AnsweredAssumed Answered

Register User Form - Wait for verification

Question asked by Marco Sannino on Apr 4, 2017
Latest reply on Dec 4, 2017 by Erika Szabo

Like • Show 0 Likes0
Comment • 6

Hi all,

i have a Register User form where i'm trying to provision a new user (and account) on AD Endpoint. When my form (it's a very simple form with only Register Provisioning Command (Non-Visual)) is run, a request is created, and the right user is provisioned (i can see it on AD and i can also collect it) BUT the request is stucked in 'Wait for Notification' node (that is a 'Wait for verification' node) even if i collect or other. Any ideas? i have no AFX error logs and all seems to work well but i can't understand why it does not work.

Thank you all in advance.

ps Via 7.0.1.122913 P02 (SP1 Patch 02)

Mostafa Helmy

Apr 5, 2017 5:10 AM

Correct Answer

The Register User is an Account Creation beneath the hoods which uses the "Create Account" AFX capability. The request will only verify if you run the ADC and collect an Account with the name you specified in the form.

In the Register User form, note the parameter you choose as the Account ID in the Register User field. This has to be the value of whatever you will collect later on as the Account ID in the ADC. For example in my lab below, if my ADC collects DN as the Account ID, then I should choose "Account Name" (this is the parameter that should contain the DN). However if my ADC collects samAccountName as the Account ID, then I should change that to "sAMAccountName" as this is the parameter that I use for samAccountName.

I hope this helps explain and solve the problem

See the reply in context

No one else had this question

Outcomes

Boris Lekumovich

Apr 4, 2017 8:45 PM

What collector did you run to verify the CR? Account collector or Identity collector or both?

I suggest you run IDC and then ADC (in that order).

Actions

Marco Sannino @ Boris Lekumovich on Apr 5, 2017 3:08 AM

Hi Boris,

first of all thank you for the response. I run the Identity collector first and then account collector. I used to collect as account name the account distinguished name and in web services or register user form i specify it BUT it didn't work. When i changed account collector in order to collect samaccountname as "Account Name" after the collection(identity at first and then account) the request is verified. BTW this is not a desired behaviour and also i don't know why in other use case (create account for example) that node is skipped even if i don't collect. In order to implement several workaround i need to do other things in fulfillment workflow before i run collection. Is there a reason why only in register user, the "Wait for notification" is not skipped as other use case?

Thank you.

ps now, i've implemented a logic where if it's a register user scenario i skip the verification and mark verified the request, but it's not a perfect workaround.

Actions

Boris Lekumovich

@ Marco Sannino on Apr 5, 2017 3:34 AM

I usually don't collect DN as account unique identifier.

Consider the following scenario:

You collected your accounts with DN as a unique identifier (account name)
You move your account to a different OU - which changes the DN
Next collection, the "old" account record will be marked as deleted and you will have a "new" account under the user access

If you are collecting from 1 AD, consider collecting the accounts with their samAccountName as unique identifier.

Similar approach for groups.

If you share the screenshots from your configuration (form, provision field, change request and the attributes, AD account collector, AD identity collector and AD AFX connector - create account capability) I believe we will be able to find the root cause.

1 person found this helpful

Actions

Mostafa Helmy

Apr 5, 2017 5:10 AM

I hope this helps explain and solve the problem

1 person found this helpful

Actions

Erika Szabo @ Mostafa Helmy on Dec 4, 2017 10:40 AM

Dear Mostafa,

I have the same issue with Contractors which are stored in local database. I created an identity and an account collector as well. The Account ID (SAP_ID) is not coming from the form itself, but is calculated in AFX based on the values in the database. The request will not be verified, but the new conractor identity, and the account is in Aveksa after collection. Is there any way to complete the request?

Actions

Marco Sannino Apr 5, 2017 8:13 AM

Thank you both Boris and Mostafa.

Actually my issue is that i'd like to skip verification because the collection must be run in the same ff workflow. Actually, i've solved it marking verified the request, later i'll handle afx response variable in order to achieve an exception handling.

Thank you.

Actions

6 Replies

Boris Lekumovich Apr 4, 2017 8:45 PM
Mark Correct
Correct Answer
What collector did you run to verify the CR? Account collector or Identity collector or both?
I suggest you run IDC and then ADC (in that order).
Like • Show 0 Likes0
Actions
- Marco Sannino @ Boris Lekumovich on Apr 5, 2017 3:08 AM
  Mark Correct
  Correct Answer
  Hi Boris,
  
  first of all thank you for the response. I run the Identity collector first and then account collector. I used to collect as account name the account distinguished name and in web services or register user form i specify it BUT it didn't work. When i changed account collector in order to collect samaccountname as "Account Name" after the collection(identity at first and then account) the request is verified. BTW this is not a desired behaviour and also i don't know why in other use case (create account for example) that node is skipped even if i don't collect. In order to implement several workaround i need to do other things in fulfillment workflow before i run collection. Is there a reason why only in register user, the "Wait for notification" is not skipped as other use case?
  
  Thank you.
  ps now, i've implemented a logic where if it's a register user scenario i skip the verification and mark verified the request, but it's not a perfect workaround.
  Like • Show 0 Likes0
  Actions
  - Boris Lekumovich @ Marco Sannino on Apr 5, 2017 3:34 AM
    Mark Correct
    Correct Answer
    I usually don't collect DN as account unique identifier.
    
    Consider the following scenario:
    You collected your accounts with DN as a unique identifier (account name)
    You move your account to a different OU - which changes the DN
    Next collection, the "old" account record will be marked as deleted and you will have a "new" account under the user access
    
    If you are collecting from 1 AD, consider collecting the accounts with their samAccountName as unique identifier.
    
    Similar approach for groups.
    
    If you share the screenshots from your configuration (form, provision field, change request and the attributes, AD account collector, AD identity collector and AD AFX connector - create account capability) I believe we will be able to find the root cause.
    1 person found this helpful
    Like • Show 0 Likes0
    Actions
Mostafa Helmy Apr 5, 2017 5:10 AM
Unmark Correct
Correct Answer
The Register User is an Account Creation beneath the hoods which uses the "Create Account" AFX capability. The request will only verify if you run the ADC and collect an Account with the name you specified in the form.

In the Register User form, note the parameter you choose as the Account ID in the Register User field. This has to be the value of whatever you will collect later on as the Account ID in the ADC. For example in my lab below, if my ADC collects DN as the Account ID, then I should choose "Account Name" (this is the parameter that should contain the DN). However if my ADC collects samAccountName as the Account ID, then I should change that to "sAMAccountName" as this is the parameter that I use for samAccountName.

I hope this helps explain and solve the problem
1 person found this helpful
Like • Show 0 Likes0
Actions
- Erika Szabo @ Mostafa Helmy on Dec 4, 2017 10:40 AM
  Mark Correct
  Correct Answer
  Dear Mostafa,
  
  I have the same issue with Contractors which are stored in local database. I created an identity and an account collector as well. The Account ID (SAP_ID) is not coming from the form itself, but is calculated in AFX based on the values in the database. The request will not be verified, but the new conractor identity, and the account is in Aveksa after collection. Is there any way to complete the request?
  Like • Show 0 Likes0
  Actions
Marco Sannino Apr 5, 2017 8:13 AM
Mark Correct
Correct Answer
Thank you both Boris and Mostafa.
Actually my issue is that i'd like to skip verification because the collection must be run in the same ff workflow. Actually, i've solved it marking verified the request, later i'll handle afx response variable in order to achieve an exception handling.

Thank you.
Like • Show 0 Likes0
Actions

Register User Form - Wait for verification

Outcomes

Related Content

Recommended Content