GRC 10 MSMP workflows - Issue

[Former Member]

Hi All,

In GRC 10 when creating an access request, user will have an option to add ROLES and SYSTEMS. Here what is happening is if i add System line item, workflows are not working even though i have routing rule for system line items separately. I have tried in different ways and none worked out so far.

Has anyone implemented workflows having both ROLES and SYSTEM lineitems together and were succesful ?

What is the best practise while creating an access request? Just adding roles or both roles and System lineitems together?

Is there any option to remove SYSTEM option from ADD button available on access request screen ?

Things i have tried and one more consultant on this forum also had the same issue. Still couldn't crack solution for this

1. If you add both role and system as line item in access request, both has to have the approvers defined (custom agent or standard agent) otherwise the request goes to "Approver Missing" path

2. If you add approver to the system line item and when it is approved the whole request moves to next stage (it doesnt wait for the role line items to be approved)

3. Even if you add a routing rule to split the system line items from the request, the whole request is getting routed to the detour path

So in essence if you mix system and role in the line items, the system takes precedence and the whole request follows suit.

Experts please share your suggestions or ideas to make this work.

Thanks a lot in advance.

Regards,

Padmavathi.

[Former Member · Accepted solution]

Hello Padmavathi,

System is behaving correctly.

Let me explain this.

First of all adding system information is not required if you are not using business roles,or you are expecting a routing futher in the workflow or you have to set system validitiy for the user.

System information is automatically picked by GRC as soon as you add single or composite role (not in case of business roles) .

If still you have business requirement (like adding parmeters id whcih are system specific) to add system in request , you need have a routing rule as soon as request is submitted to spearate role and system else you will get the same responce as you mentioned.

In your situation you can have a first stage as dummy stage, have routing rule to spearate role and system and have escalation enable after 1 min at dummy stage so request is automaticlly forwarded after 1 min and routing rule get executed automatically .

By doing this only roles will ne avaible at first stage for approval and even if approver want to see complete request they can see that .there is one optio nat stage level to see complete request even instead you get what you have to approve .

Hope this helps..

Ashish

[Former Member · Accepted solution]

Hi Ashish,

Can you help me on what basis i need to separate the LineItem SYSTEM from the request to different path?

If it is a role, i can define in my BRF+ decision table as If ROLE_NAME or ROLE_TYPE is X, then go to Y.

But for lineitem SYSTEM, how to define it?

Can i say if LINE_ITEM_KEY = SYSTEM or my RFC connector, then go to Y ? Am i correct?

Please help.

Regards,

Sai.

[Former Member · Accepted solution]

use the GRACREQPROVITEM table, the column that you want is PROV_ITEM, ROL => role, SYS => system. The REQ_ID can be had by looking in table GRACREQ using the request number. So you are looking at 2 dblookups. Use PROV_ITEM as a column in the decision table and you're good to go!

[Former Member]

Dear Sai,

As per Standard practics, in case of New Account user have to first select system and then either default role or required role (As system has to first understand where new account need to be created and then respective role need to be sellected). But in case of Request for Authorization (existing user) user can directly search role, system will give list of all available across system.

Regards..

Imran

[Former Member]

Hello All Experts,

I am facing same issue but scenario is different which I found not possible with above solution.

1) In change authorizations option, end user submits request with only filling SYSTEM option.

2) Request goes to 1st Stage people, who will add roles into system

Existing MSMP no roleowner is used as routing condition here, if role approver not FOUND, request takes  ESCAPE ROUTE and goes to Escape Stage with system option and role(if not defined role owner for it)

3) If role has owner, it goes to Role Owner.

Can we remove SYSTEM option from request and send it to NO PATH stage instead of ESCAPE route

OR

Is there any better way to handle this?  client do not wants to APPROVE requests with SYSTEM entries but ready to handle requests with no role owner request.

Please help..  **Urgent**

[Former Member]

Hi Shailesh

Remove the change user action and add assign, retain and remove actions for change request type. This should remove system as a selection in ARQ.

Thanks

Anthony

[Former Member]

Anthony,

Can we achieve resolution without using above action??

Reason is its a business requirement to have SYSTEM option while submitting request.

Can't we ignore or delete or redirect system entry ?

Many thanks in advance

Regards,

Shailesh

[Former Member]

Hi Shailesh

I am lost with what you are trying to achieve. What do you mean by the statement below.

Is there any better way to handle this?  client do not wants to APPROVE requests with SYSTEM entries but ready to handle requests with no role owner request.

Thanks

Anthony

[Former Member]

I mean... with option which I have configured.. 1st stage owner will see entry of system+roles which he will add(which has role owner for example)

when he will submit it, system entry(1st row) will follow escape route and routed to escapae stage,

whereas roles having approval will follow intended ROLE OWNER stage..

Business requirement is they can approve escapate route requests which has no role owners BUT not entries which will have ONLY systems...

With above example, only system will take escapate route which business has to approve manually, which is not expected to them

[Former Member]

Hi Shailesh

Based on the above requirement, there is no need to add system in the request line item before submission. Once the role is selected, GRC will automatically populate the system field. As for business to manually approve roles with no role owner, I would configure Approver not found escape routes to route the roles with no role owners to the business for manual approval.  You dont even need to setup a routing for that.

My suggestion is for you to go back to the client and ask why they need system to be included before request submission. It makes no sense to have it based on your requirement.

Thanks

Anthony

[former_member184114]

HI,

MAy I know how do you interpret change request? I mean what do want to achieve with change type of request?

you can add only roles not system by configuring "provisioning settings". Plus you have to configure request type with "assign object" option. This will only allow you to select roles not system.

REgards,

FAisal

[Former Member]

Hi Anthony,

I agree, system field will be populated in request once user selects a role. But not necessary end users will know which role to request for appropriate access. Generally they will know system and tcodes e.g.  so requirement is to have system field while submitting.

In 5.3, business were able to see application(system) field while raising change authorization request and they want exactly same in grc 10.

Please share any thought on this.. agree, this is weird requirement.

[Former Member]

Hi Faisal,

with change request, user will request to change authorizations (assign/remove), however he will only submit system in which he needs access, next stage person will add appropriate roles.

Any suggestion or idea?

settings mentioned by you can't be done since system field needs to be visible

[Former Member]

Hi Faisal,

Can you provide solution to my query?

[Former Member]

This is still possible Shailesh,

Your request submitters will only raise a request with the System access, therefore ensure that if you have any custom initiator in place, it considers line items that are just "systems".

As well as ensuring the request type has the "Assign object" attribute assigned, within your secondary stage setting, ensure the approver is able to change/add/remove assignments within the request.

Within the "Default Stage settings" (in MSMP workflow config screen 5 - Maintain Paths) ensure the stage has "Add Assignment" and "Override assign type" is ticked.

[Former Member]

Thanks Harinam..

Can you provide how the custom initiator should look like:

"
how to ensure, it(request) will considers line items
that are just "systems". "

and do we need to change initiator rule?  I was under impression that 1st stage rule(Agent rule) should have some condition to do that.

Pleeej help

[Former Member]

Hello,

1) you want a path for systems only, so you need to create a path to deal with systems only. Who are the approvers?

2) In the initiator, you need the condition to catch "System only" requests, so as stated in previous answers to you in other threads, you need to utilise the condition column "Role Connector" and have the value set to "Is initial" - and the result to point to the trigger result "System only path" (or whatever you name it).

3) Who is approving the roles? the actual role owners or a general approver based on access request header level attributes like Business Process etc? If you are using such header level attributes, the whole request (both roles and systems) can be kept together and approved by the same approver. If you are using Role owners, then you will have to probably create a seperate path to deal with those aspects of the request.

Consider looking at the following threads again in detail:

- your post and Neeraj has responded to you

[Former Member]

Hi All,

I have followed the below blog post to separate System and Role Line Items and it worked fine for me.

Colleen,

From next time will update the thread and will mark as answered once the issue gets resolved. I do that most of the times and this time I missed it

Regards,

Sai.

[former_member184114]

Still this is not marked as "Answered"!

[Former Member]

Faisal,

I have marked it

Regards,

Sai.

[Former Member]

Hi Faisal,

I have followed the link ARQ: How to route a request based upon system and role??? to create my initiator.

This is working absolutely fine but i found a issue recently when i raised a EAM request. My initiator table has a condition to direct requests with request type to FFPATH but instead they are going to default path and getting auto approved.

I assume that you are also using same initiator decision table. Have you come across any such issue?

Regards,

Sai.

[former_member184114]

Sai,

I have not yet configured this workflow for FF. But soon I am going to configure the same. This would be interesting to know what is going wrong.

cAn you please share your BRF+ and MSMP settings?

Regards,

Faisal

[Former Member]

Hi Faisal,

If the request type is empty for the row which has ROLE_CONNECTOR with "Is Initial", then FF requests are going to defaultpath.

I updated request type for first row as 001 and 002 and now everything works fine. You can check below blog for the same.

Regards,

Sai.

[former_member184114]

Thanks for sharing this link 🙂

[former_member184114]

Padmavathi,

Please follow below link, you will get it sure:

Regards,

Faisal

[Former Member]

Hi Faisal,

Thanks for the details. My issue was already resolved.

Regards,

Sai.

[Colleen]

HI Sai

would you please share your resolution and mark the answer as complete so the rest of the community can benefit?

cheers

Colleen

[Colleen]

Hi Padmavathi

What does your BRF+ decision table or configuration look like?

Regards

Colleen