Request approval issue with workflow.

[Santosh]

Hello all, I am having hard time with a workflow request approval routing. The use case is such that,

1) if the request is made by application owner (user group) it will be auto approved.

2) if the request is made by application owner for themselves, it has to route to their manager before approval.

3) if the request is made for end user by non-application owner for certain entitlements "ABC, "BCD" or "CDE" then 1st approver is manager then resource owner (we assigned a user group).

The issue i'm facing is the manager's approval is never clearing even though they approve the certain entitlement, also noticed the account request itself gets stucked with manager's approval even though they did approve them.

[rushikeshvartak]

• You are using All owners approval - change to any owner.
• In start validate if its account if yes auto approve

[Santosh]

I tried that already using a Custom task Assignment--User Group( included the name of the user group)----Any owner approval.

Still got the same issue..

[rushikeshvartak]

Please share xml of workflow

[Santosh]

Here I include the WF,

<?xml version="1.0" encoding="UTF-8"?>
<process key="Santosh_EWF_WF" name="Santosh_EWF_WF" xmlns="http://jbpm.org/4.4/jpdl">
<start name="Start">
<transition to="foreachAccessRequest"/>
</start>
<java class="com.saviynt.workflowmgt.rejectaccess"
method="denyAccess" name="Reject Access">
<arg>
<object expr="#{requestaccesskey}"/>
</arg>
<arg>
<object expr="ACCESS NOT COMPLETED : REQUEST REJECTED___Reject Access"/>
</arg>
<transition to="All Approvals Complete Check"/>
</java>
<java class="com.saviynt.workflowmgt.grantaccess"
method="createAccess" name="Grant Access">
<arg>
<object expr="#{requestaccesskey}"/>
</arg>
<arg>
<object expr="ACCESS REQUEST COMPLETE : SENT TO PROVISIONER___Grant Access"/>
</arg>
<transition to="All Approvals Complete Check"/>
</java>
<foreach in="#{RequestAccessKeys}" name="foreachAccessRequest" var="requestaccesskey">
<transition to="Check appl owner self request"/>
</foreach>
<decision name="Check appl owner self request">
<transition to="Manager Approval">
<condition expr="#{(requestedby.username.contains(user.username)) eq true }"/>
</transition>
<transition to="Check requestor is appl owner">
<condition expr="#{(requestedby.username.contains(user.username)) ne true }"/>
</transition>
</decision>
<decision name="Check requestor is appl owner">
<transition to="Grant Access">
<condition
expr="((com.saviynt.ecm.identitywarehouse.domain.Usergroup_users.executeQuery(&quot;select ugu.id from Usergroup_users ugu where ugu.user_groupkey = '${endpoints.get(requestaccesskey)?.requestowner}' AND ugu.userkey= '${requestedby?.id}'&quot;)?.size() != 0)) == true " lang="groovy"/>
</transition>
<transition to="Manager Approval">
<condition
expr="((com.saviynt.ecm.identitywarehouse.domain.Usergroup_users.executeQuery(&quot;select ugu.id from Usergroup_users ugu where ugu.user_groupkey = '${endpoints.get(requestaccesskey)?.requestowner}' AND ugu.userkey= '${requestedby?.id}'&quot;)?.size() != 0)) == false " lang="groovy"/>
</transition>
</decision>
<task name="Manager Approval">
<assignment-handler class="com.saviynt.workflowmgt.managerAssignmentHandler">
<field name="removeitemcf">
<string value="true"/>
</field>
<field name="mitigatingControlRisk">
<string value="[]"/>
</field>
</assignment-handler>
<transition name="Approved By Manager Approval" to="Check Entitlement"/>
<transition name="Rejected By Manager Approval" to="Reject Access"/>
<on event="end">
<event-listener class="com.saviynt.workflowmgt.JBPMTaskEventListner">
<field name="msg">
<string value="null"/>
</field>
</event-listener>
</on>
</task>
<decision name="Check Entitlement">
<transition to="resource owner approval">
<condition expr="#{(entitlementslist.get(requestaccesskey) !=null AND entitlementslist.get(requestaccesskey)=='ABC' or entitlementslist.get(requestaccesskey)=='BCD' or entitement=='CDE') eq true }"/>
</transition>
<transition to="Grant Access">
<condition expr="#{(entitlementslist.get(requestaccesskey) !=null AND entitlementslist.get(requestaccesskey)=='ABC' or entitlementslist.get(requestaccesskey)=='BCD' or entitement=='CDE') ne true }"/>
</transition>
</decision>
<task name="resource owner approval">
<assignment-handler class="com.saviynt.workflowmgt.ArsCustomAssignmentHandler">
<field name="fieldname">
<string value="UserGroup___XYZ User Group___Any Owner Approval Required"/>
</field>
<field name="mitigatingControlRisk">
<string value="[]"/>
</field>
</assignment-handler>
<transition name="Approved By resource owner approval" to="Grant Access"/>
<transition name="Rejected By resource owner approval" to="Reject Access"/>
<on event="end">
<event-listener class="com.saviynt.workflowmgt.JBPMTaskEventListner">
<field name="msg">
<string value="null"/>
</field>
</event-listener>
</on>
</task>
<join multiplicity="#{quorum}" name="All Approvals Complete Check">
<transition to="End Request"/>
</join>
<java class="com.saviynt.workflowmgt.endrequest"
method="arsendrequest" name="End Request">
<arg>
<object expr="#{reqid}"/>
</arg>
<transition to="endRequest"/>
</java>
<end name="endRequest"/>
</process>

[rushikeshvartak]

Add Account check in start and also attach entsonly in security system under create task action,

[Santosh]

well, we want the manager to approve the account as well as entitlements as based on UC3, followed by resource owner user group in case if the request include entitlement out of those three.

UC1 auto approve of account and entitlement if the member of user group (endpoint resource owner) makes the request.

UC 2 is if the resource owner user group makes the request, it needs 1 tier approval of their manager.

[rushikeshvartak]

Then for manager approval use Custom Assignments block using custom query