• State Verified Answer
  • +1 person also asked this people also asked this
  • Replies 6 replies
  • Subscribers 96 subscribers
  • Views 2679 views
  • Users 0 members are here
Options
Related

Start Unsubscribe Approval Workflow when PersonWantsOrg request ist Aborted because of Person Deactivated

edi.imhof
over 3 years ago

Hi community

We have some manually provisioned Systems where People can request Access to by requesting a resource in IT Shop.

Approval workflows work fine for subscribe (provision) and unsubscribe (deprivision).

However when a Person leaves and is permanently deactivated, the identity removed from the IT Shop an requests are silently aborted without notification, that a deprovisioning has to be performed.

The same is the case for attestations, if an attestation is denied, the request ist aborted, an no one is Aware, that a deprovisioning must be done.

Whats a simple Approach to address this issue?

Any ideas are appreciated,

Greetings, Edi

Parents
  • 0 over 3 years ago

    Which version are you using?

    Starting with 8.1, you can configure if the auto-removal for denied attestations should use either the Abort or the Unsubscribe method using the configuration parameter

    QER | Attestation | AutoRemovalScope | PWOMethodName

    In regards to the deactivated employee, you do have the option to change the condition of the dynamic rule for the customer nodes so that the employees will not be removed from it. You could then implement a custom process at the person table that starts the unsubscribe for the requested products if the person is deactivated permanently. 

    You might need an additional mechanism (a schedule perhaps) that would identify and tag all persons that are permanently deactivated and have no assigned requests (or running unsubscriptions) so that they can be removed from the IT Shop customer nodes.

    HTH

Reply
  • 0 over 3 years ago

    Which version are you using?

    Starting with 8.1, you can configure if the auto-removal for denied attestations should use either the Abort or the Unsubscribe method using the configuration parameter

    QER | Attestation | AutoRemovalScope | PWOMethodName

    In regards to the deactivated employee, you do have the option to change the condition of the dynamic rule for the customer nodes so that the employees will not be removed from it. You could then implement a custom process at the person table that starts the unsubscribe for the requested products if the person is deactivated permanently. 

    You might need an additional mechanism (a schedule perhaps) that would identify and tag all persons that are permanently deactivated and have no assigned requests (or running unsubscriptions) so that they can be removed from the IT Shop customer nodes.

    HTH

Children