Question Re: GRC 10 MSMP workflows - Issue in Additional Q&A

GRC 10 MSMP workflows - Issue

Former Member — Fri, 21 Feb 2014 01:31:00 GMT

Hi All,

In GRC 10 when creating an access request, user will have an option to add ROLES and SYSTEMS. Here what is happening is if i add System line item, workflows are not working even though i have routing rule for system line items separately. I have tried in different ways and none worked out so far.

Has anyone implemented workflows having both ROLES and SYSTEM lineitems together and were succesful ?

What is the best practise while creating an access request? Just adding roles or both roles and System lineitems together?

Is there any option to remove SYSTEM option from ADD button available on access request screen ?

Things i have tried and one more consultant on this forum also had the same issue. Still couldn't crack solution for this

1. If you add both role and system as line item in access request, both has to have the approvers defined (custom agent or standard agent) otherwise the request goes to "Approver Missing" path

2. If you add approver to the system line item and when it is approved the whole request moves to next stage (it doesnt wait for the role line items to be approved)

3. Even if you add a routing rule to split the system line items from the request, the whole request is getting routed to the detour path

So in essence if you mix system and role in the line items, the system takes precedence and the whole request follows suit.

Experts please share your suggestions or ideas to make this work.

Thanks a lot in advance.

Regards,

Padmavathi.

Re: GRC 10 MSMP workflows - Issue

Colleen — Fri, 21 Feb 2014 02:40:42 GMT

Hi Padmavathi

What does your BRF+ decision table or configuration look like?

Regards

Colleen

Re: GRC 10 MSMP workflows - Issue

Former Member — Fri, 21 Feb 2014 08:07:09 GMT

Dear Sai,

As per Standard practics, in case of New Account user have to first select system and then either default role or required role (As system has to first understand where new account need to be created and then respective role need to be sellected). But in case of Request for Authorization (existing user) user can directly search role, system will give list of all available across system.

Regards..

Imran

Re: GRC 10 MSMP workflows - Issue

Former Member — Fri, 21 Feb 2014 10:43:17 GMT

Hello Padmavathi,

System is behaving correctly.

Let me explain this.

First of all adding system information is not required if you are not using business roles,or you are expecting a routing futher in the workflow or you have to set system validitiy for the user.

System information is automatically picked by GRC as soon as you add single or composite role (not in case of business roles) .

If still you have business requirement (like adding parmeters id whcih are system specific) to add system in request , you need have a routing rule as soon as request is submitted to spearate role and system else you will get the same responce as you mentioned.

In your situation you can have a first stage as dummy stage, have routing rule to spearate role and system and have escalation enable after 1 min at dummy stage so request is automaticlly forwarded after 1 min and routing rule get executed automatically .

By doing this only roles will ne avaible at first stage for approval and even if approver want to see complete request they can see that .there is one optio nat stage level to see complete request even instead you get what you have to approve .

Hope this helps..

Ashish

Re: GRC 10 MSMP workflows - Issue

Former Member — Tue, 25 Feb 2014 07:10:28 GMT

Hi Ashish,

Can you help me on what basis i need to separate the LineItem SYSTEM from the request to different path?

If it is a role, i can define in my BRF+ decision table as If ROLE_NAME or ROLE_TYPE is X, then go to Y.

But for lineitem SYSTEM, how to define it?

Can i say if LINE_ITEM_KEY = SYSTEM or my RFC connector, then go to Y ? Am i correct?

Please help.

Regards,

Sai.

Re: GRC 10 MSMP workflows - Issue

Former Member — Tue, 25 Feb 2014 14:24:19 GMT

use the GRACREQPROVITEM table, the column that you want is PROV_ITEM, ROL => role, SYS => system. The REQ_ID can be had by looking in table GRACREQ using the request number. So you are looking at 2 dblookups. Use PROV_ITEM as a column in the decision table and you're good to go!

Re: GRC 10 MSMP workflows - Issue

former_member184114 — Sun, 13 Apr 2014 06:49:24 GMT

Padmavathi,

Please follow below link, you will get it sure:

Regards,

Faisal

Re: GRC 10 MSMP workflows - Issue

Former Member — Mon, 14 Apr 2014 05:24:18 GMT

Hi Faisal,

Thanks for the details. My issue was already resolved.

Regards,

Sai.

Re: GRC 10 MSMP workflows - Issue

Colleen — Mon, 14 Apr 2014 07:31:08 GMT

HI Sai

would you please share your resolution and mark the answer as complete so the rest of the community can benefit?

cheers

Colleen

Re: GRC 10 MSMP workflows - Issue

Former Member — Mon, 14 Apr 2014 09:44:32 GMT

Hi All,

I have followed the below blog post to separate System and Role Line Items and it worked fine for me.

Colleen,

From next time will update the thread and will mark as answered once the issue gets resolved. I do that most of the times and this time I missed it

Regards,

Sai.

Re: GRC 10 MSMP workflows - Issue

former_member184114 — Mon, 14 Apr 2014 09:48:16 GMT

Still this is not marked as "Answered"!

Re: GRC 10 MSMP workflows - Issue

Former Member — Mon, 14 Apr 2014 10:01:36 GMT

Faisal,

I have marked it

Regards,

Sai.

Re: GRC 10 MSMP workflows - Issue

Former Member — Thu, 17 Apr 2014 10:00:07 GMT

Hi Faisal,

I have followed the link ARQ: How to route a request based upon system and role??? to create my initiator.

This is working absolutely fine but i found a issue recently when i raised a EAM request. My initiator table has a condition to direct requests with request type to FFPATH but instead they are going to default path and getting auto approved.

I assume that you are also using same initiator decision table. Have you come across any such issue?

Regards,

Sai.

Re: GRC 10 MSMP workflows - Issue

former_member184114 — Thu, 17 Apr 2014 16:19:50 GMT

Sai,

I have not yet configured this workflow for FF. But soon I am going to configure the same. This would be interesting to know what is going wrong.

cAn you please share your BRF+ and MSMP settings?

Regards,

Faisal

Re: GRC 10 MSMP workflows - Issue

Former Member — Mon, 21 Apr 2014 02:54:45 GMT

Hi Faisal,

If the request type is empty for the row which has ROLE_CONNECTOR with "Is Initial", then FF requests are going to defaultpath.

I updated request type for first row as 001 and 002 and now everything works fine. You can check below blog for the same.

Regards,

Sai.

Re: GRC 10 MSMP workflows - Issue

former_member184114 — Mon, 21 Apr 2014 06:50:41 GMT

Thanks for sharing this link 🙂

Re: GRC 10 MSMP workflows - Issue

Former Member — Tue, 05 Aug 2014 14:56:49 GMT

Hello All Experts,

I am facing same issue but scenario is different which I found not possible with above solution.

1) In change authorizations option, end user submits request with only filling SYSTEM option.

2) Request goes to 1st Stage people, who will add roles into system

Existing MSMP no roleowner is used as routing condition here, if role approver not FOUND, request takes ESCAPE ROUTE and goes to Escape Stage with system option and role(if not defined role owner for it)

3) If role has owner, it goes to Role Owner.

Can we remove SYSTEM option from request and send it to NO PATH stage instead of ESCAPE route

Is there any better way to handle this? client do not wants to APPROVE requests with SYSTEM entries but ready to handle requests with no role owner request.

Please help.. **Urgent**

Re: GRC 10 MSMP workflows - Issue

Former Member — Tue, 05 Aug 2014 15:51:43 GMT

Hi Shailesh

Remove the change user action and add assign, retain and remove actions for change request type. This should remove system as a selection in ARQ.

Thanks

Anthony

Re: GRC 10 MSMP workflows - Issue

Former Member — Tue, 05 Aug 2014 16:01:33 GMT

Anthony,

Can we achieve resolution without using above action??

Reason is its a business requirement to have SYSTEM option while submitting request.

Can't we ignore or delete or redirect system entry ?

Many thanks in advance

Regards,

Shailesh

Re: GRC 10 MSMP workflows - Issue

Former Member — Tue, 05 Aug 2014 16:22:44 GMT

Hi Shailesh

I am lost with what you are trying to achieve. What do you mean by the statement below.

Is there any better way to handle this? client do not wants to APPROVE requests with SYSTEM entries but ready to handle requests with no role owner request.

Thanks

Anthony