How to auto approve the first stage in GRC 10

[Former Member]

Dear All,

We're on GRC 10 & 06 SP level.
Right now we have 2 stages of workflow, first stage is Role owner and second stage is SAP security.

The issue we are having is -
-> When I submit the workflow for new SAP account creation request it results in error.
I submit request by adding system name and then roles for assignment, it fails with error agent not found but when I add ONLY roles and then approve the first stage and at second stage I add system details and approves it works fine and the user id gets created in the backend system with roles assigned.

My requirement is I do not want to add the system details in the second stage of approval. Is there a way to auto approve the creation of SAP account when I submit the request in one go.

All I need is when I submit the request with system and role assignment details the request should move forward.

Thanks in advance.
James

[Former Member]

Hi,

Did you resolve this? I have a similar issue. But i need the request born approve.

[former_member490487]

Hi James, were you able to fix this? If so, would you mind sharing the solution, please?

[Former Member]

Hi,

Did you resolve this? I have a similar issue. But i need the request born approve.

[former_member490487]

Hi Claudio, we were not able to resolve the issue, so we dropped the user creation altogether, so GRC only performs role assignments.

Not able to answer on behalf of the person who created this question though.

[vandana_maini]

Hi James,

There are 2 ways to do this:

1. Create an customized BRF+/ for approver of the Systems stage and put the agent as empty approver. So this will auto approve and for roles, it will be directed to the right approvers and you will not face any missing agent error.

2. Do the way you are doing and check one of the parameters in SPRO --> GRC --> Access Control --> User Provisioning --> Maintain Provisioning Settings --> Maintain Global Provisioning Configuration CREATE USER FOR ROLE ASSIGN ACTION to "YES". This will help you achieve the desired results. But this has its own Cons, so please check the right way according to your requirement.

I would prefer way 1, since it a good practice and can help achieve the desired results although it involves more (one-time) effort.

I hope this helps.

Regards,

Vandana

[Former Member]

Vandana,

Thanks.

Second option doesn't work, I think its due to low SP level 06. I have referred many archived threads and looks like it may work from SP10 but I'm not sure. What table contents do you select in decision table for your first option?

Again, my workflow works fine but I want to have auto approval for one stage(System) when I submit request for NEW user account by adding both system and roles. My first stage is Role Owner and second stage is security team.

Thanks

James

[former_member324455]

Vandana,

How do I set Stage Agent ID as empty approver. Agent rule/ID for the stage is mandatory field for me. I cannot leave it empty.

[Colleen]

Hi Giridhar

To auto-approve/have no approve you need to route the request to a path with no stages.