Approval for Entitlements in an Enterprise Role

[JohnLawson]

For any given enterprise role, we have a requirement for all entitlements with a certain soxcriticality to be sent for approval to the entitlement owner. So far, we can do the flow for individual entitlements that were not requested via an enterprise role. Is it possible?

This post seems to show a conditional to go to the normal entitlement approval block but that hasn't been working:https://forums.saviynt.com/t5/identity-governance/route-role-request-to-entitlement-owner/m-p/70739 

I tried making a barebones workflow to get individual entitlement approvals when a role is requested but no luck:

Any suggestions?

[rushikeshvartak]

You need to use custom query in custom assignment block. Post shared is specific to role management workflow 

[JohnLawson]

What query would need to be used in the assignment block? Do you know?

[rushikeshvartak]

• use below tables
• ars_requests,request_Access,role_entitlements,entitlement_owners

[JohnLawson]

I've setup a custom approval block with the following query:

SELECT eo.userkey FROM ars_requests ar left join request_access ra on ar.REQUESTKEY= ra.REQUESTKEY left join roles ro on ro.rolekey = ra.ACCESSKEY left join role_entitlements re on ro.ROLEKEY=re.ROLEKEY left join entitlement_values ev on re.ENTITLEMENT_VALUEKEY=ev.ENTITLEMENT_VALUEKEY left join entitlement_owners eo on eo.entitlement_valuekey=ev.ENTITLEMENT_VALUEKEY WHERE ar.requestkey=${ARSREQUEST.id}

 but it generates just one approval even when there are two entitlements they should each have an approval. Is there any way to have it generate an approval for each entitlements in the role?

[rushikeshvartak]

It will be for all entitlements owners in 1 level you can't split approval per entitlements in role

[dgandhi]

Why do you want it to send to individual entitlement owners for approval? Since entitlement is part of role , it should go for role owner approval only.

[JohnLawson]

In case a role has entitlements with different approvers. For example entitlement A has approver A and entitlement B has approver B but the enterprise role contains both. Essentially using it as a way to bulk request commonly grouped entitlements while still respecting the entitlement approvers for each entitlement.

[rushikeshvartak]

That can't be done, Again, with custom assignment block  also it will combine all approvers of entitlements into one block

[dgandhi]

Ideally this needs to be done at Role Creation level, when role is created with entitlement, it goes to each entitlement owner for approval where in each entitlement owner will certify whether the mentioned entitlement can be part of role or not. Once they approve that it can be part of role and in that way whenever role is requested in future, it can only go through role owner approval (as entitlement owner have already certified this role as part of role creation process)