Two level of Custom approval for new account

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.4 P1

Share all details about your problem, including any error messages you may have received.

Hello,

we have to set 2 levels of custom approvals for service account creation.

Firslty, we leveraged securityofficername as it should route to requester’s manager and it is working fine.

Secondly, we need to route to constant workgroup. so we used approvingidentities. But request is gettign completed without going to this step.

Can any one suggest what are we missign here.

      import sailpoint.object.Custom;
      import sailpoint.object.Identity;
    
    Identity requesterId = context.getObject(Identity.class, requester);
    Identity reqmanager = requesterId.getManager();
    log.error("reqmanager is :"+reqmanager);
               workflow.getVariables().put("approvalScheme", "securityOfficer");
    
             workflow.getVariables().put("securityOfficerName", reqmanager.getName());

     
    
  </Source>
</Script>
<Transition to="Approve AD SA Identity"/>

      import sailpoint.object.Custom;
      import sailpoint.object.Identity;
    
    Identity requesterId = context.getObject(Identity.class, requester);
    Identity reqmanager = requesterId.getManager();
    log.error("reqmanager is :"+reqmanager);
               workflow.getVariables().put("approvalScheme", "identity");
    
             workflow.getVariables().put("approvingIdentities", "SecAdmin");

     
    
  </Source>
</Script>
<Transition to="Approve AD SA Owner Identity"/>
3 
 <Step icon="Default" name="Approval Check" posX="20" posY="20">
    <Arg name="requester" value="ref:requester"/>
    <Arg name="manager" value="ref:manager"/>
    <Arg name="plan" value="ref:plan"/>
    <Script>
      <Source>
        
          import sailpoint.object.Custom;
          import sailpoint.object.Identity;
        
        Identity requesterId = context.getObject(Identity.class, requester);
        Identity reqmanager = requesterId.getManager();
        log.error("reqmanager is :"+reqmanager);
                   workflow.getVariables().put("approvalScheme", "securityOfficer");
        
                 workflow.getVariables().put("securityOfficerName", reqmanager.getName());

         
        
      </Source>
    </Script>
    <Transition to="Approve AD SA Identity"/>
  </Step>
  <Step icon="Task" name="Approve AD SA Identity" posX="783" posY="63">
    <Arg name="requester" value="ref:requester"/>
    <Arg name="manager" value="ref:manager"/>
    <Arg name="approvalScheme" value="ref:approvalScheme"/>
    <Arg name="plan" value="ref:plan"/>
    <Arg name="securityOfficerName" value="ref:securityOfficerName"/>
    <Arg name="fallbackApprover" value="IAM Administrator"/>
    <Arg name="trace" value="ref:trace"/>
    <Arg name="doRefresh" value="false"/>
    <Arg name="flow" value="ref:flow"/>
    <Arg name="identityName" value="ref:identityName"/>
    <Arg name="notificationScheme" value="ref:requester"/>
    <Arg name="transient" value="ref:transient"/>
    <Arg name="batchRequestItemId" value="ref:batchRequestItemId"/>
    <Return name="identityRequestId" to="identityRequestId"/>
    <WorkflowRef>
      <Reference class="sailpoint.object.Workflow" id="ac1ffeda72a81c2b8172a8ac912c004b" name="LCM Create and Update"/>
    </WorkflowRef>
    <Transition to="Owner Approval Check"/>
  </Step>
  <Step icon="Default" name="Owner Approval Check" posX="20" posY="20">
    <Arg name="requester" value="ref:requester"/>
    <Arg name="manager" value="ref:manager"/>
    <Arg name="plan" value="ref:plan"/>
    <Script>
      <Source>
        
          import sailpoint.object.Custom;
          import sailpoint.object.Identity;
        
        Identity requesterId = context.getObject(Identity.class, requester);
        Identity reqmanager = requesterId.getManager();
        log.error("reqmanager is :"+reqmanager);
                   workflow.getVariables().put("approvalScheme", "identity");
        
                 workflow.getVariables().put("approvingIdentities", "SecAdmin");

         
        
      </Source>
    </Script>
    <Transition to="Approve AD SA Owner Identity"/>
  </Step>
  <Step icon="Task" name="Approve AD SA OwnerIdentity" posX="783" posY="63">
    <Arg name="requester" value="ref:requester"/>
    <Arg name="manager" value="ref:manager"/>
    <Arg name="approvalScheme" value="ref:approvalScheme"/>
    <Arg name="plan" value="ref:plan"/>
    <Arg name="approvingIdentities" value="ref:approvingIdentities"/>
    <Arg name="fallbackApprover" value="IAM Administrator"/>
    <Arg name="trace" value="ref:trace"/>
    <Arg name="doRefresh" value="false"/>
    <Arg name="flow" value="ref:flow"/>
    <Arg name="identityName" value="ref:identityName"/>
    <Arg name="notificationScheme" value="ref:requester"/>
    <Arg name="transient" value="ref:transient"/>
    <Arg name="batchRequestItemId" value="ref:batchRequestItemId"/>
    <Return name="identityRequestId" to="identityRequestId"/>
    <WorkflowRef>
      <Reference class="sailpoint.object.Workflow" id="ac1ffeda72a81c2b8172a8ac912c004b" name="LCM Create and Update"/>
    </WorkflowRef>
    <Transition to="setIdentityCorrelation"/>
  </Step>
4

Hi @Preethi ,

Can you try setting the approvalScheme to manager, securityOfficerName in the workflow. If this approach is not working, then you can use an approval assignment rule for custom approvals.

5

@Preethi Please set your approvalScheme variable to manager, identity.. When you set identity, it looks for the value set in approvingIdentities. Also set approvalMode to seriel so once Manager approves, then only it’ll generate the second approval to the workgroup.

6

@neel193 I have injected securityofficer name for first level as we need to leverage requester’s manager for first level approval.

For second level , it has to route to a static workgroup . so I used approvingidentites in approval scheme. But it is getting skipped. Can you please advise.

 <Step icon="Default" name="Approval Check" posX="20" posY="20">
    <Arg name="requester" value="ref:requester"/>
    <Arg name="manager" value="ref:manager"/>
    <Arg name="plan" value="ref:plan"/>
    <Script>
      <Source>
        
          import sailpoint.object.Custom;
          import sailpoint.object.Identity;
        
        Identity requesterId = context.getObject(Identity.class, requester);
        Identity reqmanager = requesterId.getManager();
        log.error("reqmanager is :"+reqmanager);
                   workflow.getVariables().put("approvalScheme", "securityOfficer");
        
                 workflow.getVariables().put("securityOfficerName", reqmanager.getName());

         
        
      </Source>
    </Script>
    <Transition to="Approve AD SA Identity"/>
  </Step>
  <Step icon="Task" name="Approve AD SA Identity" posX="783" posY="63">
    <Arg name="requester" value="ref:requester"/>
    <Arg name="manager" value="ref:manager"/>
    <Arg name="approvalScheme" value="ref:approvalScheme"/>
    <Arg name="plan" value="ref:plan"/>
    <Arg name="securityOfficerName" value="ref:securityOfficerName"/>
    <Arg name="fallbackApprover" value="IAM Administrator"/>
    <Arg name="trace" value="ref:trace"/>
    <Arg name="doRefresh" value="false"/>
    <Arg name="flow" value="ref:flow"/>
    <Arg name="identityName" value="ref:identityName"/>
    <Arg name="notificationScheme" value="ref:requester"/>
    <Arg name="transient" value="ref:transient"/>
    <Arg name="batchRequestItemId" value="ref:batchRequestItemId"/>
    <Return name="identityRequestId" to="identityRequestId"/>
    <WorkflowRef>
      <Reference class="sailpoint.object.Workflow" id="ac1ffeda72a81c2b8172a8ac912c004b" name="LCM Create and Update"/>
    </WorkflowRef>
    <Transition to="Owner Approval Check"/>
  </Step>
  <Step icon="Default" name="Owner Approval Check" posX="20" posY="20">
    <Arg name="requester" value="ref:requester"/>
    <Arg name="manager" value="ref:manager"/>
    <Arg name="plan" value="ref:plan"/>
    <Script>
      <Source>
        
          import sailpoint.object.Custom;
          import sailpoint.object.Identity;
        
        Identity requesterId = context.getObject(Identity.class, requester);
        Identity reqmanager = requesterId.getManager();
        log.error("reqmanager is :"+reqmanager);
                   workflow.getVariables().put("approvalScheme", "identity");
        
                 workflow.getVariables().put("approvingIdentities", "SecAdmin");

         
        
      </Source>
    </Script>
    <Transition to="Approve AD SA Owner Identity"/>
  </Step>
  <Step icon="Task" name="Approve AD SA OwnerIdentity" posX="783" posY="63">
    <Arg name="requester" value="ref:requester"/>
    <Arg name="manager" value="ref:manager"/>
    <Arg name="approvalScheme" value="ref:approvalScheme"/>
    <Arg name="plan" value="ref:plan"/>
    <Arg name="approvingIdentities" value="ref:approvingIdentities"/>
    <Arg name="fallbackApprover" value="IAM Administrator"/>
    <Arg name="trace" value="ref:trace"/>
    <Arg name="doRefresh" value="false"/>
    <Arg name="flow" value="ref:flow"/>
    <Arg name="identityName" value="ref:identityName"/>
    <Arg name="notificationScheme" value="ref:requester"/>
    <Arg name="transient" value="ref:transient"/>
    <Arg name="batchRequestItemId" value="ref:batchRequestItemId"/>
    <Return name="identityRequestId" to="identityRequestId"/>
    <WorkflowRef>
      <Reference class="sailpoint.object.Workflow" id="ac1ffeda72a81c2b8172a8ac912c004b" name="LCM Create and Update"/>
    </WorkflowRef>
    <Transition to="setIdentityCorrelation"/>
  </Step>
7

I have already set value for approvingidentites. But it is not getting routed

8

@Preethi Could you please share your LCM workflow to review?

9

Hi @Preethi You can achieve this using OOTB configuration. You will need to set “approvalScheme” and “approvalMode” in your LCM provisioning workflow:

<Variable initializer="manager,identity"name="approvalScheme">

you can add also owner, securityOfficer to this list, if required.

<Variable initializer="serial" name="approvalMode">

identity here need to be set in “approvingIdentities” a variable.

Hope this helps.