Task result not launching workflow case

IdentityIQ (IIQ) IIQ Discussion and Questions
, , ,
1

Which IIQ version are you inquiring about?

8.4p1

Share all details about your problem, including any error messages you may have received.

I have a lifecycle event which gets triggered when a user has 2 particular roles requested via manage user access. This lifecycle event triggers a workflow which has 6 steps to be executed with some of them having wait time. today i saw a weird case where 2 users for whom the life cycle event was triggered correctly which in turn created a task result. All good so far. but when i open the task result it doesnt mention which step it is on, even mor when i open the task result in debug, i dont see any workflow case mentioned there. The task has been stuck for days now without moving forward.

Anyone seen this issue before, Any idea what i should debug for this ?

2

hi @rohit_jaiswal1
I have seen something similar in IIQ 8.4p1. If the task result doesn’t show the current step or workflow case, it might mean the workflow didn’t start properly or got stuck at a wait step.

A few things to check:

  • Look in the spt_workflowcase table to see if a case was created.
  • Check debug logs for the workflow engine—any errors when the lifecycle event triggered?
  • If your workflow has wait steps, make sure the conditions to move forward are actually being met.
3

Thanks for your reply @haideralishaik
1 and 3 are not the case, wait step has no logic just time to wait so that object locks are released in the target system, first i checked their is no entry. Trying to reproduce the issue to find the logs

4

Update : my workflow had wait =“1” which i removed and it works fine now . makes me wonder why it was the issue earlier as there are many other workflows where i have wait =“1”

5

Hi @rohit_jaiswal1
Some times workflow case has a lock, it has to unlocked so the perform maintenance with background events can process in the next run.

If you receive next time, in the workflow case you can add trace=true entry tag to trace the workflow, this way it will give more information in the logs.

6

When workflow has “wait” step, it’s backgrounded and a workItem is created with expiration time. So until that time passes, that workflow will not restart. Once it’s time you need Perform Maintenance task to run to pick up the workItem and progress the workflow.
If there are errors (and I’ve seen it happen) the workItem can get locked and workflow does not get progressed. In such case delete the lock in debug and it will work again.
If it happens frequently you might want to look in to the correctness of your workflow.
Also just to be clear: event starts a workflow and that creates task result. If you have no workflowCaseId in your task result it could mean it’s finished or died on error.
You mentioned that task has been stuck for days? What exactly do you mean by that?

7

So i see that the workflow is erroring in sys logs with the lazy error. looking on compass i found articles which suggest if i use provisioner API in a workflow with wait step it might cause problems sometimes due to context and wf parameters (objects). i am not using either . Is there any other way other than provisioner API to execute the same workflow ?

8

perform maintenance is not moving, what i noticed is my workflow has 7 steps, first 2 steps dont have wait time =“1” so they get executed fine, third step where wait=“1”, it throw sys log error and task result is in pending state for weeks

9

OK, it seems that your issue is that lazy error, and the rest could be just consequences of that error.
What are you trying to do in your workflow?
You are asking if there is “any other way other than provisioner API to execute the same workflow”. What do you mean by that. Provisioner is a class used to execute provisioning plans and projects. It is NOT in any way used to execute a workflow.
If possible please provide your workflow so we can have a look.

10

Hi @aleksander_jachowicz, workflow is a custom workflow to interact with CyberArk APIs to perform operations like create vault, add default users etc. sorry i miswrote the worflow, what i mean was is there any other way to execute the provisioning plan created in each of these steps without provisioner API and us OOTB LCM for it ?

11

Yes and no. Under the hood Provisioner is always used but instead of invoking it directly you can invoke OOTB subworkflow “Provision with retries”. You get retries, refresh a few other things by just using that workflow.
The way to do this:

<Step name="Provision">
    <Arg name="disableIdentityRequests" value="true"/>
    <Arg name="project" value="ref:project"/>
    <Arg name="maxRetries"/>
    <Arg name="provisioningRetryThreshold"/>
    <Arg name="trace" value="ref:trace"/>
    <Arg name="identityRequestId"/>
    <Arg name="retryProject"/>
    <Arg name="retries"/>
    <Arg name="enableRetryRequest"/>
    <Arg name="foregroundProvisioning" value="true"/>    
    <Return name="project" to="project"/>
    <WorkflowRef>
      <Reference class="sailpoint.object.Workflow" name="Provision with retries"/>
    </WorkflowRef>
    <Transition to="???"/>
  </Step>

You will have to provide the arguments you need. Most critical is project of course.
This is what LCM provisioning is using do do actual provisioning.
Does that answer your question?