AnsweredAssumed Answered

Request button to form to AFX

Question asked by Steve Fuson on Dec 5, 2018
Latest reply on Dec 17, 2018 by Mostafa Helmy

Like • Show 0 Likes0
Comment • 5

We have applications which are contolled out of Active Directory groups. Meaning:

AD groups Application_1_Modify and Application_1_Read give access to Application 1

AD groups Application_2_Modify and Application_2_Read give access to Application 2

I'm trying to set up Request Buttons/Forms specific to those groups which will then go through the workflows we've assigned to Active Directory and then be fulfilled by AFX.

I've tried some different combinations and run into issues. For instance, if I do a Global request form with a Group Picker, it doesn't see the group as an application entitlement and therefore doesn't follow the correct workflow.

The best I've come up with so far is a Request Button with Action "Add using request sources" including the Active Directory Application, then an Application type Request Form with the groups filtered. But what happens is, I have different buttons which go to the same application and when I select the application it gives options a second time for multiple forms. Even when I try to filter to specific forms, I get the same results.

The Request Button Action "go to form" doesn't give an option for application forms.

Is there a better way to do this?

Mostafa Helmy

Dec 6, 2018 5:48 AM

Correct Answer

The group picker is not the best option if you want this to be go as a request-able entitlement. Just create a Global Form > Add an Entitlement Table > Put a filter on the entitlement table to limit it to only those groups. This way if someone just picks from these groups, it will generate a CR to add those groups to him and will use the normal workflows you assigned to AD.

See the reply in context

No one else had this question

Outcomes

Steve Fuson Dec 5, 2018 10:32 PM

Also, is there a way to have AFX add a group to another group?

Actions

Mostafa Helmy

@ Steve Fuson on Dec 6, 2018 10:16 AM

I was successful using the Add Account to Group capability to add a group to another. You could potentially do that using a Global form two Group picker fields and a Provisioning Command field. Then pass the Groups DNs as parameters to the Add Account to AD Group capability.

Actions

Steve Fuson @ Mostafa Helmy on Dec 6, 2018 12:39 PM

That sounds great. Can you elaborate on how I would configure the Provisioning Command node?

Actions

Mostafa Helmy

@ Steve Fuson on Dec 17, 2018 6:31 AM

You can create a Global form. Then in the fields add three fields:

Parent Group (Group picker).
Child Group (Group picker).

Both can look like this:

Provisioning Command (Non-visual). I will assume here that the Group name is the Group DN. Try mapping the Parent to the Group name, and Child to the Account Name. This will use whatever workflow you have assigned to your Active Directory.

Have to say I am not sure if the change request will work or not and how will it verify.

If the Group Name is not the DN (most cases), then probably you could do either:

Use Web Services in the form to fetch the DN from the Group ID then map the DN variable to AFX instead.
Do not use a provisioning command in the form and just use two group pickers to fetch the Group IDs. Then create a custom fulfilment workflow to fetch the Group DNs from their IDs using the public views then pass it on to an AFX Provisioning command node.

5 Replies

Steve Fuson Dec 5, 2018 10:32 PM
Mark Correct
Correct Answer
Also, is there a way to have AFX add a group to another group?
Like • Show 0 Likes0
Actions
- Mostafa Helmy @ Steve Fuson on Dec 6, 2018 10:16 AM
  Mark Correct
  Correct Answer
  I was successful using the Add Account to Group capability to add a group to another. You could potentially do that using a Global form two Group picker fields and a Provisioning Command field. Then pass the Groups DNs as parameters to the Add Account to AD Group capability.
  Like • Show 0 Likes0
  Actions
  - Steve Fuson @ Mostafa Helmy on Dec 6, 2018 12:39 PM
    Mark Correct
    Correct Answer
    That sounds great. Can you elaborate on how I would configure the Provisioning Command node?
    Like • Show 0 Likes0
    Actions
    - Mostafa Helmy @ Steve Fuson on Dec 17, 2018 6:31 AM
      Mark Correct
      Correct Answer
      You can create a Global form. Then in the fields add three fields:
      
      Parent Group (Group picker).
      Child Group (Group picker).
      
      Both can look like this:
      
      Provisioning Command (Non-visual). I will assume here that the Group name is the Group DN. Try mapping the Parent to the Group name, and Child to the Account Name. This will use whatever workflow you have assigned to your Active Directory.
      
      Have to say I am not sure if the change request will work or not and how will it verify.
      
      If the Group Name is not the DN (most cases), then probably you could do either:
      Use Web Services in the form to fetch the DN from the Group ID then map the DN variable to AFX instead.
      Do not use a provisioning command in the form and just use two group pickers to fetch the Group IDs. Then create a custom fulfilment workflow to fetch the Group DNs from their IDs using the public views then pass it on to an AFX Provisioning command node.
      Like • Show 0 Likes0
      Actions
Mostafa Helmy Dec 6, 2018 5:48 AM
Unmark Correct
Correct Answer
The group picker is not the best option if you want this to be go as a request-able entitlement. Just create a Global Form > Add an Entitlement Table > Put a filter on the entitlement table to limit it to only those groups. This way if someone just picks from these groups, it will generate a CR to add those groups to him and will use the normal workflows you assigned to AD.
Like • Show 1 Like1
Actions

Request button to form to AFX

Outcomes

Related Content

Recommended Content