AnsweredAssumed Answered

Unable to Provision User

Question asked by vasudev verma on Apr 20, 2016
Latest reply on May 11, 2016 by vasudev verma

Like • Show 0 Likes0
Comment • 19

Hi All,

We are performing a POC , which include user provision only (First Use Case). We have created a request form for the same with default workflow. The issue we are facing is , when is submit a request for new user creation, after approval, the workflow status is changed to "Fulfillment state" and when checking further more details, it says "Wait for Verification". We are not able to get to whom is this verification is pending or how to process it.

Any help on this.

Screen shot of the same is attached.

Thanks,

Vasu

Attachments

pending verification.PNG48.9 KB

No one else has this question

Outcomes

19 Replies

Sean Miller Apr 20, 2016 12:23 PM
Mark Correct
Correct Answer
Wait for Verification generally means we are waiting for a future collection to confirm the change actually happened on the endpoint. We do this as part of our closed loop system to ensure what was requested in fact happened.

In this case, you need to collect from 'Active Directory' before this change request will move to completed.
Like • Show 0 Likes0
Actions
- vasudev verma @ Sean Miller on Apr 20, 2016 1:25 PM
  Mark Correct
  Correct Answer
  Does it means that user is provisioned in AD and application is waiting for the collection to confirm if the user has been provisioned or not ?
  
  Thanks,
  Vasu
  Like • Show 0 Likes0
  Actions
  - Boris Lekumovich @ vasudev verma on Apr 20, 2016 4:59 PM
    Mark Correct
    Correct Answer
    Usually when a workflow reaches the verification node, it means that the AFX tried to provision.
    In your screenshot, I don't see any comment (success or fail) under the status column (see screenshot below).
    I doubt that you will see that account in your AD.
    
    To answer your question, yes. The system is waiting for the collection to confirm a successful provisioning.
    Like • Show 0 Likes0
    Actions
    - vasudev verma @ Boris Lekumovich on Apr 21, 2016 9:06 AM
      Mark Correct
      Correct Answer
      Even though the user is provisioned and visible in AD, still the state if workflow does not changes. We did manually run the collection for the AD endpoint and the Users is present in AD and Aveksa, also the AFX has completed the item and same is visible in comment . What could be the issue, are we missing any step. I'm just listing the steps we performed
      
      Fill Up user form->Request Generated-> AFX handler did complete the request -> user provisioned and visible in AD -> Run the collectors on AD.
      
      Attaching the snippet.
      Thanks,
      Vasu
      Like • Show 0 Likes0
      Actions
      - Boris Lekumovich @ vasudev verma on Apr 21, 2016 9:52 AM
        Mark Correct
        Correct Answer
        Did you run identity collector from AD and also an account collector from AD?
        Like • Show 0 Likes0
        Actions
        vasudev verma @ Boris Lekumovich on Apr 22, 2016 6:23 AM
        Mark Correct
        Correct Answer
        Yes, we did but the workflow didn't change and it's not only in case of user provisioning, even for access change request/user termination etc. . once the AFX handler completes it's task, the workflow is in "wait for verification" state.
        
        Thanks,
        Vasu
        Like • Show 0 Likes0
        Actions
        Boris Lekumovich @ vasudev verma on Apr 25, 2016 9:34 AM
        Mark Correct
        Correct Answer
        It depends on the configuration of your form.
        Here is a screenshot of how I've configured the register user form on my system.
        The Account ID is configured as sAMAccountName. The meaning of it, that your account collector should be configured to collect sAMAccountNames as accounts.
        Is this setup similar to what you have?
        
        Like • Show 0 Likes0
        Actions
        vasudev verma @ Boris Lekumovich on Apr 26, 2016 4:24 AM
        Mark Correct
        Correct Answer
        Yes,
        
        We have configured the form in similar way.
        Like • Show 0 Likes0
        Actions
        Boris Lekumovich @ vasudev verma on Apr 26, 2016 4:46 AM
        Mark Correct
        Correct Answer
        Can you post a screen shot of your account collector configuration (from AD)?
        
        Similar to the screen shot below:
        
        Also post the attributes screen shot from your change request (similar to the screen shot below:)
        
        Like • Show 0 Likes0
        Actions
        vasudev verma @ Boris Lekumovich on Apr 28, 2016 3:56 AM
        Mark Correct
        Correct Answer
        PFB the same,
        
        Like • Show 0 Likes0
        Actions
        vasudev verma @ vasudev verma on Apr 28, 2016 4:09 AM
        Mark Correct
        Correct Answer
        Like • Show 0 Likes0
        Actions
vasudev verma May 5, 2016 2:33 AM
Mark Correct
Correct Answer
Any help on this. We are still facing this issue.
Like • Show 0 Likes0
Actions
- Boris Lekumovich @ vasudev verma on May 5, 2016 3:24 AM
  Mark Correct
  Correct Answer
  Try running the following SQL query and post the result:
  
  SELECT * FROM T_AV_DATAPROCEVENTWATCHES WHERE id = (SELECT watch_id FROM T_AV_CHANGE_REQUEST_DETAILS WHERE CHANGE_REQUESTS_ID=YOUR_CHANGE_REQUEST_ID);
  
  Replace 'YOUR_CHANGE_REQUEST_ID' with the actual value.
  The change request id can be taken from the URL (in the screenshot below, the value is: 598):
  Like • Show 0 Likes0
  Actions
  - vasudev verma @ Boris Lekumovich on May 5, 2016 6:12 AM
    Mark Correct
    Correct Answer
    Here is the output. Is this what we get executing the sql query, just numbers. ?
    
    Oracle Database 12c Enterprise Edition Release 12.1.0.2.0 - 64bit Production
    With the Partitioning, Automatic Storage Management, OLAP, Advanced Analytics
    and Real Application Testing options
    SQL> SELECT *
    FROM T_AV_DATAPROCEVENTWATCHES
    WHERE id =
    (SELECT watch_id
    FROM T_AV_CHANGE_REQUEST_DETAILS
    WHERE CHANGE_REQUESTS_ID=63); 2 3 4 5 6
    Like • Show 0 Likes0
    Actions
    - Boris Lekumovich @ vasudev verma on May 5, 2016 6:28 AM
      Mark Correct
      Correct Answer
      This is not the expected output.
      If there are not results, the output would be: no rows selected
      
      Try typing it in one row and do not paste it:
      SELECT * FROM T_AV_DATAPROCEVENTWATCHES WHERE id =(SELECT watch_id FROM T_AV_CHANGE_REQUEST_DETAILS WHERE CHANGE_REQUESTS_ID=63);
      
      Or execute the query in SQL Developer.
      Like • Show 0 Likes0
      Actions
      - vasudev verma @ Boris Lekumovich on May 5, 2016 7:13 AM
        Mark Correct
        Correct Answer
        Is this what you are excepting ?
        
        I tried executing the query in one line but it return error , I have executed the query based on the ID's present in the system.
        
        SQL> SELECT * FROM T_AV_DATAPROCEVENTWATCHES WHERE id = ( SELECT watch_id FROM T_AV_CHANGE_REQUEST_DETAILS WHERE CHANGE_REQUESTS_ID=63 );
        SELECT * FROM T_AV_DATAPROCEVENTWATCHES WHERE id = ( SELECT watch_id FROM T_AV_CHANGE_REQUEST_DETAILS WHERE CHANGE_REQUESTS_ID=63 )
                                                             *
        ERROR at line 1:
        ORA-01427: single-row subquery returns more than one row
        
        SQL> SELECT id FROM T_AV_DATAPROCEVENTWATCHES;
                ID
        ----------
                 2
                21
                43
                46
                64
                83
               123
               125
               126
               143
               147
        
                ID
        ----------
               168
               169
        13 rows selected.
        
        SQL> SELECT * FROM T_AV_DATAPROCEVENTWATCHES WHERE id=143;
                ID TYPE TARGET_ID     DATA_1
        
        ---------- ---- ---------- ----------
        DATA_2
        --------------------------------------------------------------------------------
        DATA_3                                             I S
        -------------------------------------------------- - -
        WORKFLOW_ID
        --------------------------------------------------------------------------------
               143 RU           -1         -1
        CN=Rohit Arora,ou=People,dc=users,dc=company,dc=local
                                                           Y O
        177:WPDS
        Like • Show 0 Likes0
        Actions
        Boris Lekumovich @ vasudev verma on May 5, 2016 8:00 AM
        Mark Correct
        Correct Answer
        It seems that the system expects the account name to be: CN=Rohit Arora,ou=People,dc=users,dc=company,dc=local
        
        In your collector configuration, you are collecting sAMAccountName as AccountName. Obviously the 2 values are different and that's the reason to why the CR is not completed.
        
        You should adjust your RegisterUser form.
        Like • Show 0 Likes0
        Actions
        vasudev verma @ Boris Lekumovich on May 5, 2016 8:59 AM
        Mark Correct
        Correct Answer
        The provided result of the sql query is of another directory, OPENLDAP. Sharing the screenshot of form for LDAP.
        
        Like • Show 0 Likes0
        Actions
        vasudev verma @ Boris Lekumovich on Jun 8, 2016 6:19 AM
        Mark Correct
        Correct Answer
        Even though if We change the setting in the request form, it's still the same. Workflow is not showing process after the "Wait for verification" state.
        Like • Show 0 Likes0
        Actions