Assignment Roles : Status Pending

[Former Member]

Hi All,

I need your help about my issue.

With the Admin account I've created in Identity Center I add a privilege (ABAP role) to a user.

I don't get any error message, everything works fine but my request is going to Pending ?!

How can I validate this pending task ?

Thx for your help,

Nicolas.

[Murali_Shanmu · Accepted solution]

Hi Nicolas,

Is there a  "Add_validate" or "Add_member" task assigned to either the privilege or Repository ? If so, then it would create a PVO and wait for the assigned task to give an OK.

What are you expecting to happen after the role is assigned ? Should it go for approval or straightaway be provisioned in the ABAP system. Can you put some screenshot of your settings.

Cheers,

Murali

[Former Member · Accepted solution]

Hi Murali,

Do you speak about that ? (it's standard in SAP Provisioning Framework)

If yes, where can I find the validation task ?

I don't see anything in my "To do" or "Approval request".

It can directly go to the ABAP system, I don't need any validation, as only validators will have access to IDM.

Nicolas.

[Murali_Shanmu · Accepted solution]

I understand that you do not want any approvals and want the role to directly assigned to the user in ABAP system.

I wanted to see the screen where the task are assigned to either the role or Repository. If you go to the repository > Event task , you should be able to add the tasks you showed in your screenshot.

You can also do this at role level by selecting the role > Tasks.

Have you maintained anything in the above two places ?

I believe, if you want to straightaway assign the role to user in ABAP without approval, the simplest way is to go to the repository > Event task and under Provision link the task to the "Provisioning" task (which is shown in your screen shot available in SAP Provisioning Framework). Ensure that there is no task assigned for Add Member and Add Validate fields in the Event Task tab.

Cheers,

[Former Member · Accepted solution]

I had earlier this year same kind of issue - where I had two task blocking the task execution and for that reason all privileges were left pending.

I opened SAP customer message and with SAP tachnician we found out the One my customized task contained semicolon (;) in condition query - it didn't report any error it just stop to that task..

That was towarsds ECC

And after we found and fixed that there was one task was someway corrupted and by disabling and enabling it removed the block - and that was toward AD..

Here is SQL queries we used to find blocking tasks ..

Find Provistioning tasks pending

select auditref from mxp_provision where actionid = 601

select count(*) from mxp_provision

Find Audit ref

select * from mxp_provision order by auditref desc

Find Task ID

select * from mxp_audit where auditid = 37284

Find tasks

select t.taskname,a.* from mxp_ext_audit a,mxp_tasks t where a.aud_task = t.taskid and a.aud_ref = 37284 order by aud_datetime

-- I don't remember what this was - I suppose finding if user has Account attribute for repository

select count(mskey) from idmv_value_basic_all  where mskey=143446 and attrname in

(SELECT 'ACCOUNT'||REP_NAME FROM mc_repository where REP_ID=61);

Find Queries with semicolon

select * from mxp_tasks where boolsql like '%;%'

BR

V-M

[Former Member · Accepted solution]

Hi,

In IDM I don’t have any tab with pending request / tasks it’s why I don’t understand where or how to validate.

In my Event Tasks I put the Provisioning task from Provisioning Framework.
I just tried with “Validate add task” but I don’t get any To Do or Approval in my IDM.

At role Level I don’t have Task yet.

Here are some print screens that would help me to find the solution.

Thx.

[Murali_Shanmu · Accepted solution]

Thanks for the screen shot. I can see that your repository is TESTGS5 and you are trying to assign a role which has got privileges belong to this repository.

In the Repository > Event tasks , you have maintained values for below items

(1) Add Task

(2) Remove Task

(3) Provisioning Task

(4) Modify Task

Add Task and Remove Task will create a Pending Value Object. If you need approvals to happen in IdM, you need to create an Approval task and assign it to the "Add Task". Once you do this, you will find an item in the Approval Tab of the Manager.  Checkout the Implementation Guide on Creating role approvals.

Provisioning Task will do the actual provisioning (after the Add Task execution, if it is maintained).

So the sequence will be Add Task and then Provisioning Task.

Now in your case, you do not need approval or validation. Hence, keep below assignments empty.

(1) Add Task

(2) Remove Task

Please remove the assignments for the above two tasks. Keep Provisioning task = 3295/Provisioning and Modify Task - 751/Modify.

Also, when assigning role, the system will ask for "Valid From" date. Please provide today's date.

See how it goes.

Cheers,

Murali.

Message was edited by: Murali Shanmugham

[Former Member · Accepted solution]

I think we are close to the solution but not yet 😞

I did what you wrote : remove the assignement tast "Add Task" & "Remove Task".

But my requests are stil going to Pending.

I'm sure I missed something else, but I don't find what.

Basically, I've haven't modified the SAP Provisioning Framework, maybe I have to change something there ?

Thanks for the document link, I printed it, it could be interresting for later.

Do you have a link to a document concerning SAP Provisioning Framework configuration or setup ?

Thx,

Nicolas.

[Murali_Shanmu · Accepted solution]

Hi,

There is no document on SAP Provisioning Framework Config. You do not need to change anything in the Standard SAP Provisioning Framework unless you have a different requirement. In your case, it is a simple assignment of an existing role to an existing user in ABAP.  Maybe the "Add Tasks" have been maintained in the role/privilege object itself.

Best is to debug. In the above screen, at the top, you will find status. Open it and sort by latest time. This will show you all the tasks which ran due to your role assignments. Select the entry and do a right click and jump to the job. This will take you to the actual job which is being executed and you see the log details.

Sorry, I could not find the exact cause. Shall see if others have a suggestions.

Cheers,

Murali.

[Former Member · Accepted solution]

Hi,

I still don't get how to avoid this Pending Task but thanks anyway.

I hope someone will point out my mistake in the configuration.

Nicolas.

[Former Member · Accepted solution]

Do you have entries in mxp_provision table?

[Former Member · Accepted solution]

I don't have access to the table, but I haven't performed a lot of tasks.

I can process the tasks manually by oing in Connectors - BAP connector -- As abap tasks and do "Test Provisioning Task" and the request is performed correctly, but the status in IDM is still pending.

[Former Member · Accepted solution]

And is the account provisioned to ABAP side and does it have any Roles - which you indended it to have?

V-M

[Former Member · Accepted solution]

Provisioning works perfectly, my problem is more : how to remove the pending / validation process ?

Or what do I have to do to see the pending tasks in the "TO DO" tab.

I must probably add my user as validator somewhere or something like that.

[Former Member · Accepted solution]

Sorry Only answer if could think -  would be that on Provisioning framework some task block completion would be some task which is some way broken and provisioning is stopped in stage it is not yet gone in to end - that's why I asked if there is something on mxp_provistioning table..

it's easier  to look tables than guessing from Job log if every step has been done on provisioning..

You can also post pictures of Job log - if there could be something obvious to look for..

V-M

[Former Member · Accepted solution]

Pending value could mean that something went wrong in ordered task and not specialy that it's waiting for an approval ?

[Former Member · Accepted solution]

Yes..

I experienced such on my project that privileges was left pending because there was two tasks which caused provisioning operation to stop ( leave waiting ) to task which had such error or corruption which didn't cause any error to log - in my case there where two - 1. semicolon on my custom condition task query and 2. corrupted SAP provided task .

Problem was to find where the problem was - so solution was to dug it from Database level with certain queries - Developing SAP IDM is most always matter of knowing also system under the hood. Solution for me was to open SAP Customer message and SAP helped me to find the problem causing tasks.

After fixing those tasks pending operations where applied.

Could be also something else on your case- cannot be sure

BR

Veli-Matti

[Former Member · Accepted solution]

Thanks for your reply Veli-Matti, I try search in that direction !

I think you might have right, I didn't know that error could cause pending, I thought it meant that a validation was needed.

Nicolas.

[Former Member · Accepted solution]

Hi Nicolas,

The assignment is in state pending until both the Validation and Assignment task has finished.

The Provision tasks (which are a legacy thing from 7.0/7.1 versions) are run *after* the privilege has been assigned to the person.

If an assignment is stuck in pending state you can try to look at the extended audit (mxp_ext_audit table, or Admin UI) to see where the process got stuck. A typical query for the ext-audit could be:

select t.taskname, a.* from MXP_Ext_Audit A, MXP_Tasks T where

T.TaskID=A.Aud_Task and A.Aud_ref in (

select mcValidateAddAudit from mxi_link where mcLinkState > 0 and mcThisMSKEY in(

select mcmskey from mxi_entry where mcMSKEYVALUE like 'USER.TEST.PVO%'

) UNION ALL

select mcAddAudit from mxi_link where mcLinkState > 0 and mcThisMSKEY in(

select mcmskey from mxi_entry where mcMSKEYVALUE like 'USER.TEST.PVO%'

) UNION ALL

select mcProvAudit from mxi_link where mcLinkState > 0 and mcThisMSKEY in(

select mcmskey from mxi_entry where mcMSKEYVALUE like 'USER.TEST.PVO%'

)

)

order by A.Aud_ref desc, Aud_datetime desc

which lists the audits for links that are not active (mcLinkState=0) for the user(s) USER.TEST.PVO*. You should be able to see what the last task that executed was, if theres a message returned from it, or if the last task is only partial compared to the workflow in your configuration.

[Former Member · Accepted solution]

Hi Veli-Matti,

You were right, I was looking in the wrong direct, i thought that the role assignement needed to be validated but in fact another task locked the whole assignation !

Nicolas.

[Murali_Shanmu · Accepted solution]

Hi Nicolas,

Can you please let me know if this issue is resolved. If yes, what did you do ?

Also, are you able to provision the role to ABAP system ? Are the requests going to an Approver in "To Do" tab ?

Cheers,

Murali

[Former Member · Accepted solution]

Hello Murali,

Yes it works now.

I thought that "Pending" meant that the request needed to be validated (in To Do) but in my case it meant that it's locked in a previous step of the process.

When you add a privilege, if you go fast and check in IDM the status of the role, you can see pending but it's simply because the process is still busy (sometimes you have 5-7 steps of 2-5 secondes, so you see pending and after 20-30 secondes the privilege is assigned).

Nicolas.

[Murali_Shanmu · Accepted solution]

Ok. That's good to know. It appears to me that you are not having any approvals and require the privilege to be assigned directly. Did you change the setting as I suggested in the above threads ? For repository TEST_GS5, Did you  link the "Add Task" or "Provisioning Task"  to " 3295/Provisioning" ?

[Former Member · Accepted solution]

Hello,

I just did it but I still have this problem when I create a user :

ToIDStore.modEntry failed modifying entry 'TEST_222'. IDStore returned error message: " Referenced value does not exist:Attribute: MXREF_MX_PRIVILEGE" when storing attribute 'MXREF_MX_PRIVILEGE={A}<PRIV:SYSTEM:Enterprise People>'ToIDStore.modEntry failed modifying entry 'TEST_222'. IDStore returned error message: " Referenced value does not exist:Attribute: MXREF_MX_PRIVILEGE" when storing attribute 'MXREF_MX_PRIVILEGE={A}<PRIV:SYSTEM:Enterprise People>'

I still have to figure out what is wrong with this.

Nicolas.