Version: 6.2+
Workflow: Provisioning Approval Subprocess
Scenario
Some installations require that instead of an individual acting as an approver, a Workgroup is utilized instead. This causes a potential issue, what if the user whom the request was submitted for (the requestee) is a member of the Workgroup assigned as its approver? Potentially you have a situation where someone is approving their own access. Depending on the business requirements, this could be considered very bad.
Solution
In the provisioning approval subprocess workflow, it is possible to place a "Validation Script" in the step: "Approval". The result is a red error message (customizable) that gets show to the approver who isn't suppose to be approving. All other members of that workgroup are still able to go in and approve as normal.
Code
<ValidationScript>
<Source>
/*
This validation script will check to make sure whoever is trying to approve the
WorkItem form is not the Identity for which the access was requested. We do this by
getting the "completer" value from the WorkItem, if that is the same as the target identity
"identityName" then a red alert will be shown to that person when they attempt to approve
the item and they will not be allowed to continue. Other members of the workgroup will be
allowed to complete it.
*/
import java.util.*;
import sailpoint.api.ObjectUtil;
//returns the displayName - so need to get the actual identity
String completer = item.getCompleter();
//owner from the WI, checking to make sure it is a workgroup
Identity wiOwner = item.getOwner();
if(null != wiOwner){
if(wiOwner.isWorkgroup()){
//utility call that returns all the members of the workgroup in question
ObjectUtil obj = new ObjectUtil();
Iterator members = obj.getWorkgroupMembers(context, wiOwner, null);
if (null != members){
while(members.hasNext()){
//get the individual identity from the list of wg members
Identity identityCube= (Identity)(members.next()[0]);
String identityDisplayName = identityCube.getDisplayName();
//does the workgroup identity have the same display name as the completer?
if(identityDisplayName.equalsIgnoreCase(completer)){
//found the displayname of the approver in the wg, get the unique ID
String identityCubeName = identityCube.getName();
//if unique id of the wg member with matching displayName as "completer" matches
//the unique id of the target identity, we have a self approval - throw error
if(identityCubeName.equalsIgnoreCase(identityName)){
return "Error message that will be displayed on the approval page";
}
}
}
}
}
else{
//Check if the completer is just an id, if the id's displayName is equal to completer ... send auto-approve
//message
Identity requesteeId = context.getObjectByName(Identity.class, identityName);
if(null != requesteeId){
if(completer.equalsIgnoreCase(requesteeId.getDisplayName())){
return "Error message that will be displayed on the approval page";
}
}
}
}
</Source>
</ValidationScript>
