000034303 - Workflows stuck in AFX fulfillment and/or Provisioning nodes in RSA Identity Governance & Lifecycle

Document created by RSA Customer Support Employee on Dec 13, 2016Last modified by RSA Customer Support on Apr 15, 2020
Version 4Show Document
  • View in full screen mode

Article Content

Article Number000034303
Applies ToRSA Product Set: RSA Identity Governance & Lifecycle 
RSA Version/Condition: 6.9.1, 7.0.0, 7.0.1
IssueWorkflows become stuck in AFX fulfillment nodes and/or provisioning nodes instead of progressing to manual activities in the case of AFX fulfillment workflows or to the next workflow node in the case of provisioning command nodes.

In the user interface (Admin > Workflow > Jobs tab), the workflows show as stalled:

Workflow flagged as stalled based on stall detection settings

User-added image

The esb.AFX-MAIN.log file ($AFX_HOME/esb/logs/esb.AFX-MAIN.log) shows an error result.  Any non-zero result other than returning: 0 -> Success indicates the AFX fulfillment failed:

2016-10-21 07:15:46.084 [INFO] org.mule.api.processor.LoggerMessageProcessor:197 - returning: 1 -> Error 
2016-10-21 07:15:46.084 [INFO] org.mule.api.processor.LoggerMessageProcessor:197 -
No async callback or error code 1 - queuing F fulfillment state request 

The aveksaServer.log file ($AVEKSA_HOME/wildfly/standalone/log/aveksaServer.log) has this error:

05/08/2016 10:44:00.613 DEBUG (Worker_actionq#ActionQ1#WPDS_232)
Service [AFX Fulfillment Handler]: getHandlerConfiguration
05/08/2016 10:44:00.629 DEBUG (Worker_actionq#ActionQ1#WPDS_232)
Async_Success#:for node id=3030335:WPDS completionCode 1
05/08/2016 10:44:07.832 ERROR (http- [com.aveksa.afx.common.service.AFXBaseService]
Exception during AFX SQL execution
java.sql.SQLException: ORA-01461: can bind a LONG value only for insert into a LONG column

Please refer to RSA Knowledge Base Article 000030327 -- Artifacts to gather in RSA Identity Governance & Lifecycle to find the location of the aveksaServer.log file for your specific deployment if you are on a WildFly cluster or a non-WildFly platform. The aveksaServer.log may also be downloaded from the RSA Identity Governance & Lifecycle user interface (Admin > System > Server Nodes tab > under Logs.)
CauseThis issue occurs when the record to be updated has been deleted from the data source independently from RSA Identity Governance & Lifecycle. As a result, AFX cannot find the record and does not know about the deletion.

This is a known issue reported in engineering ticket ACM-63935.
ResolutionThis issue is resolved in the following RSA Identity Governance & Lifecycle versions and patch levels:
  • RSA Identity Governance & Lifecycle  6.9.1 P16 
  • RSA Identity Governance & Lifecycle 7.0.0 P04
  • RSA Identity Governance & Lifecycle 7.0.1 P01
  • RSA Identity Governance & Lifecycle 7.0.2

WorkaroundIf the expectation is that this workflow node should always fail and proceed to manual fulfillment for all use cases, then you can modify the workflow to remove the AFX fulfillment node. 
NotesIn 6.9.1 the AFX log files are in $AFX_HOME/mule/logs and are prefaced with mule, i.e. mule.AFX-MAIN.log.