RSA Governance & Lifecycle incorrectly approves changes in some Workflows with multiple approvals
2 years ago
Article Number
000068236
Applies To
  • RSA Identity Governance & Lifecycle 7.2.1
  • RSA Identity Governance & Lifecycle 7.5.0
  • SecurID Governance & Lifecycle 7.5.2
Issue
When using an Approval Workflow with parallel approval paths that uses "Grouped By Owner" with the Activity Node set to "Exclude" "Previous Approvers" the product may incorrectly identify a previous approver as being responsible to approve items in a different change request line item.

This causes the approval to be skipped and show as "Approval of <item> changes completed by System (No resources found to assign to)".
Cause
The algorithm to detect all the approvals where there are multiple levels of approvers did not correctly identify the change request items by category.
Resolution

This is resolved the following versions/patches:

  • RSA Identity Governance & Lifecycle 7.5.0 P08
  • SecurID Governance & Lifecycle 7.5.2 P04

These patches introduce an alternative method to calculate the correct approvers for all items in the change request. This method recursively searches for all possible approvers before calculating the approvals.

Note that the alternative method of calculating approvals is computationally expensive. Customers should evaluate the performance impact if they have applied the above patches (where the new method is enabled by default). See the following KB article for information on how to identify potential performance issues with this method:

Approval workflow slow or stuck in decision node in RSA Governance & Lifecycle


Note that the new method can be disabled to revert back to the previous behavior by using a custom parameter.  Please contact RSA Customer Support for more information on the custom flag used to enable or disable this feature.

Notes

Note that this feature is enabled by default in the following versions/patches:

  • RSA Identity Governance & Lifecycle 7.5.0 P08
  • SecurID Governance & Lifecycle 7.5.2 P04 through P07

This was changed and the new method is disabled by default in the following versions/patches:

  • SecurID Governance & Lifecycle 7.5.2 P08
  • RSA Governance & Lifecycle 8.0.0
Please contact RSA Customer Support for guidance on enabling or disabling this feature in these versions/patches.

Related Articles

Trending Articles

Don't see what you're looking for?