8.5p1
*We have a requirement to provision the user in AD group and wait for 10min inorder to provision to a webservice application. We have configured a custom role type with AD group and webservice application specific, however that is not working as it is trying to provisioning both at a time.
*
Hi @sboina24 ,
Create a custom workflow with a step containing a rule to provision the AD group and use wait attribute in order to wait for 10 mins and then provision the webservice application.
You can use schedule a rule runner task to trigger the custom workflow based on specific conditions.
As wait is only available in workflows , you can try this approach.
@Chathuryas I’m using OOTB LCM workflow for provisioning and deprovisioning without any customization. Are you saying to add a specific step explicitly for this application?
Can you please elaborate more?
@sboina24 Could you please provide more details on your use case and what issue you are facing.
Are you using manage user access Quicklink to provision the access or roles to provision the access to AD and webservices
I’m using manage user access, where the user will select the custom role (bundle) submits the request and after approval i have to wait for the AD group to be provisioned first and after 10min provision to webservice application.
Yes, you can customize the LCM Provisioning workflow to wait for this specific application or create a custom workflow then create a step to call the default LCM Provisioning workflow for other applications using step condition and for other applications , you can use a subprocess to create a step to create a plan to provision to AD and use default LCM Provisioning with approvalScheme and then wait for 10 minutes and create another step to create plan for webservices and in the next step you can call default LCM Provisioning.
@sboina24 If your requirement is specific to a set of apps, not for all apps, then modifying it in LCM is a risky approach. You can try to handle this in AD After Provisioning Rule, where you can create another plan to provision to the web services app and launch it after 10 mins.
If you try to achieve this in roles, then in your web services before provisioning rule you need to sleep the thread for 10 mins which will still hold the thread and over time it leads to slowness as most of the threads are in sleep mode.
So launching a workflow in AD After Prov, seems to be a better option.
Note: Found a fix?Help the community by marking the comment as solution. Feel free to react(
,
, etc.)with an emoji to show your appreciation or message me directly if your problem requires a deeper dive.
@sboina24 , the following shows the approach which I have explained above .
I think you can use the after provision rule in order to provision a web service application account. Once an AD account is provisioned, it will call the after provision rule. In the after provision rule, you create a provisioning plan for the web service and compile the provisioning plan. The execution of this plan can be implemented in this rule. You can implement a 10-minute wait and then execute the provisioning project.
Thanks,
PVR.
@Chathuryas / @neel193 / @Peddapolu
I had role configured and added a sleep in webservice before operation rule to achieve it. It works fine however i’m not a big fan of adding sleep in rule. I was looking for other alternatives
@sboina24 Don’t sleep inside the rule, it holds the thread while waiting and other module/processes can;t acquire it. That’s why doing it why workflow is preferred, where it releases a thread and create a workitem with the launch/resume date time.
@neel193 i don’t want to modify LCM provisioning workflow. Can you elaborate other route. As users will request Webservice application specific entitlement which inturn need to be added to AD group
@sboina24 could you please specify your requirement? Like in what order you want to assign entitlements? Do you want to assign web services ent first and then AD or other way around? and are users going to use Manage User Access to submit request?
@neel193 If a user comes and request for webservice entitlement from manger user access quicklink, after approval he need to be added to AD group first and then wait for 10min to get created in webservice application with entitlement they requested.
@sboina24 I am pinging you over chat to understand your usecase better. It is still not clear.
