RSA Governance & Lifecycle Services 101: Explaining Workflow Nodes - Summary
2 years ago
Originally Published: 2019-12-11

RSA Governance & Lifecycle Services 101 blogs help to explain various areas of RSA Governance & Lifecycle, to ensure you are getting the most out of the product and following recommended practices. We hope to show you lots of great features, tips and tricks that you may not have been aware of!

This article provides a high level index and summary of each workflow node available, taken from v8.0 of RSA G&L. As we dive into more detail of each node, we will provide link(s) below, to click and get more info. For example, please click "Milestone" in the following table.

Workflow Node Summary

The workflow editor includes processing nodes common to and also specific to request, approval, fulfillment, and escalation workflows. Nodes are the building blocks you use to create and modify workflows. The following table lists nodes that you can use in workflows for Requests, Reviews, and/or Rules.

 

Node

Description

Activity

Used to define a activity for a change request.

Approval

Used to define an approval for a change request.

Approvals Phase

Used to allow change request items to be approved as groups at the same level.

Cancel Change Request

Used to generate a milestone to cancel the entire change request processed by the workflow and revert all changes completed in the change request, reject the entire change request processed by the workflow, or put the change request in an error state.

Change Review State

Changes the state of a review to the selected state.

Collect Accounts 

Used to collect accounts by running an Account Collector.

Collect Entitlements

Used to collect entitlements by running an Entitlement Collector.

Collect Identities

Used to collect users/identities by running an Identity Collector.

Collect Roles

Used to collect roles by running a Role Collector.

Complete Assigned Work

Used in an escalation workflow to mark work assigned to a user (through an approval or activity) as completed.

Create Admin Error

Specifies the type of admin error to create for an administrator.

Decision

Evaluates a condition(s) based on a true or false result for outgoing transitions to an action or stop delimiter based on whether or not the condition exists.

Delay

Suspends a workflow temporarily based on date criteria. The date could be a specific date, the change request fulfillment date, a system calculated date relative to current time, the result of a java method that returns a date, or the result of a SQL query resulting in a date.

Form Approval

Used to define an approval for a change request generated from a form.

Form Fulfillment

Used to define a fulfillment for a change request generated from a form.

Fulfillment Handler

Invokes a Java class to fulfill changes in a request.

Fulfillment Phase

Used to allow change request items to be fulfilled as groups at the same level.

Get Remaining SecondsUsed to store how much time remains for a calculated due date, performs some escalation outside of the assigned user’s control, and then updates the due date for the assigned user based on the earlier recorded remaining time.

Java *

Provides an interface to a Java method passing any parameters and returning a true/false result you can incorporate into a workflow.

The Java node, can evaluate conditions and perform actions in a workflow required for an approval and to initiate completion of an activity.

Note: If your workflow uses the Java node or the Java tag in workflow forms, upload all required custom JARs under Admin > Workflows > Custom Code in the UI before executing the workflow.

A sample Java Node workflow is available under Approval Workflows. It demonstrates how to invoke a Java class from a workflow and integrate it into the workflow execution process.

The source code for the sample class used by Java Node workflow is included in the following directory:

aveksa.ear/aveksa.war/WEB-INF/plug-ins/JavaNode/src/

Job State

Specifies a job state the pauses a workflow: Canceled, Error, or Suspension

Manual Fulfillment

Used to handle a fulfillment manually and not automatically by the system.

Mark Review Items

Marks the reviewer’s items to Maintain, Revoke, or any configured custom state.

Mark Verified

Marks the reviewer’s items to Verified state.

Milestone

Provides high-level status information about a workflow milestone you want displayed in a change request.

Next Value

Returns the next value for a given job level workflow variable. If no value is returned (the last value was previously retrieved), the node returns false, which can be tested on an outgoing transition. If a valid value is returned, a true return code is provided. This node is typically used to iterate through an array of values to get the next value in the array..

Process Remediation

This node will create change requests for the entitlements that will be removed and mark violation as an exceptional access for those that will be maintained.

Provisioning Command

Used to complete a provisioning command in a data source for a particular business source.

Reassign

Used to assign an approval or activity to another user.

Request Form Activity

Used to define a form-based activity in a rule provisioning workflow. This node assigns a manual activity related to a request form so that the assigned resource can review, complete, or act on the form details during provisioning. 

Reset Password

Used to generate an email notification prompting a user to retrieve a password that has been reset for the user.

REST Web Service *

Invokes a REST call to an endpoint. The responses and results from the calls are stored in the workflow variables based on the configuration in the node. This information can be used in a workflow’s decision logic.

The node supports:

  • GET and POST methods
  • Basic authentication
  • Header parameters.
  • XML and Properties response types
  • Parsing of the response using XPath and RegEx expressions.

Rule Remediation

Users are assigned to process the Rule Violation based on how the remediators tab is configured.

Rule Revoke Violations

Automatically generates change requests to revoke the offending entitlements associated with open rule violations without requiring manual remediator action.

Run Report

Generates a report configured for the node in the workflow.

Run Review

Used to generate a user access review associated with the node.

Run Unification

Used to run the Unification.

Send Email

Generates email you want from the workflow. It supports the use of workflow variables or runtime workflow information to specify the To/From portions of the email.

Set Value

Creates or updates a job level workflow variable(s) using the value(s) provided. The value can be a literal or use other workflow variables that are evaluated at the time the node is executed

SOAP Web Service *

Invokes a SOAP call to an endpoint. The responses and results from the calls are stored in the workflow variables based on the configuration in the node. This information can be used in a workflow’s decision logic.

The node supports:

  • POST method
  • Basic authentication
  • WS-Security
  • Generic MIME Header
  • SOAP based XML response type
  • Parsing of the response using XPath and RegEx expressions

SQL Execute *

Runs an Insert/Update/Delete SQL command or a stored procedure where no result set is needed. It runs against the system database (AVDB). This node supports variables from the workflow with the SQL.

If you want to use an output parameter from your stored procedure (say, ‘success’ or “failure’ status) as a workflow variable for subsequent processing, you must define the stored procedure as a function and use the following syntax:

select sp_update_db (‘JOE’, ‘SMITH’, status) status from dual.

SQL Select *

Executes a SQL SELECT query against the system database (AVDB) and stores the returned column values as workflow variables for use in subsequent nodes. Supports parameterized queries using workflow variables (${} syntax) and configurable variable scope (Job, Node, or Public).

Start

Used as the start delimiter for a workflow.

Stop

Used as the stop delimiter for a workflow.

Subprocess

Calls/interjects another workflow as a subprocess of the current workflow. This node is useful in compartmentalizing work items or to improve maintenance or re-use of workflows.

Technical Approval

Used to define a technical-level approval for a change request. This node routes approval work to technical owners or other configured technical approvers and supports the same approval configuration options, including resources, behavior, and approval form settings.

Text

Used to enter text into a workflow.

Transition

Used to connect two workflow nodes (processes) unidirectionally with a straight line. Transitions can be conditional or unconditional. A conditional transition occurs only if a particular condition is true. An unconditional transition can occur regardless of whether a condition is true. A transition is visually represented as an arrow.

Undo Changes

Used to generates changes to reverse the requested changes that have been fulfilled.

Update Work

Used in an escalation workflow to request a new date or a new priority for a work item using the comment field during escalation creation.

Wait for Verification

Used to create a database watch for evidence of a change request fulfillment.

Note: Not all controls and types are available for every workflow type. Also, nodes with an asterisk symbol (*) are designed for advanced application. These nodes should be implemented carefully because poorly defined nodes can negatively impact workflow performance.