Terminate a workflow with only a message Return

IdentityIQ (IIQ) IIQ Discussion and Questions
1

We’re using a customized workflow to accept input from a SCIM request and trigger said workflow to create an identity and provision an Okta account. As the front end of the request portal is 100% removed from IIQ, I’m looking to do validation of the identity’s non-existence within my workflow. I’d like to create a conditional transition from the Start step into a “Message” step that simply adds a message to the workflow case and is returned in the API response. From there the workflow would transition to end. I’ve developed the conditional transition and the message step, but I currently have the workflow going from Start to Message to Stop, and when I run it with an existing identity’s info, it can’t complete because there is no work item.

Log error: “2021-04-13T10:34:00,565 ERROR http-nio-8080-exec-7 sailpoint.api.Workflower:3573 - Unable to create workflow task result
sailpoint.tools.GeneralException: Unable to create qualified task result: AA Logging Workflow”

Is there any way to exit out of the workflow without creating an identity request id or is there some simple variable I can create and set for this conditional flow to allow the workflow to simply end and return the message variable in the API response for the end system to read?

1 Like
2

Hey @cassidiopia,

Thanks for joining the Developer Community and for making your first post! I am currently working on getting the answer to your question from one of our IIQ experts. First thoughts here are that I believe it cannot currently be done as you described. Let me try digging to find the best path forward to achieve the results you are looking for. We will be sure to circle back to you with a definitive answer shortly.

Thanks again for posting!

3

Thanks @jordan.violet for jumping in. Yesterday evening, I could only read a preview of the message on my phone, but not I understand the question a bit better.

@cassidiopia, the SCIM protocol is meant to be stateless. So when you launch a workflow, you simply get a task result back for tracking purposes. It won’t wait for any results. You will need to check the results using the task result.

Also, the WorkflowCase will cease to exist if the workflow ends. Only the task result will stay. It’s not 100% clear what the message step is expected to do, but I can think of two things:

(1) You just want a message to be logged somewhere. The only suitable place would be in the task result, which you can grab using SCIM again, upon completion. The workflow case will have a tasRresultId variable:

<entry key="taskResultId" value="7f00000178a6128a8178b6cdcf821a56"/>

You can use that to look up the TaskResult object, add a message to it and continue the workflow.

(2) You mentioned “WorkItem”. A WorkItem is created when the workflow waits for input. A workflow form or approval step will show only if it can determine the owner of the form or approval. As the field to set the owner is hidden by default, it’s not uncommon to forget setting that field, when a form or approval step is created in the UI. Click the Details button to fill in that information.

Does this help?

  • Menno
1 Like
4

It helps and it doesn’t, but mostly because I don’t know what I’m saying. :slight_smile:

Can you just clarify one thing based on all you explained?

You said we simply get a task result back, but in the response to the SCIM request: {{api_url}}/identityiq/scim/v2/LaunchedWorkflows we get back an output variable. In the case of a successful LCM Provisioning workflow invocation, it is the plan variable from the workflow case. In the case of my testing, if I set the return value on my single step to “message,” I get the message value as output. See here:

{
    "partitioned": false,
    "completed": "2021-04-14T11:28:41.557-04:00",
    "type": "Workflow",
    "launched": "2021-04-14T11:28:41.487-04:00",
    "pendingSignoffs": 0,
    "urn:ietf:params:scim:schemas:sailpoint:1.0:LaunchedWorkflow": {
        "output": [
            {
                "type": "application/xml",
                "value": "<WorkflowSummary step=\"Stop\"/>\n",
                "key": "workflowSummary"
            },
            {
                "value": "[Identity exists, please select new value]",
                "key": "message"
            }
        ],
        "input": [
            {}
        ],
        "workflowSummary": "<WorkflowSummary step=\"Stop\"/>\n",
        "workflowName": "AA Logging Workflow - 22"
    },
    "meta": {
        "created": "2021-04-14T11:28:41.564-04:00",
        "location": "http://localhost:8080/identityiq/scim/v2/TaskResults/c0a8000278cd1dfb8178d0ffb25c0828",
        "version": "W/\"1618414121564\"",
        "resourceType": "LaunchedWorkflow"
    },
    "schemas": [
        "urn:ietf:params:scim:schemas:sailpoint:1.0:LaunchedWorkflow",
        "urn:ietf:params:scim:schemas:sailpoint:1.0:TaskResult"
    ],
    "name": "AA Logging Workflow - 22",
    "messages": [],
    "attributes": [
        {
            "value": "<WorkflowSummary step=\"Stop\"/>\n",
            "key": "workflowSummary"
        },
        {
            "value": "[Identity exists, please select new value]",
            "key": "message"
        }
    ],
    "id": "c0a8000278cd1dfb8178d0ffb25c0828",
    "completionStatus": "Success",
    "taskDefinition": "Workflow Launcher",
    "terminated": false,
    "launcher": "nick.bowerman"
}

So that is the value I want to send back in the API response if my conditional transition finds that the identityName value in the original request is an existing identity. It works fine if it is the single return element on the single step in my workflow. When I create a conditional transition and an alternate step (which, yes, is meant to log the message TO the API response) it fails with the error I provided earlier.

This is definitely a case of my misunderstanding, so don’t worry about my original questions, but can you clarify what you said neglecting the output variable on the API response?

5

And FWIW, I got it working as expected. I was using StringBuilder to create the message value and I found this in my logs:
2021-04-14T12:03:18,709 WARN http-nio-8080-exec-3 sailpoint.api.TaskManager:1428 - Unable to save task result: No serializer registered for class class java.lang.StringBuilder
sailpoint.tools.GeneralException: No serializer registered for class class java.lang.StringBuilder

Lesson for all: CHECK ALL THE LOGS! :joy:

I changed that to a List variable and I was able to add my message, the workflow was executed successfully, I got a 201 response, and I got the message in the response body so I can parse it into a UI response for the end system.

Thanks for digging around in this for me, guys.

1 Like
6

@cassidiopia, I am very glad to hear that you were able to get this workflow behaving like you wanted it to. Let us know if we can be of any further service to you in the future; we hope to see you around the developer community!

7

Great. I had not seen your reply, yet, but was doing some testing. Just for reference, I’m adding my findings.

If the workflow runs from start to end immediately, it will not return a task id. If it pauses for user input, it will.

Getting the message as output was just a matter of marking an attribute as output and setting it somewhere in the workflow.

I created a really simple workflow to test:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Workflow PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Workflow explicitTransitions="true" name="SCIM Message" type="">
  <Variable name="message" output="true"/>
  <Variable name="message" output="true"/>
  <Step icon="Start" name="Start" posX="28" posY="10">
    <Transition to="Set Message"/>
  </Step>
  <Step action="script:wfcontext.setVariable(&quot;message&quot;, &quot;This is a test&quot;);" icon="Default" name="Set Message" posX="128" posY="9">
    <Transition to="Stop"/>
  </Step>
  <Step icon="Stop" name="Stop" posX="224" posY="10"/>
</Workflow>

…and got this output.

{
    "partitioned": false,
    "completed": "2021-04-16T11:49:30.333+02:00",
    "type": "Workflow",
    "launched": "2021-04-16T11:49:30.321+02:00",
    "pendingSignoffs": 0,
    "urn:ietf:params:scim:schemas:sailpoint:1.0:LaunchedWorkflow": {
        "output": [
            {
                "type": "application/xml",
                "value": "<WorkflowSummary step=\"Stop\"/>\n",
                "key": "workflowSummary"
            },
            {
                "value": "This is a test",
                "key": "message"
            }
        ],
        "input": [
            {}
        ],
        "workflowSummary": "<WorkflowSummary step=\"Stop\"/>\n",
        "workflowName": "SCIM Message"
    },
    "meta": {
        "created": "2021-04-16T11:49:30.335+02:00",
        "location": "http://127.0.0.1:8080/identityiq81/scim/v2/TaskResults/c0a8c86e78ca1d8a8178da15e15f7e92",
        "version": "W/\"1618566570335\"",
        "resourceType": "LaunchedWorkflow"
    },
    "schemas": [
        "urn:ietf:params:scim:schemas:sailpoint:1.0:LaunchedWorkflow",
        "urn:ietf:params:scim:schemas:sailpoint:1.0:TaskResult"
    ],
    "name": "SCIM Message",
    "messages": [],
    "attributes": [
        {
            "value": "<WorkflowSummary step=\"Stop\"/>\n",
            "key": "workflowSummary"
        },
        {
            "value": "This is a test",
            "key": "message"
        }
    ],
    "id": "c0a8c86e78ca1d8a8178da15e15f7e92",
    "completionStatus": "Success",
    "taskDefinition": "Workflow Launcher",
    "terminated": false,
    "launcher": "Aaron.Nichols"
}
1 Like