Approval procedure - Named approvers of requested business role or organization? (7.1.1)

Question

Hello, im an newbie, 
 Im looking for an Approval Procedure - Named approvers of requested business role or organization? (7.1.1) 
 Idea is 
 Business role has a configured UID_RulerContainer Application role "Business role approvers" and some people are assigned to it. Business role has an assignment resource assigned to Shelf in IT Shop Service Item is assigned to IT Shop and ready for order. 
 I'd like to create an approval procedure that evaluates the members of the UID_RulerContainer "Business role approvers" when the Service Item is ordered in the Shop. It doesnt seem this functionality is out of the box, only "MS - Manager of the requested Business role or organization", 
 Someone has experienced similar case? 
 Any help / hint would be greatly appreciated. 
 Best regards.

Markus Weiss-Ehlers · Answer

Hi and welcome to the One Identity Manager forum. 
 There is indeed no OOTB Approval Procedure Named approvers of requested business role or organization for your use-case in 7.1.1. 
 But you can create your own approval procedure to do exactly what you are describing. I am going to walk you through the steps. 
 NOTE: SQL is for Microsoft SQL Server 
 
 Create a new approval procedure in the Manager in IT Shop\Basic configuration data\Approval procedures
 
 Approval procedure = <Abbreviation to use for the procedure.Something like C7> 
 Description = Named approvers of requested business role or organization 
 No DBQueue Processor task selected

Use the Task Change queries for approver selection to open the form to fill in your approver selection query 
 Click on the Add button and set the Approver selection to something like Named Approvers of a role, something to be assigned to 
 User the following query to select the members of the Ruler Container (named approvers) for the role assignment. (Query works only for version 7.1.1 and above). 
 
 -- Option for version 7.1.1 and higher
select distinct ro.UID_Person, ro.UID_PWORulerOrigin 
	from PersonWantsOrg pwo join BaseTree /*All Roles*/ bt on ObjectKeyOrgUsedInAssign = bt.XObjectKey
 and bt.UID_OrgRoot not in ('QER-V-NonCompliance', 'QER-V-ITShopOrg', 'QER-V-ITShopSrc')
 cross apply dbo.QER_FTOrgHighestRulerContainer (bt.uid_Org
 , pwo.UID_PersonInserted
 , pwo.UID_PersonOrdered
 , 0
 , 0
 ) ro
where pwo.UID_PersonWantsOrg = @uid_personwantsorg
 
 If you want to achieve the same with version 7.0.x or 7.1 you have to use the following query: 
 -- Option for version 7.0-7.1
select distinct ro.UID_Person, ro.UID_PWORulerOrigin 
	from PersonWantsOrg pwo join BaseTree /*All Roles*/ bt on dbo.QBM_FCVObjectkeyToElement('ColumnValue1', pwo.ObjectKeyAssignment) = bt.UID_Org
 and bt.UID_OrgRoot not in ('QER-V-NonCompliance', 'QER-V-ITShopOrg', 'QER-V-ITShopSrc')
 cross apply dbo.QER_FTOrgHighestRulerContainer (bt.uid_Org
 , pwo.UID_PersonInserted
 , pwo.UID_PersonOrdered
 , 0
 , 0
 ) ro
where pwo.UID_PersonWantsOrg = @uid_personwantsorg
union 
-- could be in the other part of the assignment key
select distinct ro.UID_Person, ro.UID_PWORulerOrigin 
	from PersonWantsOrg pwo join BaseTree /*All Roles*/ bt on dbo.QBM_FCVObjectkeyToElement('ColumnValue2', pwo.ObjectKeyAssignment) = bt.UID_Org
 and bt.UID_OrgRoot not in ('QER-V-NonCompliance', 'QER-V-ITShopOrg', 'QER-V-ITShopSrc')
 cross apply dbo.QER_FTOrgHighestRulerContainer (bt.uid_Org
 , pwo.UID_PersonInserted
 , pwo.UID_PersonOrdered
 , 0
 , 0
 ) ro
where pwo.UID_PersonWantsOrg = @uid_personwantsorg

HtH 
 Markus

edi.imhof · Answer

Hello Markus, thank you very much, thats exactly what I needed. I tested the V7.1 Version and it seems to work very well. Will look at the 7.1.1 version soon. 
Best regards, Edi

Endpoint Privilege Management

Approval procedure - Named approvers of requested business role or organization? (7.1.1)