none
FIM Portal Workflow Approvals questions RRS feed

  • Question

  • Hi,

    Got a few FIM Portal Workflow Approval questions. How many of these can be accomplished with out of the box FIM functionality/GUI:

    1. If there are multiple approvers listed in the 'Approvers' section, and the 'Approval Threshhold = 1 Approver" - then when only one person approves the request, the request will be approved and also be no longer visible to the other approvers?

    2. Can there be two levels of approval required? And if the first approver rejects the request, the second approver will simply not even be notified?

    3. Can the first level approver be an AD Group? and the 'Escalated Approver' be the AD Group Owner?

    4. What happens if the Escalated approval has not happened, say after 10 days...can FIM Service fire off an email to someone like Help Desk?

    Thank you,

    SK

    Monday, September 29, 2014 12:33 AM

All replies

  • Hi Shim,

    If there are multiple approvers listed in the 'Approvers' section, and the 'Approval Threshhold = 1 Approver" - then when only one person approves the request, the request will be approved and also be no longer visible to the other approvers?

    Yep, once the threshold is met the request is approved.

    Can there be two levels of approval required? And if the first approver rejects the request, the second approver will simply not even be notified?

    You can have as many levels of approval as needed by chaining approval activities. If the first approver rejects, the other approvers in the chain don't get notified since the request never made it to them in the first place

    Can the first level approver be an AD Group? and the 'Escalated Approver' be the AD Group Owner?

    Yes, I think this should be possible as long as the group is in FIM.

    What happens if the Escalated approval has not happened, say after 10 days...can FIM Service fire off an email to someone like Help Desk?

    Don't think this can be done using OOTB features, but I might be wrong.

    Monday, September 29, 2014 9:27 AM
  • Thank you, I have also confirmed this by configuring FIM.

    One more question:

    How to configure FIM Workflow so that the 'Escalated Approver' is the AD Group Owner?

    The Workflow Parameters are: Requestor, WorkflowData,Target,Delta

    I tried [//Target/Manager] and [//Target/Owner] but that did not escalate correctly - I thought since the original approver in the workflow was a FIM Portal Security Group, this configuration should work?

    I tried to build a 'WorflowData' item for 'Group Owner' - but the list of attributes available appears to be only 'User' object attributes - not 'Group' object attributes.

    So, how to configure FIM Workflow so that the 'Escalated Approver' is the AD Group Owner?

    Thanks




    • Edited by Shim Kwan Monday, September 29, 2014 9:48 PM
    Monday, September 29, 2014 8:59 PM
  • The AD group owner is the owner as configured in the security group in FIM (in the "Owners" tab).

    [//Target] is essentially giving you the group object, and //Target/Owner is the group owner as seen in FIM.

    Remember, the approval process is following attributes as seen by FIM, it is not showing you attributes from AD. If you have imported your groups from AD already (and assuming you imported the "Managed by" attribute), then the owner field will be populated and he/she will get the approval request.

    I think [//Target/Owner] should work here, can you explain who gets the approval when you do this and what do you expect should happen instead?

    Tuesday, September 30, 2014 8:21 AM
  • Thanks, I was trying to change the FIM server time to simulate 24 or 48  hrs having elapsed, since its in a VM...but that didnt work.

    So now I am going to just wait it out and see whether the escalation occurs correctly. As you have pointed out, that is the config I used which should work [//Target/Owner]...so it just might be a time/date issue.

    I have dropped the escalation to 1 day. So effectively, if I kicked off the approval workflow today, FIM will wait till the end of tomorrow before it escalates, correct?

    Tuesday, September 30, 2014 8:43 AM
  • Changing the FIM server time won't necessarily help - the request has its own timestamp which you can look up in the "Search requests" page.

    The request should escalate by the end of tomorrow though

    Tuesday, September 30, 2014 9:30 AM
  • So my initial request was started on 9/29/2014, and on 10/1/2014 the escalation unfortunately has not yet happened. Escalation was meant to have happened after 1 day in the workflow. Request is still visible in the first approvers' 'Request & Approvals' page. Nothing in the Group Owners' 'Request & Approvals' page.

    And the customer has waited 2 days for this demo result...nothing...kind of disappointing...

    Wednesday, October 1, 2014 10:18 PM