ServiceNow Catalogue Approval Issue

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Team,
We are having a weird issue in our ServiceNow Catalogue where when we are raising a request it goes to manager/governance group and after approval it goes back to manager/governance group. We recently upgraded to 4.0. It was working fine. Not sure where to start looking at in ServiceNow to fix the issue.

2

Can you describe the approval definitions/rules you’ve configured for this?

3

Hey Mark,

It looks like it has stuck at Has Active Approvals in ServiceNow.

image
image1303×598 49.4 KB

The values at ServiceNow side is as below

image
image800×167 40.6 KB

4

Ok, you have configurable approvals enabled, so that means you have at least one record in the table x_sap_intidn_mla_definition.

  1. What type of object is being requested in this workflow? (Entitlement, Access Profile, Role)
  2. What are the approval rules (in the table x_sap_intidn_mla_rule) associated with the definition that maps to the object type?
5

Here is why I ask…

In my environment, we have users request access profiles only, so I have two different definitions in the x_sap_intidn_mla_definition table

image
image1833×259 21.4 KB

Notice how they each have their own rule associated with the definition, so there are two steps involved for the approval.

Let’s assume a scenario where the approver for the first rule (Manager) and the second rule (Access Item Owner) return the same user. That will result in back-to-back approvals being sent to the same user. The logic that generates the approval plan has no check to see if the next approval level is the same as the previous level and to see whether or not it’s already been approved so it can “skip” the next level.

Therefore, it’s possible for one person to receive an approval twice for one record.

Take a look at the generated approval plan for an example request I created… notice the same ID for the user

[
    {
        "name": "Manager",
        "users": "4c6f416e1bdee700275276e1dd4bcb35",
        "allSign": "0",
        "type": "userApproval",
        "order": "100",
        "approvalType": "snow_manager",
        "reassignedToDefault": false
    },
    {
        "name": "Access Item Owner",
        "users": "4c6f416e1bdee700275276e1dd4bcb35",
        "allSign": "0",
        "type": "userApproval",
        "order": "200",
        "approvalType": "snow_script",
        "reassignedToDefault": false
    }
]

image
image661×276 10.3 KB

This is why I am asking for that information from your environment, because it’s possible that you have two definitions that return the same user(s)

6

Hi Mark,
Sorry for late reply. We only have one definition for Access Profile. We don’t have access to ServiceNow but i have requested this information.