AnsweredAssumed Answered

Group Review is not removing Account

Question asked by Shlomo Katz on Dec 14, 2018
Latest reply on Dec 27, 2018 by Mostafa Helmy

Like • Show 0 Likes0
Comment • 13

Version: 7.1 P03

Oracle 12c

RSA Appliance

No logs

Issue: Any ideas why the Group Review does not remove the account from the group.

What works:

I can make a request through My Access to remove a subordinate's group from Active Directory.

I see that it is using the AD workflow to remove the account from the group.

Resulting workflow:

What is not working:

I have a Group Review > Accounts.

The group owner wants to selectively remove group members.

Fulfillment says complete by the Review says pending action.

The "workflow" skips the AD workflow and goes straight to completion.

The AD workflow is not limited to any specific Process.

Skips a beat:

Any idea why the group review does not work?

Boris Lekumovich

Dec 16, 2018 8:40 AM

Correct Answer

This might have been fixed in v7.1 P04 (ACM-89833)

I suggest you reach out to support to confirm that this is the same issue.

Meanwhile, check the grouping on your workflow. Try changing it to any other value from the current one.

See the reply in context

No one else had this question

Outcomes

13 Replies

Boris Lekumovich Dec 16, 2018 8:40 AM
Unmark Correct
Correct Answer
This might have been fixed in v7.1 P04 (ACM-89833)
I suggest you reach out to support to confirm that this is the same issue.

Meanwhile, check the grouping on your workflow. Try changing it to any other value from the current one.
1 person found this helpful
Like • Show 2 Likes2
Actions
- Shlomo Katz @ Boris Lekumovich on Dec 17, 2018 12:39 PM
  Mark Correct
  Correct Answer
  Hello Boris Lekumovich and Mostafa Helmy
  Thank you for the suggestions and this is where I am:
  I patched to P04 - that did not resolve.
  On a side note: We have a collector that collects account from AD - after the patch, the the identities are not assigned to a collector.
  I change the AD workflow to group "Create a job per group, grouping by " from user to group - this removes the account from the group.
  Question: Do I need to worry that this changes anything else with AD requests?
  Like • Show 0 Likes0
  Actions
  - Mostafa Helmy @ Shlomo Katz on Dec 17, 2018 12:42 PM
    Mark Correct
    Correct Answer
    Is the account orphaned? This maybe would explain that it does not create a workflow job when grouping per user as the orphaned account has no attached user?
    Like • Show 0 Likes0
    Actions
    - Shlomo Katz @ Mostafa Helmy on Dec 17, 2018 12:48 PM
      Mark Correct
      Correct Answer
      No, these are all active accounts.
      And to repeat my question: Will any other AD processes break if I switch to Group vs User (what is the difference when it come to grouping)? or is just a cosmetic thing?
      Like • Show 0 Likes0
      Actions
      - Mostafa Helmy @ Shlomo Katz on Dec 18, 2018 6:37 AM
        Mark Correct
        Correct Answer
        The grouping is basically how you put approvals together. Imagine a CR with 4 change items:
        Item 1: Add group G1 to user U1.
        Item 2: Add group G1 to user U2.
        Item 3: Add group G2 to user U1.
        Item 4: Add group G2 to user U2.
        
        If you do Group by user, then you will end up with two approval workflows and tasks: Item 1 and Item 3 together, while Item 2 and Item 4 together.
        If you do Group by group, then you will also end up with two approval workflows and tasks but: Item 1 and Item 2 together, while Item 3 and Item 4 together.
        
        So it would really depend on your approval logic, as in who is your approver? If the approver is the User's supervisor then it makes no sense to group by Group. Also if the approver is the Group Owner, then it makes no sense to group by User.
        
        Like • Show 1 Like1
        Actions
        Shlomo Katz @ Mostafa Helmy on Dec 18, 2018 10:18 AM
        Mark Correct
        Correct Answer
        Thank you...is there a way to create a workflow just for this?
        Like • Show 0 Likes0
        Actions
        Shlomo Katz @ Shlomo Katz on Dec 18, 2018 10:29 AM
        Mark Correct
        Correct Answer
        never mind.. I figured that one out.
        Like • Show 0 Likes0
        Actions
        Shlomo Katz @ Mostafa Helmy on Dec 26, 2018 6:00 PM
        Mark Correct
        Correct Answer
        Mostafa Helmy
        Thank you.
        I am very confused as you mention approvals, I am trying to figure out Fulfillment.
        As such:
        Test scenario
        Role is created to add/remove users to an Application.
        Application requests set to send an email to application owner or Role sends an email to the owner for add/remove.
        One user
        10 entitlements
        
        Result 1: Create an individual job for each change
        User is hired and added to a Role.
        The application owner receives 10 messages to add (1) user for each (10) entitlements.
        Result: 10 email messages
        
        Result 2: Create a Job per group grouping by user
        User is hired and added to a Role.
        The application owner receives 1 message to add (1) user for all (10) entitlements.
        Result: 1 email message
        Like • Show 0 Likes0
        Actions
        Mostafa Helmy @ Shlomo Katz on Dec 27, 2018 9:24 AM
        Mark Correct
        Correct Answer
        Yes what you state here is correct … it is more or less the same idea for fulfilment. I just assumed it was an approval workflow.
        Like • Show 0 Likes0
        Actions
      - Mostafa Helmy @ Shlomo Katz on Dec 18, 2018 7:20 AM
        Mark Correct
        Correct Answer
        So to answer your question in short yes it will affect your approvals one way or another. As for the thing on P04, please raise this as a case with RSA Support so the workflow editor would show these missing links.
        Like • Show 0 Likes0
        Actions
- Shlomo Katz @ Boris Lekumovich on Dec 26, 2018 9:39 AM
  Mark Correct
  Correct Answer
  Hello Boris Lekumovich,
  This is happening both on P03 and P04.
  Membership removal works when the workflow grouping is “Create an individual job for each change” .
  It does not work when the grouping is “Create a Job per group grouping by user”.
  
  I can change this in production and just see how it effects existing workflows.
  Like • Show 0 Likes0
  Actions
- Shlomo Katz @ Boris Lekumovich on Dec 27, 2018 9:08 AM
  Mark Correct
  Correct Answer
  Update: The following has been created.
  ACM-94324-Request from Group Review stuck in Fulfillment Phase when “Create a Job per group" used.
  Like • Show 1 Like1
  Actions
Mostafa Helmy Dec 17, 2018 5:56 AM
Mark Correct
Correct Answer
If you click on the three dot icon beside the save button in the workflow … you can uncheck the option to show only the followed path. This will show you that it actually went to some fulfilment workflow but for some reason did not generate any sub-workflows. As Boris said this is probably fixed later on (not seeing the fulfilment workflow). As for the fact that it did not create any fulfilment sub-workflow then I would check first which fulfilment workflow was called, then check the grouping on that again as Boris said.
Like • Show 0 Likes0
Actions

Group Review is not removing Account

Outcomes

Related Content

Recommended Content