Access Enforcer 5.2 - auto-provisioning error

Question

Hi all,
i have come across strange quirk in AE 5.2 that is causing my client some issues.  During UAT, a scenario was tested for a new user request with two roles with different role managers.  The results i obtained were as follows:
1.  Role manager 1 rejects 1st role then role manager 2 approves 2nd role (in that order).  Expected result is that the user is created and the 2nd role is provisioned in the system.  Actual result was that user was created and 2nd role was provisioned in system.  PASS
2.  Role manager 1 approves 1st role and then role manager 2 rejects 2nd role (in that order).  Expected result is that the user is created and the 1st role is provisioned in the system.  Actual result was that the request was closed and no auto provisioning was done.  FAIL
For some reason, AE is only picking up the last approval/rejection when deciding whether to auto-provision or not.  So when the last role manager rejects their role that was requested, AE closes the entire request and does not provision other roles in the request even though they were already approved.  If the last role manager approves their role that was requested, AE will provision access according to the roles that were previously approved/rejected.
This does not occur for multiple roles that have the same role manager, as they are able to reject some roles and approve others without any problems with the provisioning.  Config is set up so that the role manager stage approvals are at the role level, and approval type is "all approvers".  We have also configured auto-provisioning type as "Auto provision at end of request" and provision effective immediately as "Yes".
Any ideas what is going on?
Thanks,
Alexi

Answer 1

Hi all,
i've tried to resolve this issue by changing the configuration, however this has not resolved it.  I've attached the audit log of two requests for the same roles, only difference is the order of the role approvals.  In request 226, the first role manager approved their role and the second role manager rejected their role and AE did not auto-provision the approved role (the whole request appears to be rejected). 
Request 226 Submitted by Alexi Tsafos(k01232) on 07/30/2008 15:44 
   YBC:ROLE_921-QAS Role Added
   YBC:ROLE_922-QAS Role Added
   ZU:COMMON-QAS Default Role Added By system
   Request submitted for approval by Alexi Tsafos(K01232) on 07/30/2008 15:44 
  Approved By Alexi Tsafos(K01232) Path ERP_NEW and Stage LINE_MANAGER on 07/30/2008 15:44 
   ZU:COMMON-QAS Role Approved
   YBC:ROLE_921-QAS Role Approved
   YBC:ROLE_922-QAS Role Approved
   Request submitted for role level approval by Carmen Richardson(K01231) on 07/30/2008 15:45 
  Approved By Carmen Richardson(K01231) Path ERP_NEW and Stage ROLE_MANAGER on 07/30/2008 15:45 
   YBC:ROLE_922-QAS Role Approved
   Request submitted for role level rejection by Alexi Tsafos(K01232) on 07/30/2008 15:45 
  Rejected By Alexi Tsafos(K01232) Path ERP_NEW and Stage ROLE_MANAGER on 07/30/2008 15:45 
   YBC:ROLE_921-QAS Role Rejected
   Request Closed By Alexi Tsafos(K01232) on 07/30/2008 15:45 
   Auto provisioned for request on 07/30/2008 15:45 
In request 227, the first role manager rejected their role and the second role manager approved their role and AE auto-provisioned the approved role. 
Request 227 Submitted by Alexi Tsafos(k01232) on 07/30/2008 15:50 
   YBC:ROLE_921-QAS Role Added
   YBC:ROLE_922-QAS Role Added
   ZU:COMMON-QAS Default Role Added By system
   Request submitted for approval by Alexi Tsafos(K01232) on 07/30/2008 15:50 
  Approved By Alexi Tsafos(K01232) Path ERP_NEW and Stage LINE_MANAGER on 07/30/2008 15:50 
   ZU:COMMON-QAS Role Approved
   YBC:ROLE_921-QAS Role Approved
   YBC:ROLE_922-QAS Role Approved
   Request submitted for role level rejection by Carmen Richardson(K01231) on 07/30/2008 15:50 
  Rejected By Carmen Richardson(K01231) Path ERP_NEW and Stage ROLE_MANAGER on 07/30/2008 15:50 
   YBC:ROLE_922-QAS Role Rejected
   Request submitted for role level approval by Alexi Tsafos(K01232) on 07/30/2008 15:50 
  Approved By Alexi Tsafos(K01232) Path ERP_NEW and Stage ROLE_MANAGER on 07/30/2008 15:50 
   YBC:ROLE_921-QAS Role Approved
  Auto provisioned for request on 07/30/2008 15:50 
   New User: AETEST20 created on 07/30/2008 15:50 in System(s): QAS.
   Role: ZU:COMMON assigned to user: AETEST20 in System(s): QAS.
   Role: YBC:ROLE_921 assigned to user: AETEST20 in System(s): QAS.
   Request Closed By Alexi Tsafos(K01232) on 07/30/2008 15:50 
As described in an earlier post, the stage config is set for "role" level approval by "any approver".  I've also tried "role" level approval by "All approvers" and have the same problem. 
Any ideas?
Thanks,
Alexi