Task is creating without Approvals - (Workflow issue)

[ShyamSrisailam]

Hi,

We have a workflow where it goes for 2 level approval (Manager and Group Owner OR Entitlement Owner). Once the user submits the request in ARS it goes for manager then it checks the condition that, (entitlement.customproperty39 == '') or (entitlement.customproperty39 eq null) entitlement CP39 will be stored with the Group Owner. If there is no value in CP39 then it checks other condition that (entitlement.ownerRank1 == null) or (entitlement.ownerRank1.size() == 0 ) then it goes for Entitlement Owner approval then it Grants.

NOTE: we need to check the null value for ent CP39 and for ent Owner because there are some requests without any entitlement while submitting the ARS requests, that is why we kept entitlement.ownerRank1 == null and entitlement.customproperty39 eq null

Issue:

After manager approval if the Group Owner is present in CP39 it goes for Entitlement Owner and at the same time it's creating the Task without Owner approval. Same is happening with Entitlement Owner approval (If Entitlement Owner is present then it goes for Ent Owner and creating Task without Ent Owner approval)

If you see in below Screenshot Group Owner has rejected but the task has created directly without Owner Approval

Workflow setUp:

Let us know, what is the right condition to use in IF-ELSE. We tried below but No result.

(entitlement.ownerRank1 == null or entitlement.ownerRank1.size() == 0 )

((entitlement.ownerRank1 == null) or (entitlement.ownerRank1.size() == 0 ))

(entitlement.customproperty39 == '' or entitlement.customproperty39 eq null)

((entitlement.customproperty39 == '') or (entitlement.customproperty39 eq null))

If I try update the IF-Else with Groovy then it's not even Approving the manager request.

[sudeshjaiswal]

Hello @ShyamSrisailam,

Could you please specify which task is being created? If it's a new account with entitlement, the new account task will be created after manager approval. Only the "add access" task will proceed to the next approval stage.

It would be helpful if you mentioned or indicated whether the task being created is for a new account or for adding access.
Additionally, if you want to differentiate between normal requests and entitlement requests, you can use the condition "entitlement != null" for checking entitlement.

Thanks,

[ShyamSrisailam]

Hi @sudeshjaiswal 

The request is for New Account and Add Access. 

In endpoint > Entitlements with New Accounts(Default entitlements) > Here, we added Other endpoint entitlements (Once the task gets created after approvals these entitlements gets assigned by default).

Now the flow should go like > Once user submits request > Manager Approval (New Account/Access) > Owner Approval (Add Access) > Task creation for (Default entitlements Access/New Account/Access)

Here, the task should create only after Manager and Owner approves the entitlement Access but it's creating task without Owner approval only for Default entitlements not for New Account OR for Add Access which are requested in ARS (if Owner rejects the request then it won't create then access task but it also not creating the task for New Account)

The task should not create unless all the approvals are done even though it's still pending with Access approval. Can we make this happen

NOTE:

As per my understanding New Account/Add Access task should only create after the Approvals. Let me know if I'm wrong.

[sk]

Since you have seperated the WF for Account and Entitlement where account goes through one level approval and entitlement goes through two level approval task gets created for account first without being waiting for entitlement approval.

To avoid this what you can try do is, in Security system make Create Task action as EntitlementOnly and also make entitlement as mandatory. With this setting task won't get created for account alone unless an entitlement is approved. But incase if you have a requirement for account only request without entitlement that cannot be achieved in this way

[shivmano]

With entitlementsOnly action, can we still get the Entitlements with New Account added? Will Serial workflow not help here ?

[sk]

@shivmano : Yes entitlements with new account should work. Also YES serial WF is another approach you can try

[ShyamSrisailam]

Hi @sk 

We made the change on Create Task action as EntitlementOnly in security system and we also have Entitlements with New Account in endpoint. Once the request is submitted the entitlement is going for Group Owner Approval and It's creating task for Entitlements with New Account entitlements without Group Owner Approval.

Is this the way it works? because if it creates a task for Entitlements with New Accounts first and what if the Group owner rejects the Add Access. In this case user shouldn't get access to the entitlements inside Entitlements with New Account, right ?

[sk]

Are you saying without entitlement getting approved a task is created for entitlement that is added under Entitlements with New Account? If so do you see any new account task is also getting created?

[ShyamSrisailam]

@sk 

Yes, without entitlement getting approved, a task is created for entitlement that is added under Entitlements with New Account.

No, we don't see New Account task because we selected Create Task Action - EntitlementOnly in Security System. 

[Sampritha_r]

Hello @ShyamSrisailam ,

Entitlements with New Account: This feature is to create New account and add access on the Enpoint 2 during New Account creation on Endpoint 1.  Let's say, You submit New Account and Add access of endpoint 1 through ARS, once manager approval is completed , there are 3 tasks that get created. 

1. Endpoint 1 New Account Task

2. Endpoint 2 New Account Task

3. Endpoint 2 Add Access Task 

It wont wait until Endpoint1 Entitlements complete Entitlement Owner Approval as "Entitlements with New Account" itself says to provide Endpoint2 Entitlements on New Account creation of Endpoint1. If your requirement is to not create any task until Endpoint1 Entitlements are approved, then you need change workflow configuration to support creating tasks after all approval requests complete. 

Reference Forum Link to achieve this. 

https://forums.saviynt.com/t5/saviynt-knowledge-base/how-to-configure-all-approval-workflow-to-creat...

[ShyamSrisailam]

@Sampritha_r 

Thank You for the link, it should be helpful. I'll check it out.

How to configure All Approval Workflow to create t... - Saviynt Forums - 28987

On the same issue, we are sending Entitlement values in a tabular format in the Approved Email (Grant Access), since the Add Access (Entitlement) is still in pending with Owner Approval and task is creating directly without Owner Approval. We are receiving the Approved email without entitlements in table.

I understand that the above link you provided will solve this issue but, is there any other way we should send the email only if Entitlements are approved so that the entitlement with show up in email OR anything that we can change in email template?

[sk]

If I understand correctly looks like you still splitting the WF for account and entitlement and making account as auto approval where as entitlement goes through approval and using one grant block for both. If that is the case you can try separating grant blocks for account approval and don't attach email template over there whereas another grant block you going to use for entitlement approval there you can assign email template which should solve the issue.

[ShyamSrisailam]

Hi @sk.

No, First New Account and Add Access will go for Manager approval Once manager approves then Add Access goes for Group Owner/Entitlement Owner Approver. Once New Account and Add access approves we are not sending it for GrantAccess, it's checking the if-else condition whether it has to go for Owner Approval or not, if it fails then it goes for GrantAccess.

 @Sampritha_r ,

I have checked the link you provided regarding the Task has to create only if all the Approvals are done. I've tried it but didn't get the expected solution. Can you please help me updating the XML snippet. I'm attaching the .zip file.

FYI, file consists of conditions where we mentioned in if-else block and the Email template Names also

.

[Sampritha_r]

Hello @ShyamSrisailam 

I have made changes to your workflow XML as per your requirement. Attached is the updated XML. 

Before loading the changed XML workflow into the Saviynt system, update the following entries in ‘workflowhistory’ table.

1. Set the status of this workflow in workflowhistory = 3.
2. Update the xmldata col with this workflow.
3. update ‘workflowhistory’ set WFLOADED=0 where WORKFLOWKEY = ;
4. Saviynt UI approves the workload So that it is approved and loaded successfully

[ShyamSrisailam · Accepted solution]

Hi @Sampritha_r ,

Thanks for checking into the XML but the provided XML didn't work.

I got an another XML with resolved the issue by following the below steps one after other. Attaching the XML workflow.

1. Set the status of this workflow in workflowhistory = 3.
2. Update the xmldata col with this workflow (OR) Import the Updated XML through Transport feature.
3. update ‘workflowhistory’ set WFLOADED=0 where WORKFLOWKEY = ;
4. Saviynt UI approves the workload So that it is approved and loaded successfully

[Sampritha_r]

Hello @ShyamSrisailam 

Thanks for sharing the XML. 

[ShyamSrisailam]

Hi @Darshanjain,

I've seen your post regarding, task has to create after all the approvals. I have the same requirement and I've tried the steps that you mentioned but didn't know what I'm missing in the XML code. I have pasted the .zip file in my previous post. So, can you please update the file correctly and send it here.

Post regarding: How to configure All Approval Workflow to create t... - Saviynt Forums - 28987

It would be more helpfull!