SOD Evaluated Requests Approval Workflow Issue

[SPP]

Hi All,

We have a 2 level appproval workflow configured for an application where in the first level approval is setup for SOD Risk Owners if there are any SOD violations detected and the second level is setup for Ent Owner if the entitlement is soxcritical - Medium, High, Very High otherwise it gets autoapproved.

Issue: A request is submitted for the entitlements that have SOD violations. The request for approval is sent to first level approval to the owners. Once the request is approved at this stage, the if else block to check Entitlement soxcritical condition is failing and the entitlements are getting auto-approved. Below is the workflow configured

Request got completed after Level 1 approval, if else block EntSoxCheck condition is failed. The expected behaviour is that request approval must go to second level EntOwner approval as the entitlements are Soxcritical High

[This message has been edited by moderator to mask sensitive info]

[Raghu]

can you confirm insteadOf entimt.soxcritical>3  , try

1. entitlment.soxcritical==3

2. entitlment.soxcritical=='3'

[SPP]

@Raghu 

I've tried both the ways, it still doesn't go to second level approval. Also FYI, If the SODCheck & SODRiskOwner Approval blocks are removed in the workflow, entimt.soxcritical>3 condition is working as expected.

[Raghu]

entimt.soxcritical>3 if else block chaining may be issue , pointing reject and owner block accept scenario both tagging same if block .

what is error in logs?

[SPP]

@Raghu It's going to EntSoxCritical If-else block but the condition is always failing. If I point both true and false scenarios to EntOwner Approval block, it goes to second level approval. 

Note: Updated EntSoxCheck condition to entitlement.soxcritical=='5' for testing purpose

The same condititon (entimt.soxcritical>3) is working fine when SOD blocks are removed.

[rushikeshvartak]

It seems you are using serial workflow where entitlement object is not exposed. please use parallel workflow

[SPP]

@rushikeshvartak  

As per the documentation, SOD Owner Approval blocks are only used in Serial Workflows

Link - https://docs.saviyntcloud.com/bundle/SSM-Admin-v55x/page/Content/Chapter11-Workflows/Workflow-Compon...

[rushikeshvartak · Accepted solution]

You can use Parallel workflow with custom assignment block

https://forums.saviynt.com/t5/identity-governance/dynamic-attribute-for-risk-owner-in-workflow/td-p/...

select u.userkey
from request_exceptions RE INNER JOIN riskowners RO ON RO.RISKID=RE.EXCEPTIONKEY
INNER JOIN Users U ON U.userkey=RO.OWNERUSERKEY
where RE.REQUESTKEY=${ARSREQUEST.id}

[SPP]

@rushikeshvartak  Yes, looks like the custom assignment block with a custom query is working as expected. However, I still don't understand the problem with SOD blocks.