InitializeReapproval

Initializes reapproval for all privileges marked for reapproval

InitializeReapproval finds all privileges in the Identity Store that have been marked for reapproval and initializes the reapproval process for each. The PolicyAgent sets the internal state flags and creates the necessary workflow instantiation data, so that the StartReapprovalWorkflows workflow can subsequently pick up and launch the individual approval workflows for the affected privileges.

Run this workflow first as the setup step in a two-step reapproval cycle, followed by StartReapprovalWorkflows.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

InitializeReapproval

Category

Identity Store

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

-

Connected system / controller type

-

Configuration wizard

LDAP-LDAP

Active in the factory data

not set

Factory data version

7.0

Factory data path

Workflows/Default/Identity Store/InitializeReapproval

Prerequisites

  • The reapproval mechanism must be configured in the Identity Store domain, and the relevant privileges must be flagged for reapproval.

  • The InitializeReapproval in and InitializeReapproval out channels must be configured in the C++-based Server.

Workflow and Activities

Step Activity Description Agent Runs after

1

InitializeReapproval

Policy execution to initialize reapproval

PolicyAgent

start activity

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

InitializeReapproval

InitializeReapproval

PolicyAgent

Full Import

InitializeReapproval in

InitializeReapproval out

Configuration Parameters

Table 1. Parameters of job InitializeReapproval
Parameter Default value

delta_mode

full

delta_on

0

mode

AssignOnly

request

process

trace

2

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

The workflow has a single activity, InitializeReapproval, which runs the PolicyAgent job of the same name. The job reads privileges marked for reapproval from the InitializeReapproval in input channel, sets the necessary state attributes, and writes the updated entries to the InitializeReapproval out output channel. The mode is AssignOnly and the request is process.

Operation

  1. You start the workflow manually from the Identity Manager or attach it to a schedule.

  2. The C++-based Server starts the InitializeReapproval activity and launches the PolicyAgent job.

  3. The agent reads privileges from the Identity Store through the InitializeReapproval in input channel; the channel filter selects privileges that are flagged for reapproval.

  4. For each matching privilege the policy sets the internal state attributes that mark it as ready for the reapproval workflow.

  5. The updated entries are written back through the InitializeReapproval out output channel.

  6. Run StartReapprovalWorkflows next to launch the approval workflow for each initialized privilege.