User Application Role and Resource Provisioning Requests

Hi I'm using User application with IDM 4.7.
I would like to create a workflow in order to allow a manager to approve or revoque a Provisioning Request for roles and resources.
I noticed that under the UA/Entitlements in designer there is a series of templates of workflows.
But these workflows are only simulated by an PRD in AD and not by the Request page where users can normally request roles.
I've tried to solve this problem by adjusting the options of the role created in role catalog and require an approval from a manager.
But what is really weird is that once the user requests the role it is provisioned immediately without approval.
Is it normal to have such response? I think i must be missing something in the process.
What is the right way of doing this?
Parents
  • vkhoury;2491067 wrote:
    Hi I'm using User application with IDM 4.7.
    I would like to create a workflow in order to allow a manager to approve or revoque a Provisioning Request for roles and resources.
    I noticed that under the UA/Entitlements in designer there is a series of templates of workflows.
    But these workflows are only simulated by an PRD in AD and not by the Request page where users can normally request roles.
    I've tried to solve this problem by adjusting the options of the role created in role catalog and require an approval from a manager.
    But what is really weird is that once the user requests the role it is provisioned immediately without approval.
    Is it normal to have such response? I think i must be missing something in the process.
    What is the right way of doing this?


    I realized that once a user request a role the request remains in pending state for about 24 hours before appearing in the task section of the user responsible of provisioning the role.
    However, I don't know why it's taking that much time and if tif this can be configured or not.
  • vkhoury;2491194 wrote:
    I realized that once a user request a role the request remains in pending state for about 24 hours before appearing in the task section of the user responsible of provisioning the role.
    However, I don't know why it's taking that much time and if tif this can be configured or not.


    This is the Role
  • On 11/21/2018 5:36 AM, sma wrote:
    >
    > vkhoury;2491194 Wrote:
    >> I realized that once a user request a role the request remains in
    >> pending state for about 24 hours before appearing in the task section of
    >> the user responsible of provisioning the role.
    >> However, I don't know why it's taking that much time and if tif this can
    >> be configured or not.

    >
    > This is the Role
  • Geoffrey Carman <geoffreycarmanNOSPAM@NOSPAMgmail.com> wrote:
    >
    >
    > The RRSD driver is interesting in how it works.
    >
    > It events on certain things (users, nrfRequest objects,
    > nrfResourceAssociation objects) and it checks dynamic groups on a
    > schedule. It also seems to look for events due on a schedule as well.
    >
    > So if you have something with a pending time period, then RRSD is what
    > is watching for that to come due and process it. (Perhaps you have set
    > RRSD to a very long polling interval to reduce load from checking a lot
    > of dynamic groups?)
    >


    IiRC Polling period for other things than dynamic groups canâ€Tmt be tweaked.

    More likely the RRSD driver was stuck/stopped and that is explanation for
    delay.




  • On 11/21/2018 2:13 PM, Alex McHugh wrote:
    > Geoffrey Carman <geoffreycarmanNOSPAM@NOSPAMgmail.com> wrote:
    >>
    >>
    >> The RRSD driver is interesting in how it works.
    >>
    >> It events on certain things (users, nrfRequest objects,
    >> nrfResourceAssociation objects) and it checks dynamic groups on a
    >> schedule. It also seems to look for events due on a schedule as well.
    >>
    >> So if you have something with a pending time period, then RRSD is what
    >> is watching for that to come due and process it. (Perhaps you have set
    >> RRSD to a very long polling interval to reduce load from checking a lot
    >> of dynamic groups?)
    >>

    >
    > IiRC Polling period for other things than dynamic groups canâ€Tmt be tweaked.
    >
    > More likely the RRSD driver was stuck/stopped and that is explanation for
    > delay.


    Or slow? It is within the realm of possibility that evaluating the
    Dynamic groups took that long. (Would be a very very bad design if true...)


Reply
  • On 11/21/2018 2:13 PM, Alex McHugh wrote:
    > Geoffrey Carman <geoffreycarmanNOSPAM@NOSPAMgmail.com> wrote:
    >>
    >>
    >> The RRSD driver is interesting in how it works.
    >>
    >> It events on certain things (users, nrfRequest objects,
    >> nrfResourceAssociation objects) and it checks dynamic groups on a
    >> schedule. It also seems to look for events due on a schedule as well.
    >>
    >> So if you have something with a pending time period, then RRSD is what
    >> is watching for that to come due and process it. (Perhaps you have set
    >> RRSD to a very long polling interval to reduce load from checking a lot
    >> of dynamic groups?)
    >>

    >
    > IiRC Polling period for other things than dynamic groups canâ€Tmt be tweaked.
    >
    > More likely the RRSD driver was stuck/stopped and that is explanation for
    > delay.


    Or slow? It is within the realm of possibility that evaluating the
    Dynamic groups took that long. (Would be a very very bad design if true...)


Children
No Data