Time bound roles creating two remove access tasks for the same entitlement

[Nidhins27]

We have a firefighter role: ROLE_ADMIN which has an entitlement inside it "ROLE_ADMIN".

whenever the end date is reached, system generated two remove access tasks for the same entitlement.

This is happening intermittently.

When checked in db both the remove access tasks are created for same entitlement value. One gets completed and other one fails with "No action required". Creation date of both the tasks also looks very confusing.

[rushikeshvartak]

As long as role is getting removed it should not be issue. this happens when workflow approval block is sent 2 times to grant 

[Nidhins27]

But these are autogenerated removal tasks. They are not going through any approval.

[rushikeshvartak]

Does job is scheduled time entering end date job.

does both tasks have same end date in arstasks table?

[Nidhins27]

There is no enddate defined in the two remove tasks.

Howerve, add access task had a enddate date based on which these remove tasks are created.

Also, The job "create tasks for future ent and roles" is scheduled to run every 10 mins.

What I am suspecting is, The moment end date is reached, a remove task is generated. and if withing ten mins if it is not provisioned, and "created tasks for future ent and roles" is run before previous task is completed, it generates another task.

I may be wrong.

[rushikeshvartak]

What is global configuration for time delay ?

Tasks - > Create Task if Start date less than

[Nidhins27]

There are no configs set.

[rushikeshvartak]

Overall What is impacting of duplicate task?

are you using entitlement map concept ? Is this behavior with all role for application?

[Nidhins27]

This behaviour is only for the time bound roles.

I have found out something.

when the role reaches its enddate, immediately the task is generated by job (create tasks for role n ent).

if this task is completed before the next run of the job it doesn't generate another tasks.

Also, I have nothiced when first task is in-progress status and i run this create task job manually, it doesn't generate any other task. It generates the duplicate task when previous task is picked up by the provisioning job and in the meantime create task job runs, duplicate task is created.