StartReapprovalWorkflows

Starts all not yet started workflows for reapproval

StartReapprovalWorkflows is the second step in a reapproval cycle. After InitializeReapproval has set the internal state flags for all privileges that require reapproval, this workflow instructs the PolicyAgent to start the individual approval sub-workflows for each of those privileges. The agent iterates over the prepared records and instantiates the appropriate reapproval workflow for each one.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

StartReapprovalWorkflows

Category

Identity Store

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

-

Connected system / controller type

-

Configuration wizard

LDAP-LDAP

Active in the factory data

not set

Factory data version

7.0

Factory data path

Workflows/Default/Identity Store/StartReapprovalWorkflows

Prerequisites

  • InitializeReapproval must have been run first; the privileges to be reapproved must have their internal state attributes set.

  • The StartReapprovalWorkflows in and StartReapprovalWorkflows out channels must be configured in the C++-based Server.

Workflow and Activities

Step Activity Description Agent Runs after

1

StartReapprovalWorkflows

Policy execution to start reapproval workflows

PolicyAgent

start activity

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

StartReapprovalWorkflows

StartReapprovalWorkflows

PolicyAgent

Full Import

StartReapprovalWorkflows in

StartReapprovalWorkflows out

Configuration Parameters

Table 1. Parameters of job StartReapprovalWorkflows
Parameter Default value

delta_mode

full

delta_on

0

mode

AssignOnly

request

process

trace

2

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

The workflow has a single activity, StartReapprovalWorkflows, which runs the PolicyAgent job of the same name. The job reads the prepared privilege records from the StartReapprovalWorkflows in input channel, starts a reapproval workflow instance for each record, and writes the updated entries to the StartReapprovalWorkflows out output channel. The mode is AssignOnly and the request is process.

Operation

  1. Run InitializeReapproval first to prepare the privileges that require reapproval.

  2. You start StartReapprovalWorkflows manually from the Identity Manager or attach it to a schedule that runs after InitializeReapproval.

  3. The C++-based Server starts the StartReapprovalWorkflows activity and launches the PolicyAgent job.

  4. The agent reads the prepared privilege records from the Identity Store through the StartReapprovalWorkflows in input channel.

  5. For each record the agent instantiates the configured reapproval workflow.

  6. The updated records are written back through the StartReapprovalWorkflows out output channel.