IDM - GRC AC 5.3 integration - workflow detour not working as expected

Hi IDM Experts!
I would greatly appreciate your help with the problem we're currently facing; when integrating IDM with GRC, we have configured 2 CUP workflows; one for handling requests with SoD violations (Workflow B) and one to handle ones without any SoD violations (Workflow C), with the former handling risk analysis followed by role approval, and the latter handling only role approval; we have one path with one stage configured as "No Stage" (Workflow A); this path is used to decide which of the primary workflows to use (i.e. SoD violations or no SoD violations) using two detours; we have one detour configured to use Workflow B if any SoD violations are found in the request and another detour configured to use Workflow C if no SoD violations are found.
Currently what happens in our tests is that requests without risks / SoD violations work fine and actually get detoured to Workflow C, awaiting role approval from the right approver ; while requests with inherent risks / SoD violations unforutnately get automatically approved and provisioned rather than being sent to Workflow B
Any clues as to why this could be happening? We've checked if there are any settings that might be triggering it to automatically approve requests despite any risks, but can't find anything of the sort; Would be very grateful for any insight / advice on the issue.
Thanks a lot in advance!
Best regards,
Sandeep

Hi Diego!
Once again; thank you for your quick reply!
I did recheck the auto-provisioning issue and I can confirm that it is definitely set to "No Auto-provisioning" and it hasn't been changed recently. The strange thing is that the detour works for NO SoD violations, but doesn't work for SoD violations; find below the audit trail for detour working:
Request XXX Submitted by Sandeep (SANDEEP) on 01/28/2012 02:04 
   Z_111111-ECC Role Added with validity dates 01/28/2012-12/31/9999
Request submitted for approval by admin(system) on 01/28/2012 02:04 
Approved by Sandeep (SANDEEP) on behalf of Sandeep (SANDEEP) at path WORKFLOW_A and stage WORKFLOW_A on 01/28/2012 02:04 
   Approved Z_111111-ECC role for Add action with validity dates 01/28/2012-12/31/9999
Request has taken a detour to path C_WORKFLOW and stage C_STAGE on 01/28/2012 02:04 
   Detour condition SOD Violations with value No is satisfied at path WORKFLOW_A and stage WORKFLOW_A
and find below the audit trail for the detour not working:
Request YYY Submitted by Sandeep (SANDEEP) on 01/28/2012 01:53 
   Z_222222-ECC  Role Added with validity dates 01/28/2012-12/31/9999
Request submitted for approval by admin(system) on 01/28/2012 01:53 
Approved by Sandeep (SANDEEP)  on behalf of Sandeep (SANDEEP)  at path WORKFLOW_A and stage WORKFLOW_A on 01/28/2012 01:53 
   Approved Z_222222-ECC role for Add action with validity dates 01/28/2012-12/31/9999
Request Closed By Sandeep (SANDEEP) on 01/28/2012 01:53 
I even checked the CUA System section, and the "By system" tab and it was empty; there were no specific system configurations.
And to answer your questions:
Since Workflow A is the path with the Initiator, the detour flag is deactivated and the active flag is activated.
WF B & C have both the active and detour flags activated.
Thanks a lot again for your quick responses and all the help you've provided so far!
Best regards,
Sandeep

Similar Messages

  • GRC AC 5.3 Detour not working as expected in workflow

    Hi GRC Experts!
    I would greatly appreciate your help with the problem we're currently facing; we have configured 2 CUP workflows; one for handling requests with SoD violations (Workflow B) and one to handle ones without any SoD violations (Workflow C), with the former handling risk analysis followed by role approval, and the latter handling only role approval; we have one path with one stage configured as "No Stage" (Workflow A); this path is used to decide which of the primary workflows to use (i.e. SoD violations or no SoD violations) using two detours; we have one detour configured to use Workflow B if any SoD violations are found in the request and another detour configured to use Workflow C if no SoD violations are found.
    Currently what happens in our tests is that requests without risks / SoD violations work fine and actually get detoured to Workflow C, awaiting role approval from the right approver ; while requests with inherent risks / SoD violations unforutnately get automatically approved and provisioned rather than being sent to Workflow B
    Any clues as to why this could be happening? We've checked if there are any settings that might be triggering it to automatically approve requests despite any risks, but can't find anything of the sort; Would be very grateful for any insight / advice on the issue.
    Thanks a lot in advance!
    Best regards,
    Sandeep

    Hi Diego!
    Once again; thank you for your quick reply!
    I did recheck the auto-provisioning issue and I can confirm that it is definitely set to "No Auto-provisioning" and it hasn't been changed recently. The strange thing is that the detour works for NO SoD violations, but doesn't work for SoD violations; find below the audit trail for detour working:
    Request XXX Submitted by Sandeep (SANDEEP) on 01/28/2012 02:04 
       Z_111111-ECC Role Added with validity dates 01/28/2012-12/31/9999
    Request submitted for approval by admin(system) on 01/28/2012 02:04 
    Approved by Sandeep (SANDEEP) on behalf of Sandeep (SANDEEP) at path WORKFLOW_A and stage WORKFLOW_A on 01/28/2012 02:04 
       Approved Z_111111-ECC role for Add action with validity dates 01/28/2012-12/31/9999
    Request has taken a detour to path C_WORKFLOW and stage C_STAGE on 01/28/2012 02:04 
       Detour condition SOD Violations with value No is satisfied at path WORKFLOW_A and stage WORKFLOW_A
    and find below the audit trail for the detour not working:
    Request YYY Submitted by Sandeep (SANDEEP) on 01/28/2012 01:53 
       Z_222222-ECC  Role Added with validity dates 01/28/2012-12/31/9999
    Request submitted for approval by admin(system) on 01/28/2012 01:53 
    Approved by Sandeep (SANDEEP)  on behalf of Sandeep (SANDEEP)  at path WORKFLOW_A and stage WORKFLOW_A on 01/28/2012 01:53 
       Approved Z_222222-ECC role for Add action with validity dates 01/28/2012-12/31/9999
    Request Closed By Sandeep (SANDEEP) on 01/28/2012 01:53 
    I even checked the CUA System section, and the "By system" tab and it was empty; there were no specific system configurations.
    And to answer your questions:
    Since Workflow A is the path with the Initiator, the detour flag is deactivated and the active flag is activated.
    WF B & C have both the active and detour flags activated.
    Thanks a lot again for your quick responses and all the help you've provided so far!
    Best regards,
    Sandeep

  • Workflow is not working

    Hi everybody;
    I'm teaching in a University and recently was provided to us a server for testing Podcasting lectures. Xserve 2 Ghz PowerPC G5, 1Gb RAM and 232 Gb HD (just 9 GB used), Leopard 10.5.2 OS. Of course we choose the hard way so no assistance for setup was hired.
    My problem is that I can subscribe to my Podcast server with iTunes but I get "no new episodes from Podmac(my group)".
    (1) I went into Server Admin under Podcast Producer and set the default Properties. (2) xGrid services and Podcast Producer are runnig.(3) open directory and kerberos are running in the same server. My guess workflow is not working; the files stacking up in the podcast recording directory and nothing goes to the podcasts directory. At Podcast producer server Log I get;
    +Thu Apr 10 20:58:54 -0500 2008 -- Processing Podcast Producer Job ID: 14+
    +Thu Apr 10 20:58:54 -0500 2008 -- Using workflow bundle:+
    +/System/Library/PodcastProducer/Workflows/Blog and iTunes with+
    intro.pwf
    +Thu Apr 10 20:58:54 -0500 2008 -- Assembling Metadata for recording:+
    458D24C4-DFD0-48CD-BDE2-0A3E1530502F
    +Thu Apr 10 20:58:54 -0500 2008 -- Processing:+
    /Podcasts/Recordings/458D24C4-DFD0-48CD-BDE2-0A3E1530502F/user_metadata.plist
    +Thu Apr 10 20:58:59 -0500 2008 -- Processing Podcast Producer Job ID: 14+
    +Thu Apr 10 20:58:59 -0500 2008 -- Using wor+
    Using the xGrid admin I can see the agent available but none job is listed. Can anyone help me pls?

    Officially, Podcast Producer only supports Intel-based agents. On a PowerPC based Xserve, the agent ranking will be zero, and podcast producer jobs will not run.
    Some people have modified the workflows to ignore the ranking, but there are no guarantees the workflows will run correctly if that's done.

  • The "alt, ctrl and shift" on the left side of my keyboard keys integrated notebook did not work. What should I do?

    The "alt, ctrl and shift" on the left side of my keyboard keys integrated notebook did not work. What should I do?

    Hi Luis Fernando Garcia,
    Thanks for using Apple Support Communities.  This article has troubleshooting for keys not working on your keyboard:
    One or more keys on the keyboard do not respond
    http://support.apple.com/kb/ts1381
    Some keys don't work as expected
    From the Apple menu, choose System Preferences.
    From the View menu, choose Speech.
    Click the Text to Speech tab.
    If "Speak selected text when the key is pressed" is enabled, the key or key combination set to speak text cannot be used for other purposes or used to type text--click Set Key and change it to a less-commonly used key combination (try to use modifier keys such as Shift, Command, Option, and Control). Or, disable the "Speak selected text when the key is pressed" option.
    Click the Universal Access pane in System Preferences, click the Keyboard tab.
    Make sure that Slow Keys is turned off. With Slow Keys on, you need to press a key for a longer period of time for it to be recognized.
    In the Universal Access pane, click the Mouse tab, and make sureMouse Keys is turned off. With Mouse Keys enabled, you cannot use the Numeric Keypad to enter numbers--instead the keypad moves the pointer (cursor). (There is an option to enable Mouse Keys with five presses of the Option key; you may want to turn that option off to avoid accidentally enabling it.) If Mouse Keys is enabled and you are using a keyboard with no numeric keypad or Num Lock function, seeUnable to type while Mouse Keys is enabled in Mac OS X.
    If the function keys on the top row of the keyboard are not working as expected, see Mac OS X: How to change the behavior of function keys.
    If the issue persists, use Keyboard Viewer to help isolate the issue:
    Click the Language & Text pane (Mac OS X v10.6) or International pane (Mac OS X v10.5.8 or earlier) in System Preferences.
    Click the Input Sources tab (or Input Menu tab in Mac OS X 10.5.8 or earlier).
    Click the Keyboard & Character Viewer "On" checkbox to select it (click the Keyboard Viewer "On" checkbox in Mac OS X 10.5.8 or earlier).
    From the Input (flag) menu, choose Show Keyboard Viewer.
    If the keyboard is connected and detected by Mac OS X, the keys you type will highlight in the Keyboard Viewer window. Open TextEdit (or any text application), and try to type something using the keys that were previously not responding to see if they highlight in Keyboard Viewer.
    Cheers,
    - Ari

  • Setting Workflow status not working in imported workflow from SPD to Visual Studio

    Hi all,
    I have created SPD workflow and imported in visual studio. When I deploy imported Workflow using visual studio feature I found that Setting Workflow Status action is not working. Do I need to change Set Workflow status activity in Visual studio to make it
    work.
    Rohit Pasrija

    Hi,
    According to your post, my understanding is that Setting Workflow status did not work in imported workflow from SharePoint Designer to Visual Studio.
    I try to reproduce the issue and the result is the same as yours.
    After I import the workflow, choose the .xoml file, the view is as below:
    To troubleshooting the issue, I add a new item to the project and select “Sequential Workflow” in the template.
    After I click the Tool, I find that there don’t have the “SetCustomWorkflowStatus1” activity.
    To set the status of the state, we need to use the “Set State” Activity in the “SharePoint Workflow” toolbar.
    That is the reason why the “SetCustomWorkflowStatus1” activity does no work.
    More information:
    Apply Custom Values to Visual Studio Workflow Statuses
    Thanks,
    Linda Li                
    Forum Support
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
    [email protected]
    Linda Li
    TechNet Community Support

  • Workflow does not work from Script Menu or as Application

    Hi,
    I create a really simple script to adjust podcast volume...
    1. Get Specified iTunes Items (Recently added podcast – my smart folders of recently downloaded items)
    2. Filter Songs in iTunes (Volume Adjustment is 0: so the workflow will not touch podcasts already adjusted.)
    3. Set Options of iTunes Songs (Volume Adjustment: 80)
    The workflow works find when running from Automator. But when I save it as script plug-in or application and try to run it, nothing happens. Please help. Thanks.
    P.S. I tried to create folder action script that adjust the volume automatically when a podcast is downloaded (get selected items -> set options in iTunes songs). At first it works. Now it doesn't.

    It starts by pausing iTunes, executes a applescript where there are say commands, pauses for 3 seconds, gets info from ical, filters out todays events, speaks these events out loud, fetches a weather report via web(xml), speaks out loud, pauses a couple of seconds, gets current itunes song, resumes playing of this song and the workflow is finished.
    It quits right before it is about to announce todays events. Doesnt matter if there are events for today or not. If I start the application manually however, everything seems fine.
    The Applescript used to launch the program:
    tell application "TodaysiCal"
    run
    end tell
    Any suggestions now ?

  • Integrated Microphone Array not working

    Hi. I recently bought a dv6 laptop. In the beginning there were no problems with it at all, but without any (to me) apparent reason, the integrated microphone simply stopped working. I've tried several suggested solutions already; I've checked my sound setup in the control panel, everything checks out there, and I've tried uninstalling and reinstalling the IDT HD Audio Driver CODEC through the HP Recovery Manager. My laptop is running Windows 7 x64. I really need a solution to this problem, it is driving me crazy.. I'm hoping someone in here can help me..
    Thanks in advance.
    Martin

    @oluawoderu, @karen5, @M_Holmstroem
    Please provide us the complete model of your system along with the operating system, so that we can assist you in a better way.
    How to locate model number:
    Notebook:
    http://h10025.www1.hp.com/ewfrf/wc/document?cc=us&​lc=en&docname=c00033108
    Also, please let us know the BIOS version on your notebook and installed Microphone driver version.
    Regards,
    =======================
    I am an HP employee.
    If my suggestion was helpful, you can thank me by clicking on the "Kudos" button!
    If my answer solved your problem, please feel free let the community know by clicking the "Accept as Solution" button!!

  • OIM-OAM 11g BP 02 integration not working as expected

    Hi Experts,
    We have OIM 11g and OAM 11g both upgraded to BP02 installed on separate hosts. We are using OID 11g as the directory servers and OVD 11g fronting OID for integration. We followed the steps mentioned in Oracle Document Oracle® Fusion Middleware Integration Guide for Oracle Access Manager 11g Release 1 (11.1.1)Part Number E15740-04 for integration purpose.
    After performing all the integration tasks mentioned in the document, while testing the ingtegration, the expected results are not been serverd.
    If I access OIM admin console URL, am getting default OIM admin console URl instead of OAM SSO login page for authencation. and also I am unable to login using either xelsysadm\oimadmin\oamadmin but I can login using weblogic, so this is referin to the default embeded LDAP of weblogic for credential validation.
    OIM and OAM are deployed on separate hosts, please find the deployment details below.
    1. JDK: 1.6.0_29
    2. WLS : 10.3.5
    3. LDAP: Oracle Internet Directory: 11.1.1.5.0
    Oracle Virtual Directory: 11.1.1.2.0
    4. Webserver: Oracle HTTP Server fronting the OIM
    The Integration videa on Support.oracle assumes that all components OIM\OAM/OID/OHS being on the same host.
    I have my OIM and OAM both patched to the latest BP which is BP 02. There is a support article which specifically talks about few settings ton be made for BP 02.
    the article ID is 1447494.1.
    Even after doing all these, the integration is not working.
    As per the support article, I need to use preferred host name for agent fronting OIM as IAMSuiteAgent and if I do that, the proxying of OIM server with the webserver host will not work at all and ends with 404 not found error when I access using http://OHShost:OHSport/oim.
    but if i use the name of agent i.e webserver name in the preferred host field, the redirection would happen and i get OAM SSO login page for authentication, however with the credential validation at this page, the OIM login page (http://OIMhost:OIMport/oim) is provided prompting for login again.
    also if i access OIM login page http://OIMhost:OIMport/oim directly, the OAM SSO page is not coming for authentication.
    I am awaiting your advice\suggestions or workarounds if any one has come across this kind of issue, which i am sure is an obvious case.
    Thanks,
    Nagendra

    Hi,
    Any help in this regard please/
    Thanks
    Nagendra

  • Automatic approval workflow does not work anymore

    Hi,
    Our automatic approval workflows configured via standard business configuration sets (process controlled) do not work anymore. They did work previously.
    After changing the BUS objects 'automatic approval' workflow into the 1-step manager approval workflow it does work.
    - The 'automatic approval' workflow does not seem to generate a workitem, the bbp_pd 'workflow' part is empty. In addition previously approved documents via 'automatic approval' do not contain workitem details via bbp_pd either anymore.
    - We applied a new SP (SP07) not that long ago.
    - These documents go into status: 'awaiting approval', the documents 'approval' details tell us the following:
    001 Automatic Approval Valid (Can be Started) Open (No Decision Made) SYSTEM system
    However the system does not execute the task, how come? What normally ensures the system executes these 'automatic approval' tasks (report?)?
    Any input is very much appreciated.
    Kind regards,
    Tim

    Hi Balaji,
    In SRM 7.0,
    Our automatic approval workflows configured via standard business configuration sets (process controlled) do not work anymore. They did work previously.
    - The 'automatic approval' workflow does not seem to generate a workitem, the bbp_pd 'workflow' part is empty. In addition previously approved documents via 'automatic approval' do not contain workitem details via bbp_pd either anymore.
    - - These documents go into status: 'awaiting approval', the documents 'approval' details tell us the following:
    001 Automatic Approval Valid (Can be Started) Open (No Decision Made) SYSTEM system
    However the system does not execute the task, how come? What normally ensures the system executes these 'automatic approval' tasks (report?)?
    Any input is very much appreciated.
    Regards,
    Shears

  • Workflow does not work properly

    Hi experts,
    I had configure approval process for my folder. The problem is when i upload a file, there is no email sent for approval. I have a FSDB repository. What went wrong? Appreciate any suggestions.
    Thanks,
    Nanie

    Hello,
    Workflow does not start automatically by uploading documents.
    You have to Submit for Approval these documents.
    Regards
    BP

  • Multiple scheduled workflows does not work correctly

    Hi All,
    I hava made a simple workflow who executes a powershell script with the latest SMLETS, this workflows is triggered when a new incident is created and after the script change the status of the related computer that is affected by the incident.
    When I do this just for one computer it works very fine, but when I create by example 4 incidents for several computers the workflows does not change the status of the comptuers.
    For the moment I create a incident and I wait the workflows is finished and i continue to create the next incident it is ok. But I cannot to put this in production environment where several analyst create incient for several devices.
    Any Idea?
    Thank you
    MIKE

    Hi,
    Ben was right when asked you to share the PS code.
    It seems that it works for one instance and doesn't work for multiple ones. It's a regular case when you get objects using search request. Share the PowerShell code and receive the prompt within minutes.
    Cheers,
    Marat
    Site: www.scutils.com  Twitter:
      LinkedIn:
      Facebook:

  • Help! Pavilion Dv7 Integrated mic array not working!

    Ok ive looked at many forums and couldnt find a solution i recently booted my laptop and didnt have a driver backup so i manually downloaded and installed all the correct drivers everything seems to be functioning correctly accept the mic. in the recording section of the sound control panel all i see is external mic, integrated mic, and stereo mix. my problem is that when i listen to my int. mic array all i hear is static, i turned down the levels and it still didnt work; i updated but the problem kept occuring. any help; i think its the idt codec idk but help please!

    Raddy_Srey
    The following steps were posted by @DavidPK. I am copying the steps I want you to try rather than just linking you the thread as it is quite long. I am also providing a link to the thread below.
    “Right click the speaker icon in the Taskbar and select Playback Devices. Click the Recording tab, right click the 'Integrated Microphone array' and select Properties. Click the Microphone Enhancements tab and put a tick in the box next to 'Disable microphone enhancements'. Click Apply and Ok to save this change and the restart the notebook - has this made any difference?”
    The thread named “ internal microphone not working on pavilion dv7” is linked below.
    http://h30434.www3.hp.com/t5/Notebook-PC-Sound-and​-Audio/internal-microphone-not-working-on-pavilion​...
    If this does not resolve your issue please re-post so we can continue.
    Please click the "Thumbs Up" on the bottom right of this post to say thank you if you appreciate the support I provide!
    Also be sure to mark my post as “Accept as Solution" if you feel my post solved your issue, it will help others who face the same challenge find the same solution.
    Dunidar
    I work on behalf of HP
    Find out a bit more about me by checking out my profile!
    "Customers don’t expect you to be perfect. They do expect you to fix things when they go wrong." ~ Donald Porter

  • GRC AC v10 SPM WF - Workflow Item not showing up in WF Inbox

    GRC AC v10 - SP12
    The outlook email notification for the Workflow Item goes out, but there is nothing in the NWBC Inbox for the WF Item. Subsitution is setup correctly.
    Any ideas?
    -john

    Hi John
    this is probably be a silly question but what substitution did you set up for ZFF_CTL_01? I assume the item is in that user's inbox. Which user is meant to be receiving?
    I also noticed this KB article (1589130) which mentions the delegated person needs GRAC_REQ authorisation. Have you checked if security access issue?
    There was also mention that the delegated approver does not appear in the MSMP instance runtime (your screen shot suggests same situation unless you have not set up the delegation). SP14 delivers the fix or refer to  1915928 - UAM: Delegated Approver is not visible in the Instance status
    Possibly have a look at both of them to see if they resolve your issue.
    Regards
    Colleen

  • OOB Approval Workflow Not Working as Expected

    I am using the OOB Approval Workflow with an InfoPath (Browser Based) form that is published to a form library. The form contains multiple options for approvers that route serially.  I open the form, fill it out, and submit it to the library. The
    approval workflow is set to automatically start when an item is created. When the first Item is created the it works correctly. The workflow's task status is "In Progress" and the workflow assigns a task to the person selected in the person/group
    picker on the Infopath form. 
    The issue is when I submit a second form to the library. The workflow automatically sets the the "Outcome" to "Rejected" and never assigns a task to the person selected in the person/group picker on the Infopath form. See below:

    check the ULS logs and share the more details why its auto rejected.
    you can configure the Diagnostic Log as verbose for Workflow.
    http://technet.microsoft.com/en-us/library/jj658588.aspx
    share the result.
    Please remember to mark your question as answered &Vote helpful,if this solves/helps your problem. ****************************************************************************************** Thanks -WS MCITP(SharePoint 2010, 2013) Blog: http://wscheema.com/blog

  • Message Monitoring Tool in RWB for Integration Engine Messages not working

    Hi all
    We currently work on a Pi 7.11 system. I f we start the runtime workbench and going to the message monitoring, we want to get in to a message in the integration engine.  Normaly we should get the same sxi_monitor in the web browser, but we only get the soap envelope. The pipeline steps on the  left side and also the payload cannot be seen.
    We increased the rights of the user to sap_all but this did not changed anything. We also implemented the J2EE monitoring rule.
    Seems to me as we forgot a setting after installation, but which??
    Thanks in advance for  your help.
    Oliver

    Hi Oliver,
    I work on PI 7.0 and I know it's very different from 7.1x releases, but your problem sounds like a similar "problem" on 7.0.
    Is your message sycronous? At PI 7.0 the default configuration is defined to remove the payload of sync messages. You can change it on JAVA Visual Administrator.
    Try to find this parameter in Java Visual Administrator and set it to "false", below you will find the PI 7.0 path to this:
    Server >> Services >> SAP XI AF Messaging >> messaging.syncMessageRemover.removeBody
    I hope it helps,
    Marcelo Vieira

Maybe you are looking for