SNOW Catalog Integration: Revoke is stuck at Sailpoint verification

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi,

we are facing some synchronization issues with SNOW->ISC Catalog Integration.

I have “Configurable Approvals” and Generic Approval Definition for Roles in SNOW.

If I request a role, it will be approved by access item owner in SNOW and the provisioning will be sent to ISC. After provisioning in ISC SNOW gets the information, closes and updates the request as “Completed”

But, If I revoke an Role, the same steps happen. Approval by Owner, sending to ISC. ISC revokes it. At the end The request is stuck in “Sailpoint Verification” in SNOW and the request never gets updated.

Did you have this issue? If yes, how did you solve it?

2

One thing you likely need to check here -

What is the value of the system property x_sap_intidn.idn_status_check_timer? That determines how often ServiceNow polls for status on the SailPoint access request

image
image1324×154 11.4 KB

I’ve seen people not be aware of this setting and wonder why requests get “stuck” on the ServiceNow side only to figure out the workflow is only checking status once every 24 hours because they haven’t set a value

3

Thank you, we have set the value to 720’ (12h), which is recommended by sailpoint:

image
image1486×149 9.31 KB

But all the requests are more than 2 days old and still no update. As I said for assignments it works but for revokes it doesnt work.

4

do you have access to the wf_context table to ensure that the workflow didn’t get cancelled after 100 activity executions? That sometimes happens with workflows that have looping structures like this one does.

Also, if you query the access-request-status API endpoint using the accountActivityItemId value in the RITM variable, that record does indeed show as completed?

5

thank you Mark for your help.

the API {{baseUrl}}/access-request-administration?filters=accountActivityItemId eq "519649eed7dxxx" returns REQUEST_COMPLETED.

I cant look in wf_context table unfortunately, but I will ask it SNOW Admin in the company and check if the WF Execution has been stopped.

Best regards