foregroundProvisioning as false in the LCM workflow you are using?

8

@neel193

yes i tried but no luck

9

  • @SivaprakashRNTBCI

    after submitting request i need to show Access Request ID in UI message.

    What I’m facing if I’m using Transient Identity is Creating but AD account is not creating

    If i remove Transient it is not showing Access Request ID in UI.

10

@laxman_angadala Do you have steps in below order? if not change it and try

form submission → display message step → AD creation

11

Just something to point out is that once you have an approval, your workflow is no longer transient. Meaning that if you were to click cancel, there’s no WorkflowCase object. Once it passes into LCM Create and Update for approval your request no longer becomes transient and you will also lose that httpSession.

12

@laxman_angadala Could you please share the workflow/rule which you are using? That would help us to review and configure it before providing suggestion.