000037452 - Change Requests in RSA Identity Governance & Lifecycle sometimes complete but bypass both AFX and manual fulfillment and do not modify the endpoint

Document created by RSA Customer Support Employee on May 9, 2019Last modified by RSA Customer Support Employee on May 10, 2019
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000037452
Applies ToRSA Product Set: Identity Governance & Lifecycle
RSA Version/Condition: 7.0.2, 7.1.0
 
Issue

Intermittently, change requests in RSA Identity Governance & Lifecycle complete but bypass both AFX and manual fulfillment and do not modify the endpoint. 

In this scenario, the processing workflow of the change request looks like this:



User-added image



The same change request using the same workflow sometimes works. In this case, the processing workflow of the change request looks like this:
 



User-added image



This can happen in the same Change Request where two different change request items show as completed but one provisions to the endpoint and one does not.

CauseThis issue occurs when the first node is a fulfillment node. In most workflows the first node is an approval node.  The first approval or fulfillment node processed will create the sub-processes for the job, But there is a defect reported in ACM-83585 where the fulfillment node does not always create the sub-processes for the job.


 
ResolutionFixed in 7.0.2 P08 and 7.1.0 P02.
Workaround

The workaround is to add a non-operational Approval node as the very first node in your approval workflow.  To do this you would add a normal Approval node and set the settings under Behavior to Do Not Process, as shown:



User-added image



This will essentially create an auto-approval node. The only downside to this would be that the workflow would have a bit more overhead, but not significantly so. This node can be removed once the appropriate patch is installed.

Attachments

    Outcomes