IDM 7.2 Validation Tasks - How to Stop provisioning

[Former Member]

Hello,

I want to implement an Add Validation Task. This task is fired before the provisioning is started. Thats exactly what I need. But I found no documentation about it. What I have done until now:

1) Added the validation Task to the repository

2) created the Task which at the moment just logs the entrytype and I tried to set the approval on "dicline"

What is happening until now:

1) A pending value is generated, which has the action ADD-Validation, which is fine.

2) nothing the function uIS_SetApproval only works in Approval tasks.

The only think I found in the documentation about the validation tasks is that nothing has to be returned. Just true or false should be delivered. But how? Do I have to set it at a context variable? If so, which one? Do I have to call a function? Which one?

Anyone who can help me here?

BR,

Christoph

[Former Member · Accepted solution]

Hi Christoph,

To automatically decline a validate-add task from a job, set the attribute MX_ATTR_STATE to the value 3.

This will then behave the same as if you had an approval task, and the user pressed decline.

Best regards

John Erik Setsaas

Development Architect IdM

PS. We are working on documentation for this now.

[Former Member · Accepted solution]

Hi John,

thanks for your Reply. I tried it. You are right, the Priv is not assigned. But as I can see there is the following message in the log:

!ERROR: Referenced value does not exist - Operation code not allowed. Use 0=WAIT,1=APPROVED,2=DECLINED

So, the Pending Value is still in the DB.

BR,

Christoph

[Former Member · Accepted solution]

!ERROR: Referenced value does not exist - Operation code not allowed. Use 0=WAIT,1=APPROVED,2=DECLINED

So, the Pending Value is still in the DB.

quote}

Can you see the PVO in database? Which version of 7.2 you have? SP2 deletes the PVO in the end of the processing.

[Former Member · Accepted solution]

Hi,

We are doing exactly this in IdM 7.1 and it works great! The only problem I have now is that the role shows status "Partially OK" which is not what I would want.

In our case, we are provisioning to one of 2 AD's depending on the location of the user. We have put both privileges in the role, which creates 2 pending values when the role is assigned via an add member task on both repositories. We check the user location, then apply one and clear the other using MX_ATTR_STATE. As effectively this is an approval and a rejection, the role shows as "Partially OK" and this is confusing - though I understand this is correct as per standard.

Any ideas on how to get the role status to show "OK" in this scenario?

Cheers,

Ian