Delete Application bypasses approval process

[Mukul]

Noticed a weird behaviour and wanted a confirmation.

Under manage my access, if you select "Delete" corresponding to the application, it skips the approval process for underlying entitlements as well and competes the tasks without any pending task.

The entitlements request is configured to use workflow and we expect Saviynt to follow the workflow if there is remove access task for entitlements 

Any suggestions please?

[rushikeshvartak]

For Delete Account - Security System --> Access Remove Workflow  is used.

[Mukul]

Thanks and we do have approval attached to Access Remove Workflow. See below. This is the same workflow which is used for Add Access Workflow

[rushikeshvartak]

Can you share workflow to check why its becoming auto approved with no task

[Mukul]

 Yes here it is

[rushikeshvartak]

Workflow is incomplete there is no end block

[Mukul]

sorry what do you mean? This has been working fine for all our new requests

[rushikeshvartak]

from Grant Access  & Rejected Access - Down Arrow should go to End Request block

[Mukul]

okay sure...Let me try that. You recon thats the issue our delete approvals are not kicking in?

[Mukul]

Hello, I updated the workflow and tested the application removal. Still the same. See below

[rushikeshvartak]

enable "Create Dependent Entitlement Task for Remove Access"  under endpoint

[Mukul]

 It's already on

[rushikeshvartak]

• Instead of Entitlement owner try with manager approval in wf

[Mukul]

But that's not what we want. We want during the delete of application, all the corresponding applications shall go for the approval process

[Mukul]

Hi Rushikesh,

Found this in logs.

"2024-01-11T22:03:41.414+00:00","ecm","services.WorkflowService","http-nio-8080-exec-63-n4x59","DEBUG","Auto approval case "
"2024-01-11T22:03:41.415+00:00","ecm","services.WorkflowService","http-nio-8080-exec-63-n4x59","DEBUG","creating acc appr entry for Request access 414"
"2024-01-11T22:03:41.426+00:00","ecm","services.WorkflowService","http-nio-8080-exec-63-n4x59","DEBUG","creating acc appr entry for Request access 414 done"
"2024-01-11T22:03:41.426+00:00","ecm","services.WorkflowService","http-nio-8080-exec-63-n4x59","DEBUG","Completing request.. 213"
"2024-01-11T22:03:41.429+00:00","ecm","services.WorkflowService","http-nio-8080-exec-63-n4x59","DEBUG","Completed request.. 213"
"2024-01-11T22:03:41.429+00:00","ecm","services.WorkflowService","http-nio-8080-exec-63-n4x59","DEBUG","Close Request Called Status Completed grails.validation.ValidationErrors: 0 errors ARS_RequestsID=213"
"2024-01-11T22:03:41.429+00:00","ecm","services.WorkflowService","http-nio-8080-exec-63-n4x59","DEBUG","isautoapproved = true"
"2024-01-11T22:03:41.429+00:00","ecm","services.WorkflowService","http-nio-8080-exec-63-n4x59","DEBUG","Is auto approved case..

[Mukul]

"2024-01-11T22:03:41.560+00:00","arsms","c.s.s.a.s.impl.RequestAccessServiceImpl","http-nio-8787-exec-5-sl479","DEBUG","Approvers of request :: XXX:: [Mukul Mahajan (XXXXXXX)] "

[Mukul]

Hi @rushikeshvartak : it works when its assigned to manager

[rushikeshvartak]

Since remove account does not have entitlement your workflow is not working add if else block after start as below condition

requestcounts.DELETE_ACC_REQUESTS_COUNT > 0

if true then grant block

else entitlement owner ( remove access approval)