SP9 Patch 9 Approvals Not Processed

[Former Member]

Gurus,

I'm facing an issue with Approvals in 7.2SP9 Patch9 where the approval tasks are not being considered. I started with a multiple stage approval workflow but have since reduced it to a single stage. It is an assignment approval task which retrieves the approver from the PVO. Nothing that I have tried results in the approval task being processed. Therefore I'm looking for suggestions.

Reviewing the idmv_approvals_<> views displays no entries. I can see the approvals in mxpv_approval with a status of 'wait'. Yet I am unable to determine what IdM is waiting for. Of course since the approvals are not processing there are no entries for the approver in the To Do tab.

Thoughts/suggestions are appreciated

Thanks

[Former Member · Accepted solution]

Hi Michael,

I finally got the approval mechanism working! The dispatcher option "Evaluate approvals" was not checked (under "Policy" tab).

...and also make sure that you are running the latest version of DesignTime (7.20.9.13) and Runtime (7.2.9.9) patches

and that you also updated your Database (mxmc-update.cmd and mxmc-enable-72-approvals.cmd scripts).

Please try this and let us know if it resolved your problem.

Cheers!

Marco

[Former Member]

Hello, I have a very similar issue and I did apply the Designtime SP9 Patch 13 and runtime Patch 9. However, the issue persists.

[former_member2987]

Marco,

Did you do the database updates and update the dispatchers? Don't forget that the dispatchers and event agents need to be turned off before doing a database update?

Thanks,

Matt

[Former Member]

yes, I had stopped the dispatcher. My dispatcher is on version 7.2.9.9. I also updated the database running the mxmc_update cmd file. My IC version is 7.20.9.13..

[Former Member]

forgot to mention that I have no event agent configured

[former_member2987]

Marco,

What database are you using?  Also it's a long shot, but there's another database update script that turn on approvals.  Can you try running that?

Matt

[Former Member]

Hello Matt,

I'm running MSSQL 2012. for the script, are you talking about mxmc-enable-72-approvals.cmd ? If yes, I had executed it already. I executed it again and still having the issue.

Thanks

[former_member2987]

Ok, then I think I my last stab is to try reapplying the database update, if you have not done so already.

Matt

[Former Member]

Hi Matt,

I did the update again. I ran the Disable approvals script and then ran the Enable approvals script. tested again and still no approvals in the todo tab of my approver user.

One thing that I noticed, is that a query of the MXPV_APPROVAL table shows that all statuses are in WAIT. The approver column shows 0 for all of them.

In my scenario, the approver is set to the privilege level (PRIV:IDM:ONLY approver is set there) and the approval task is set to Get Approvers from : Role / Privilege.

Any other suggestions? Thank you again

[former_member2987]

Hi Marco,

I think at this point you need to open a Support Note if you have not already done so.

Matt

[Former Member]

Thank you Matt, I have a ticket already... it's been open for about 5 months now. We will see.

Cheers

Marco

[former_member2987]

Hi Marco,

Time to escalate it, I guess.

Matt

[terovirta]

What happens? Does the execution reach the approval workflow? Can you see from the job log that the workflow is executed? Does the execution just flow through the approval workflow? Does the role get assigned to the user?

Can you print out the values from the PVO just before the approval step so, that PVO has the values you're expecting it to have?

How did you configure the approval step? Can you share a screen shot?

I think I used the following document to configure the last approval workflow I've done (a year ago on Sp8 which has been upgraded to Sp9, cannot remember the exact patch); http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/80f324e1-925f-2f10-a7a5-dea9be51b...

Based on the requirements I just update the approver in PVO first with manager's mskey and after that update the approver in PVO with role owner's mskey. Only problem that I had was that on the certain Sp8 patch the timeouts or escalation timeouts weren't calculated correctly.

regards, Tero

[Former Member]

Tero, thanks for the response.

The process bascially stops at the approval task with no further provisioning. The apporval item does not show in the To Do list of the approver nor does the role get assigned to the user.The process just hangs.

Approval Stage Setting:

As you can see in the screenprint above, I do write the PVO/Attribute values to a file for inspection. I can confirm that the correct MSKEY value has been assigned to MX_APPROVERS attribute.

I've configured approval stages many times in the past using more complex logic than what I'm attempting to do here. What's different this time around is that I'm using SP9 Patch 9. I've also opened a message with SAP.

Any additional thoughts/suggestion...?

Message was edited by: Matt Pollicove by request

[terovirta]

Your configuration looks the same as mine in the current project (apart from timeouts and sent notifications).

If you can see the expected values from the PVO then it sounds like your configuration is correct.

Does it act any different with different users? Is the approver different user than submitter and different than the person to whom the role is requested? (Just out of curiosity as I've had some issues with earlier 7.2 SPs when the requester/approver has same mskeys.)

Is the PVO deleted or does it remain in DB? If it's deleted that would suggest the execution flows through the workflow.

Hope the message gets solved soon,

regards, Tero

[Former Member]

I have insured that there are different Identities used in the approval process. The requestor is different from the approver which is different from the user who is to receive the access. The pending value remains in the database as to suggest the process is not complete.

I have confirmed this same behavior on a second installation of IdM 7.2SP9 Patch 9. Both of these systems were at a lower SP version and then upgraded to 9 at a later point. Before being upgraded, no approval tasks existed in the system. Therefore I can not say with certainty that the approvals functioned before going to SP9-9 in these systems specifically.

I will continue to dig into this and provide an update once its resolved.

Thanks again.

[ChrisPS]

Hello Michael,
                     install designtime patch 12 and runtime patch 9 which I believe should resolve the issue.

Thanks,

Chris