000034303 - RSA Identity Governance and Lifecycle AFX error:  Workflow flagged as stalled based on stall detection settings

Document created by RSA Customer Support Employee on Dec 13, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000034303
Applies ToRSA Product Set: Identity Governance and Lifecycle
RSA Version/Condition: 6.9.1, 7.0.0, 7.0.1
Product Name: RSA Identity Governance and Lifecycle 
 
IssueThe Access Fulfillment Express (AFX) fulfilment workflow nodes do not progress either to automated or manual fulfillment.  The node is stuck with the following state.

Workflow flagged as stalled based on stall detection settings

User-added image

The /home/oracle/AFX/mule/logs/mule.AFX-MAIN.log shows an error result.  Any non-zero result other than returning: 0 -> Success indicates the AFX fulfillment failed. 
2016-10-21 07:15:46.084 [INFO] org.mule.api.processor.LoggerMessageProcessor:197 - returning: 1 -> Error 
2016-10-21 07:15:46.084 [INFO] org.mule.api.processor.LoggerMessageProcessor:197 - No async callback or error code 1 - queuing F fulfillment state request 
2016-09-28 13:38:05.810 [INFO] org.mule.api.processor.LoggerMessageProcessor:197 - returning: 1 -> Failed
2016-09-28 13:38:05.811 [INFO] org.mule.api.processor.LoggerMessageProcessor:197 - No async callback or error code 1 - queuing F fulfillment state request


 
CauseIt is anticipated that some AFX requests may fail, (for a variety of reasons, and the AFX workflow model accommodates for that by allowing the AFX request to return an status code and allows the AFX workflow to consume the status message as either a success or a failure. On a successful result, the AFX workflow should proceed with the provisioning event marked as complete.  On an error result, the workflow should also proceed; but on a different workflow path that typically includes generating a manual fulfillment request, or some other error handling path.  
The following versions and patches have a defect that prevents the Workflow engine from correctly interpreting the AFX error response.  
  • RSA Identity Management Governance and Lifecycle 6.9.1 P13 
  • RSA Identity Management Governance and Lifecycle 7.0.0 P01
  • RSA Identity Governance and Lifecycle 7.0.1 GA

If the AFX request returns a successful result the workflow will continue, but if the AFX request returns any non-zero error status, the status is not interpreted correctly and the workflow stalls. If there is an alternate workflow path for manual fulfillment or error handling the workflow does not proceed to this node. Note that the entire workflow is stalled so no further processing occurs.  


  • Note that this error may not be obvious if the AFX provisioning is working correctly as this issue only occurs if there is an AFX provisioning error.   
  • Note that if the customer has an existing workflow where the AFX provisioning is always expected to fail (for example the workflow contains a placeholder node for a future automated AFX provisioning feature that is not yet fully implemented) and the manual provisioning workflow path is the path that is normally executed, when the customer patches to a version with this defect the manual provisioning event will stall. 
ResolutionThis issue is resolved in the following versions and patches.
  • RSA Identity Management Governance and Lifecycle 6.9.1 P16 
  • RSA Identity Management Governance and Lifecycle 7.0.0 P04
  • RSA Identity -Governance and Lifecycle 7.0.1 P01



















 
WorkaroundIf the expectation is that this workflow node should always fail and proceed to manual fulfillment for all use cases, then you can modify the workflow to remove the AFX fulfillment node. 
NotesThis solution does not discuss the many possible ways the AFX fulfillment process might return a non-zero failure result code.  If the failure is unexpected, this failure must be investigated separately. 

Attachments

    Outcomes