Skip to Content

Web Enabled Task - work with UserMsKey/AdminMsKey

Jun 26, 2017 at 01:46 PM


avatar image


we want to create a userfriendly UI task for some of our users, which can be used to change privilege assignments. The task has some checkboxes and depending of the choice, privileges will be assigned through a "to identity store" pass. That is working fine.

The "problem" is that you can not see in the UI who made the assignment. The value of the assigner seems to be empty because the assignment is done by another pass from the system. The assigner information is also important for our approval process.

Is there any possibility to add the assigner information in that kind of assignment?

If I use a UI task to change MX_ASSIGNMENT the necessary information is visible.

I have tried it also via internal function uIS_SetValue. But it was not possible for me to add the assigner information.

Thanks and best regards


BTW: Our version is: IdM 7.2 SP9


If I modify the assignment directly, the pending value object has two attributes MX_MODIFY_BY and MX_PRIV_USERID which have my MSKEY as value.

If I modify the assignment across the checkbox and the related job, the pending value object has only the atrribute MX_MODIFY_BY which has the JobId as value.

How can I put my MSKEY as value into this?


10 |10000 characters needed characters left characters exceeded
* Please Login or Register to Answer, Follow or Comment.

1 Answer

Best Answer
Steffi Warnecke
Jun 27, 2017 at 08:55 AM

Hello Micheal,

I use the internal function "uGetAuditID()" to work my way up via a small script "refaudit from Mxp_Audit" by "refaudit from Mxp_Audit" to get the userid of the person who started the whole process.

Is the assignent still part of the workflow? Or is the job standalone and runs later on?


We also use an attribute on several UI masks that is filled by default with "%ADMINMSKEY%" to save the mskey of the person who used it and then use this attribute later on in emails and as information for our requests. So that's another way to go depending on how your workflow is designed.

The good thing is, this attribute has not even be visible on the mask. It's enough to have it filled with a default value to get it saved. At least that's the case on SP10.




Show 2 Share
10 |10000 characters needed characters left characters exceeded

Hello Steffi,

thanks for your answer!!! The assignment is part of the workflow.

When the assignment will be done in the UI (direct via MX_ASSIGNMENT or via checkbox and "to identity store" pass), the approval step will be started by validate add task on repository.

The attribute MX_ASSIGNER is important for our approval process. But when we add the privilege with the checkbox and "to identity store" pass, this attribute is not filled for the pending value object which will be created. Therefore we want to use your way to get the MSKEY of the assigner and add this one to the pending value object via "to identity store" pass before the first approval must be done.

Do you know if it is a problem when we add MX_ASSIGNER to a pending value object?

We tried it in our test system and it seems to be OK...

Thanks a lot for your support!



Hello Michael,

we don't use "MX_ASSIGNER". I guess it's part of the enhanced approval workflow?

We only use the simple one, having it tailored (and therefor made it not so simple ^^) to our needs. The first part of the workflow is normally the saving of all important information from the mask and finding more information, mostly via scripts and after that sending it of to the wanted approvers. So pretty much what you have in mind.

Why not create a custom attribute special for this case? That way you have more control over the content and can use it separatly from "MX_ASSIGNER"?