AnsweredAssumed Answered

pre_data_processing and post_data_processing

Question asked by Shlomo Katz on Jan 9, 2019
Latest reply on Jan 10, 2019 by Shlomo Katz

Like • Show 0 Likes0
Comment • 12

We had a vendor setup our initial setup on 7.0.x.

There are some pretty confusing custom code in both pre and post data processing.

We have upgrading to 7.1 p3 and I believe we have had successful account creations when a role called for the account to be created.

Since we are having account creation issues, I am wondering if these processes are the issue?

I know they are part of unification processes but I am wondering if something changed that prevents creation.

Unification is working fine.

What are they really for?

How can I test?

Thank you

Shlomo Katz Jan 10, 2019 8:26 PM

Correct Answer

Edwin Mullie and Mostafa Helmy

Thank you for letting me "think out loud".

The Pre/Post Processes was not the issue.

The resolution was to reset the "group by" to user in the AD fulfillment.

Why was it set to group?

Because we are doing our first Group Review, and the option to remove an account from a group did not go to AFX with "group by group".

So we resolved one issue to create another.

It would be great to have the option to change to workflow for Group Removal Fulfillment or fix the remove account failure when the "group by" is set to user.

See the reply in context

No one else had this question

Outcomes

Edwin Mullie

Jan 10, 2019 3:33 AM

Now I'm curious what was done in the pre and post data processing. I don't see how that would result in account creation. Did you check the JML playbook, this has a use case around AD account creation when assigning birthright authorizations: https://community.rsa.com/docs/DOC-86439

Or do you mean identity creation? There I would see how the pre and post data processing could influence that

Regards

Edwin

Actions

Shlomo Katz @ Edwin Mullie on Jan 10, 2019 6:35 AM

Thank you Edwin Mullie.

I believe the Pre/Post Data Processing is related to checking for duplicate Identities (User) and duplicate Accounts .
The challenge I am having is this part is failing:

"Example of CR showing the 2nd step of adding the new account to the Birthright Group " (pg. 17 of JML Playbook).

The workflow says "complete" but the account information is not added to the actual AFX - example: no logs.

but there are other indicators showing that the userID , Full name , and Manager are all correct.

In other words: Imagine a subordinate saying they created an AD account and here is proof because they said so, but their is no account or logs saying they even tried. (make sense?)

Hope you have some ideas.

I posted this issue in another question as well.

Thank you

Shlomo

Actions

Edwin Mullie

@ Shlomo Katz on Jan 10, 2019 8:07 AM

So you are saying that G&L isn't creating the add account item in the CR? Can you post the CR? And how you configured the application (the requests tab)

Edwin

Actions

Shlomo Katz @ Edwin Mullie on Jan 10, 2019 9:34 AM

Edwin Mullie - please let me know if you need more information.

Thank you

workflow shows an empty transition.

transitional line does show when un-checking

Even though the Create Account decision is fulfilled, it does not create the account.

No errors. No permission errors. It does not even try to get to AD.

I have changed groupings.

Actions

Edwin Mullie

@ Shlomo Katz on Jan 10, 2019 9:38 AM

Can you show me the CR and the change items, like this

Actions

Shlomo Katz @ Edwin Mullie on Jan 10, 2019 9:45 AM

Actions

Edwin Mullie

@ Shlomo Katz on Jan 10, 2019 9:50 AM

Have you tried if this work with the default workflows? I've seen this issue before and it had to do with the migration (or lack of it) during the upgrade / patch

Edwin

Actions

Shlomo Katz @ Edwin Mullie on Jan 10, 2019 1:19 PM

Edwin Mullie - the Default AFX give the following
AFX can not process this change item because a runtime value can not be found for the following required variables: ${Account.Cn}

and then goes to manual fulfillment.

Actions

Mostafa Helmy

@ Shlomo Katz on Jan 10, 2019 10:02 AM

I see you are calling the fulfilment workflow using a sub-process node rather than a fulfilment phase node. Could you give us screenshots of the config of that node "Handle Active Directory changes”?

Actions

Shlomo Katz @ Mostafa Helmy on Jan 10, 2019 1:20 PM

The process does not call the AD fulfillment. That is the problem.

Actions

Shlomo Katz @ Shlomo Katz on Jan 10, 2019 1:54 PM

You can see there are 5 changes:

But only 4 workpoints, non are AD creation.

Actions

Shlomo Katz Jan 10, 2019 8:26 PM

Edwin Mullie and Mostafa Helmy

Thank you for letting me "think out loud".

The Pre/Post Processes was not the issue.

The resolution was to reset the "group by" to user in the AD fulfillment.

Why was it set to group?

Because we are doing our first Group Review, and the option to remove an account from a group did not go to AFX with "group by group".

So we resolved one issue to create another.

It would be great to have the option to change to workflow for Group Removal Fulfillment or fix the remove account failure when the "group by" is set to user.

Actions

12 Replies

Edwin Mullie Jan 10, 2019 3:33 AM
Mark Correct
Correct Answer
Now I'm curious what was done in the pre and post data processing. I don't see how that would result in account creation. Did you check the JML playbook, this has a use case around AD account creation when assigning birthright authorizations: https://community.rsa.com/docs/DOC-86439

Or do you mean identity creation? There I would see how the pre and post data processing could influence that

Regards

Edwin
Like • Show 0 Likes0
Actions
- Shlomo Katz @ Edwin Mullie on Jan 10, 2019 6:35 AM
  Mark Correct
  Correct Answer
  Thank you Edwin Mullie.
  I believe the Pre/Post Data Processing is related to checking for duplicate Identities (User) and duplicate Accounts .
  The challenge I am having is this part is failing:
  "Example of CR showing the 2nd step of adding the new account to the Birthright Group " (pg. 17 of JML Playbook).
  
  The workflow says "complete" but the account information is not added to the actual AFX - example: no logs.
  but there are other indicators showing that the userID , Full name , and Manager are all correct.
  In other words: Imagine a subordinate saying they created an AD account and here is proof because they said so, but their is no account or logs saying they even tried. (make sense?)
  
  Hope you have some ideas.
  I posted this issue in another question as well.
  
  Thank you
  Shlomo
  Like • Show 0 Likes0
  Actions
  - Edwin Mullie @ Shlomo Katz on Jan 10, 2019 8:07 AM
    Mark Correct
    Correct Answer
    So you are saying that G&L isn't creating the add account item in the CR? Can you post the CR? And how you configured the application (the requests tab)
    
    Edwin
    Like • Show 0 Likes0
    Actions
    - Shlomo Katz @ Edwin Mullie on Jan 10, 2019 9:34 AM
      Mark Correct
      Correct Answer
      Edwin Mullie - please let me know if you need more information.
      Thank you
      workflow shows an empty transition.
      transitional line does show when un-checking
      
      Even though the Create Account decision is fulfilled, it does not create the account.
      No errors. No permission errors. It does not even try to get to AD.
      I have changed groupings.
      Like • Show 0 Likes0
      Actions
      - Edwin Mullie @ Shlomo Katz on Jan 10, 2019 9:38 AM
        Mark Correct
        Correct Answer
        Can you show me the CR and the change items, like this
        Like • Show 0 Likes0
        Actions
        Shlomo Katz @ Edwin Mullie on Jan 10, 2019 9:45 AM
        Mark Correct
        Correct Answer
        Like • Show 0 Likes0
        Actions
        Edwin Mullie @ Shlomo Katz on Jan 10, 2019 9:50 AM
        Mark Correct
        Correct Answer
        Have you tried if this work with the default workflows? I've seen this issue before and it had to do with the migration (or lack of it) during the upgrade / patch
        
        Edwin
        Like • Show 0 Likes0
        Actions
        Shlomo Katz @ Edwin Mullie on Jan 10, 2019 1:19 PM
        Mark Correct
        Correct Answer
        Edwin Mullie - the Default AFX give the following
        AFX can not process this change item because a runtime value can not be found for the following required variables: ${Account.Cn}
        and then goes to manual fulfillment.
        Like • Show 0 Likes0
        Actions
      - Mostafa Helmy @ Shlomo Katz on Jan 10, 2019 10:02 AM
        Mark Correct
        Correct Answer
        I see you are calling the fulfilment workflow using a sub-process node rather than a fulfilment phase node. Could you give us screenshots of the config of that node "Handle Active Directory changes”?
        Like • Show 0 Likes0
        Actions
        Shlomo Katz @ Mostafa Helmy on Jan 10, 2019 1:20 PM
        Mark Correct
        Correct Answer
        The process does not call the AD fulfillment. That is the problem.
        Like • Show 0 Likes0
        Actions
        Shlomo Katz @ Shlomo Katz on Jan 10, 2019 1:54 PM
        Mark Correct
        Correct Answer
        You can see there are 5 changes:
        But only 4 workpoints, non are AD creation.
        Like • Show 0 Likes0
        Actions
Shlomo Katz Jan 10, 2019 8:26 PM
Unmark Correct
Correct Answer
Edwin Mullie and Mostafa Helmy

Thank you for letting me "think out loud".
The Pre/Post Processes was not the issue.
The resolution was to reset the "group by" to user in the AD fulfillment.
Why was it set to group?
Because we are doing our first Group Review, and the option to remove an account from a group did not go to AFX with "group by group".
So we resolved one issue to create another.
It would be great to have the option to change to workflow for Group Removal Fulfillment or fix the remove account failure when the "group by" is set to user.
Like • Show 1 Like1
Actions

pre_data_processing and post_data_processing

Outcomes

Related Content

Recommended Content