AnsweredAssumed Answered

AFX reports this item failed with code [120] and message: 'Invalid "Add Account to AD Group" command Account parameter value for Active Directory connector'.

Question asked by Shlomo Katz on Feb 4, 2019
Latest reply on Mar 7, 2019 by Shlomo Katz

Like • Show 0 Likes0
Comment • 2

Hello

An account is required for a Role with Entitlements.

This means that a new account will be created when the "new employee" Role is run.

The current issue is:

When the Role runs, the appropriate workflow variables Add/Create are generated.

However, the Add generates a manual workflow because:

AFX reports this item failed with code [120] and message: 'Invalid "Add Account to AD Group" command Account parameter value for Active Directory connector'.

However, subsequent Rules ( missing entitlements) adds the account to the group without any problems.

Adding existing accounts to groups does not have any issues.

I know somethings change by us and RSA, but I can't figure out why it fails on the initial add/create.

Version: 7.1 P3.

No one else has this question

Outcomes

Mostafa Helmy

Feb 6, 2019 7:52 AM

If the user requesting access does not have an account, then you either Set the "Entitlements require accounts” to "Yes” for that application (by attaching an Account Template to it first). Or the CR will just fail at fulfilment phase since there is no account available to provision to.

Also the default AFX fulfilment workflow handles this in fulfilment phase to make sure that it first runs the Create Account, then any subsequent Add entitlement afterwards. If you create your own custom AFX workflow, then make sure it is based off the default AFX workflow without removing the Java Node and loop that exist there.

Actions

Shlomo Katz @ Mostafa Helmy on Mar 7, 2019 3:50 PM

Mostafa Helmy

Regarding "Entitlements require accounts”, that is set as well as Request > Template > Pending Attributes

We have a Parent Workflow the determines if there is a create request.

That workflow had Select the grouping of changes was set to "Create one job to process all changes"

When that was set, tried to add the non existing account causing the manual task.

Now, I changed that to "Create a job per group, grouping by : user"

When this is set, the account is created, the add to group is pending add, but the workflow shows completed. Also, the split jobs shows 1 when it should be 2. A follow up "missing entitlement" rule adds the groups and the original workflow closes the previous pending add, even though the workflow is "green".

Current workflow

Actions

2 Replies

Mostafa Helmy Feb 6, 2019 7:52 AM
Mark Correct
Correct Answer
If the user requesting access does not have an account, then you either Set the "Entitlements require accounts” to "Yes” for that application (by attaching an Account Template to it first). Or the CR will just fail at fulfilment phase since there is no account available to provision to.

Also the default AFX fulfilment workflow handles this in fulfilment phase to make sure that it first runs the Create Account, then any subsequent Add entitlement afterwards. If you create your own custom AFX workflow, then make sure it is based off the default AFX workflow without removing the Java Node and loop that exist there.
Like • Show 0 Likes0
Actions
- Shlomo Katz @ Mostafa Helmy on Mar 7, 2019 3:50 PM
  Mark Correct
  Correct Answer
  Mostafa Helmy
  Regarding "Entitlements require accounts”, that is set as well as Request > Template > Pending Attributes
  
  We have a Parent Workflow the determines if there is a create request.
  That workflow had Select the grouping of changes was set to "Create one job to process all changes"
  When that was set, tried to add the non existing account causing the manual task.
  
  Now, I changed that to "Create a job per group, grouping by : user"
  When this is set, the account is created, the add to group is pending add, but the workflow shows completed. Also, the split jobs shows 1 when it should be 2. A follow up "missing entitlement" rule adds the groups and the original workflow closes the previous pending add, even though the workflow is "green".
  
  Current workflow
  Like • Show 0 Likes0
  Actions

AFX reports this item failed with code [120] and message: 'Invalid "Add Account to AD Group" command Account parameter value for Active Directory connector'.

Outcomes

Related Content

Recommended Content