{ "id": "wfAppExampleLob", "name": "WFAppExampleLOB", "displayName": "WFAppExampleLOB", "description": "WFAppExampleLOB", "type": "provisioning", "_rev": 4, "steps": [ { "name": "approvalTask-74cf85c35437", "displayName": "Approval Manager", "type": "approvalTask", "approvalTask": { "nextStep": [ { "condition": null, "outcome": "APPROVE", "step": "scriptTask-c0fe045e6750" }, { "condition": null, "outcome": "REJECT", "step": "scriptTask-c58309b8c470" }, { "condition": null, "outcome": "EXPIRATION", "step": null } ], "approvalMode": "any", "actors": [ { "id": { "isExpression": true, "value": "\"managed/user/\" + requestIndex.user.manager._refResourceId" }, "permissions": { "approve": true, "reject": true, "reassign": true, "modify": true, "comment": true } } ], "events": { "assignment": { "notification": "requestAssigned" }, "reassign": { "notification": "requestReassigned" }, "reminder": { "notification": "requestReminder", "frequency": 3, "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(3*1*24*60*60*1000))).toISOString()" } }, "escalation": { "notification": "requestEscalated", "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(5*1*24*60*60*1000))).toISOString()" }, "actors": [ { "id": "managed/user/b42b7c74-c559-45fd-a5ba-2e6da27a2612" } ] }, "expiration": { "action": "reassign", "notification": "requestExpired", "actors": [ { "id": "managed/user/b42b7c74-c559-45fd-a5ba-2e6da27a2612" } ], "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(1*24*60*60*1000))).toISOString()" }, "frequency": 1 } } }, "approvalMode": "any" }, { "name": "scriptTask-626899b6e99a", "displayName": "Application Grant Validation", "type": "scriptTask", "scriptTask": { "nextStep": [ { "condition": "true", "outcome": "done", "step": "exclusiveGateway-5167870154a9" } ], "language": "javascript", "script": "logger.info(\"Running application grant request validation\");\n\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar failureReason = null;\nvar applicationId = null;\nvar app = null;\n\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n applicationId = requestObj.application.id;\n}\ncatch (e) {\n failureReason = \"Validation failed: Error reading request with id \" + requestId;\n}\n\n// Validation 1 - Check application exists\nif (!failureReason) {\n try {\n app = openidm.read('managed/alpha_application/' + applicationId);\n if (!app) {\n failureReason = \"Validation failed: Cannot find application with id \" + applicationId;\n }\n }\n catch (e) {\n failureReason = \"Validation failed: Error reading application with id \" + applicationId + \". Error message: \" + e.message;\n }\n}\n\n// Validation 2 - Check the user does not already have application granted\n// Note: this is done at request submission time as well, the following is an example of how to check user's accounts\nif (!failureReason) {\n try {\n var user = openidm.read('managed/alpha_user/' + requestObj.user.id, null, [ 'effectiveApplications' ]);\n user.effectiveApplications.forEach(effectiveApp => {\n if (effectiveApp._id === applicationId) {\n failureReason = \"Validation failed: User with id \" + requestObj.user.id + \" already has effective application \" + applicationId;\n }\n })\n }\n catch (e) {\n failureReason = \"Validation failed: Unable to check effective applications of user with id \" + requestObj.user.id + \". Error message: \" + e.message;\n }\n}\n\nif (failureReason) {\n logger.info(\"Validation failed: \" + failureReason);\n}\nexecution.setVariable(\"failureReason\", failureReason); " } }, { "name": "scriptTask-c58309b8c470", "displayName": "Reject Request", "type": "scriptTask", "scriptTask": { "nextStep": [ { "condition": "true", "outcome": "done", "step": null } ], "language": "javascript", "script": "logger.info(\"Rejecting request\");\n\nvar content = execution.getVariables();\nvar requestId = content.get('id');\n\nlogger.info(\"Execution Content: \" + content);\nvar requestIndex = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\nvar decision = {'outcome': 'denied', 'status': 'complete', 'decision': 'rejected'};\nvar queryParams = { '_action': 'update'};\nopenidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);" } }, { "name": "exclusiveGateway-5167870154a9", "displayName": "Validation Gateway", "type": "scriptTask", "scriptTask": { "nextStep": [ { "condition": "failureReason == null", "outcome": "validationSuccess", "step": "scriptTask-3a74557440fb" }, { "condition": "failureReason != null", "outcome": "validationFailure", "step": "scriptTask-744ef6a8b9a2" } ], "language": "javascript", "script": "logger.info(\"This is exclusive gateway\");" } }, { "name": "scriptTask-3a74557440fb", "displayName": "Auto Provisioning", "type": "scriptTask", "scriptTask": { "nextStep": [ { "condition": "true", "outcome": "done", "step": null } ], "language": "javascript", "script": "logger.info(\"Auto-Provisioning\");\n\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar failureReason = null;\n\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n logger.info(\"requestObj: \" + requestObj);\n}\ncatch (e) {\n failureReason = \"Provisioning failed: Error reading request with id \" + requestId;\n}\n\nif(!failureReason) {\n try {\n var request = requestObj.request;\n var payload = {\n \"applicationId\": request.common.applicationId,\n \"startDate\": request.common.startDate,\n \"endDate\": request.common.endDate,\n \"auditContext\": {},\n \"grantType\": \"request\"\n };\n var queryParams = {\n \"_action\": \"add\"\n }\n\n logger.info(\"Creating account: \" + payload);\n var result = openidm.action('iga/governance/user/' + request.common.userId + '/applications' , 'POST', payload,queryParams);\n }\n catch (e) {\n failureReason = \"Provisioning failed: Error provisioning account to user \" + request.common.userId + \" for application \" + request.common.applicationId + \". Error message: \" + e.message;\n }\n \n var decision = {'status': 'complete', 'decision': 'approved'};\n if (failureReason) {\n decision.outcome = 'not provisioned';\n decision.comment = failureReason;\n decision.failure = true;\n }\n else {\n decision.outcome = 'provisioned';\n }\n\n var queryParams = { '_action': 'update'};\n openidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);\n logger.info(\"Request \" + requestId + \" completed.\");\n}" } }, { "name": "scriptTask-744ef6a8b9a2", "displayName": "Application Grant Validation Failure", "type": "scriptTask", "scriptTask": { "nextStep": [ { "condition": "true", "outcome": "done", "step": null } ], "language": "javascript", "script": "var content = execution.getVariables();\nvar requestId = content.get('id');\nvar failureReason = content.get('failureReason');\n\nvar decision = {'outcome': 'not provisioned', 'status': 'complete', 'comment': failureReason, 'failure': true, 'decision': 'approved'};\nvar queryParams = { '_action': 'update'};\nopenidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);" } }, { "name": "scriptTask-4e9121fe850a", "displayName": "Request Context Check", "type": "scriptTask", "scriptTask": { "nextStep": [ { "condition": "true", "outcome": "done", "step": "exclusiveGateway-621c9996676a" } ], "language": "javascript", "script": "/*\nScript nodes are used to invoke APIs or execute business logic.\nYou can invoke governance APIs or IDM APIs.\nSee https://docs.pingidentity.com/pingoneaic/identity-governance/administration/workflow-configure.html for more details.\n\nScript nodes should return a single value and should have the\nlogic enclosed in a try-catch block.\n\nExample:\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n applicationId = requestObj.application.id;\n}\ncatch (e) {\n failureReason = 'Validation failed: Error reading request with id ' + requestId;\n}\n*/\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar context = null;\nvar skipApproval = false;\nvar lineItemId = false;\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n if (requestObj.request.common.context) {\n context = requestObj.request.common.context.type;\n lineItemId = requestObj.request.common.context.lineItemId;\n if (context == 'admin') {\n skipApproval = true;\n }\n }\n}\ncatch (e) {\n logger.info(\"Request Context Check failed \"+e.message);\n}\n\nlogger.info(\"Context: \" + context);\nexecution.setVariable(\"context\", context);\nexecution.setVariable(\"lineItemId\", lineItemId);\nexecution.setVariable(\"skipApproval\", skipApproval);" } }, { "name": "exclusiveGateway-621c9996676a", "displayName": "Context Gateway", "type": "scriptTask", "scriptTask": { "nextStep": [ { "condition": "skipApproval == true", "outcome": "AutoApproval", "step": "scriptTask-0e5b6187ea62" }, { "condition": "skipApproval == false", "outcome": "Approval", "step": "approvalTask-74cf85c35437" } ], "language": "javascript", "script": "logger.info(\"This is exclusive gateway\");" } }, { "name": "scriptTask-0e5b6187ea62", "displayName": "Auto Approval", "type": "scriptTask", "scriptTask": { "nextStep": [ { "condition": "true", "outcome": "done", "step": "scriptTask-626899b6e99a" } ], "language": "javascript", "script": "/*\nScript nodes are used to invoke APIs or execute business logic.\nYou can invoke governance APIs or IDM APIs.\nSee https://docs.pingidentity.com/pingoneaic/identity-governance/administration/workflow-configure.html for more details.\n\nScript nodes should return a single value and should have the\nlogic enclosed in a try-catch block.\n\nExample:\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n applicationId = requestObj.application.id;\n}\ncatch (e) {\n failureReason = 'Validation failed: Error reading request with id ' + requestId;\n}\n*/\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar context = content.get('context');\nvar lineItemId = content.get('lineItemId');\nvar queryParams = {\n \"_action\": \"update\"\n}\ntry {\n var decision = {\n \"decision\": \"approved\",\n \"comment\": \"Request auto-approved due to request context: \" + context\n }\n openidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);\n}\ncatch (e) {\n var failureReason = \"Failure updating decision on request. Error message: \" + e.message;\n var update = {'comment': failureReason, 'failure': true};\n openidm.action('iga/governance/requests/' + requestId, 'POST', update, queryParams);\n\n}" } }, { "name": "scriptTask-c0fe045e6750", "displayName": "Check LOB", "type": "scriptTask", "scriptTask": { "nextStep": [ { "condition": "true", "outcome": "done", "step": "inclusiveGateway-b100a635dbdb" } ], "language": "javascript", "script": "var content = execution.getVariables();\nvar requestId = content.get('id');\nvar requestObj = null;\nvar appId = null;\nvar appGlossary = null;\nvar lob = null;\n\ntry {\n requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n appId = requestObj.application.id;\n }\n catch (e) {\n\tlogger.info(\"Validation failed: Error reading application grant request with id \" + requestId);\n }\n\ntry {\n appGlossary = openidm.action('iga/governance/application/' + appId + '/glossary', 'GET', {}, {});\n lob = appGlossary.lineOfBusiness || \"default\";\n //lob = (appGlossary.hasOwnProperty(\"lineOfBusiness\")) ? appGlossary.lineOfBusiness : null\n execution.setVariable(\"lob\", lob);\n}\ncatch (e) {\n logger.info(\"Could not retrieve glossary with appId \" + appId + \" from application grant request ID \" + requestId);\n}" } }, { "name": "inclusiveGateway-b100a635dbdb", "displayName": "LOB", "type": "scriptTask", "scriptTask": { "nextStep": [ { "condition": "lob == \"sales\"", "outcome": "sales", "step": "approvalTask-4798fabdde67" }, { "condition": "lob == \"finance\"", "outcome": "finance", "step": "approvalTask-67b95b1cd6f5" }, { "condition": "lob == \"humanResources\"", "outcome": "humanResources", "step": "approvalTask-3acabb78eec4" }, { "condition": "lob == \"default\"", "outcome": "null", "step": "approvalTask-2c95b33799e8" } ], "language": "javascript", "script": "logger.info(\"This is inclusive gateway\");", "gatewayType": "inclusive" } }, { "name": "approvalTask-4798fabdde67", "displayName": "Sales Approver Role", "type": "approvalTask", "approvalTask": { "nextStep": [ { "condition": null, "outcome": "APPROVE", "step": "scriptTask-626899b6e99a" }, { "condition": null, "outcome": "REJECT", "step": "scriptTask-c58309b8c470" } ], "approvalMode": "any", "actors": [ { "id": "managed/role/31d9c863-be0a-44d0-bd26-15e724d57488", "permissions": { "approve": true, "reject": true, "reassign": true, "modify": true, "comment": true } } ], "events": { "assignment": { "notification": "requestAssigned" }, "reassign": { "notification": "requestReassigned" }, "reminder": { "notification": "requestReminder", "frequency": 3, "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(3*24*60*60*1000))).toISOString()" } }, "escalation": { "notification": "requestEscalated", "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(5*24*60*60*1000))).toISOString()" }, "actors": [ { "id": "managed/user/b42b7c74-c559-45fd-a5ba-2e6da27a2612" } ] }, "expiration": { "action": "reject", "notification": "requestExpired", "actors": [ { "id": "managed/user/b42b7c74-c559-45fd-a5ba-2e6da27a2612" } ], "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(7*24*60*60*1000))).toISOString()" }, "frequency": 7 } } }, "approvalMode": "any" }, { "name": "approvalTask-67b95b1cd6f5", "displayName": "Finance Approver Role", "type": "approvalTask", "approvalTask": { "nextStep": [ { "condition": null, "outcome": "APPROVE", "step": "scriptTask-626899b6e99a" }, { "condition": null, "outcome": "REJECT", "step": "scriptTask-c58309b8c470" } ], "approvalMode": "any", "actors": [ { "id": "managed/role/df1e6ad8-db32-41a5-8368-3d989c71b9f7", "permissions": { "approve": true, "reject": true, "reassign": true, "modify": true, "comment": true } } ], "events": { "assignment": { "notification": "requestAssigned" }, "reassign": { "notification": "requestReassigned" }, "reminder": { "notification": "requestReminder", "frequency": 3, "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(3*24*60*60*1000))).toISOString()" } }, "escalation": { "notification": "requestEscalated", "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(5*24*60*60*1000))).toISOString()" }, "actors": [ { "id": "managed/user/b42b7c74-c559-45fd-a5ba-2e6da27a2612" } ] }, "expiration": { "action": "reject", "notification": "requestExpired", "actors": [ { "id": "managed/user/b42b7c74-c559-45fd-a5ba-2e6da27a2612" } ], "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(7*24*60*60*1000))).toISOString()" }, "frequency": 7 } } }, "approvalMode": "any" }, { "name": "approvalTask-3acabb78eec4", "displayName": "HR Approver Role", "type": "approvalTask", "approvalTask": { "nextStep": [ { "condition": null, "outcome": "APPROVE", "step": "scriptTask-626899b6e99a" }, { "condition": null, "outcome": "REJECT", "step": "scriptTask-c58309b8c470" } ], "approvalMode": "any", "actors": [ { "id": "managed/role/b46856f0-6533-4359-9383-9ca8c146f005", "permissions": { "approve": true, "reject": true, "reassign": true, "modify": true, "comment": true } } ], "events": { "assignment": { "notification": "requestAssigned" }, "reassign": { "notification": "requestReassigned" }, "reminder": { "notification": "requestReminder", "frequency": 3, "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(3*24*60*60*1000))).toISOString()" } }, "escalation": { "notification": "requestEscalated", "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(5*24*60*60*1000))).toISOString()" }, "actors": [ { "id": "managed/user/b42b7c74-c559-45fd-a5ba-2e6da27a2612" } ] }, "expiration": { "action": "reject", "notification": "requestExpired", "actors": [ { "id": "managed/user/b42b7c74-c559-45fd-a5ba-2e6da27a2612" } ], "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(7*24*60*60*1000))).toISOString()" }, "frequency": 7 } } }, "approvalMode": "any" }, { "name": "approvalTask-2c95b33799e8", "displayName": "App Owner Approver", "type": "approvalTask", "approvalTask": { "nextStep": [ { "condition": null, "outcome": "APPROVE", "step": "scriptTask-626899b6e99a" }, { "condition": null, "outcome": "REJECT", "step": "scriptTask-c58309b8c470" } ], "approvalMode": "any", "actors": [ { "id": { "isExpression": true, "value": "\"managed/user/\" + requestIndex.applicationOwner[0].id" }, "permissions": { "approve": true, "reject": true, "reassign": true, "modify": true, "comment": true } } ], "events": { "assignment": { "notification": "requestAssigned" }, "reassign": { "notification": "requestReassigned" }, "reminder": { "notification": "requestReminder", "frequency": 3, "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(3*24*60*60*1000))).toISOString()" } }, "escalation": { "notification": "requestEscalated", "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(5*24*60*60*1000))).toISOString()" }, "actors": [ { "id": "managed/user/b42b7c74-c559-45fd-a5ba-2e6da27a2612" } ] }, "expiration": { "action": "reject", "notification": "requestExpired", "actors": [ { "id": "managed/user/b42b7c74-c559-45fd-a5ba-2e6da27a2612" } ], "date": { "isExpression": true, "value": "(new Date(new Date().getTime()+(7*24*60*60*1000))).toISOString()" }, "frequency": 7 } } }, "approvalMode": "any" } ], "staticNodes": { "startNode": { "id": "startNode", "x": 70, "y": 140, "connections": { "start": "scriptTask-4e9121fe850a" } }, "endNode": { "id": "endNode", "x": 2349, "y": 254, "connections": null }, "uiConfig": { "approvalTask-74cf85c35437": { "actors": [ { "id": { "isExpression": true, "value": "\"managed/user/\" + requestIndex.user.manager._refResourceId" }, "type": "manager" } ], "events": { "escalationType": "applicationOwner", "escalationDate": 5, "escalationTimeSpan": "day(s)", "reminderDate": 3, "reminderTimeSpan": "day(s)", "expirationDate": 1 }, "x": 717, "y": 190 }, "scriptTask-626899b6e99a": { "x": 1683, "y": 25 }, "scriptTask-c58309b8c470": { "x": 1715, "y": 350 }, "exclusiveGateway-5167870154a9": { "x": 1781, "y": 115 }, "scriptTask-3a74557440fb": { "x": 2002, "y": 253.5 }, "scriptTask-744ef6a8b9a2": { "x": 2061, "y": 350.015625 }, "scriptTask-4e9121fe850a": { "x": 167, "y": 140.015625 }, "exclusiveGateway-621c9996676a": { "x": 433, "y": 118.015625 }, "scriptTask-0e5b6187ea62": { "x": 726, "y": 12.015625 }, "scriptTask-c0fe045e6750": { "x": 968.75, "y": 151.91796875 }, "inclusiveGateway-b100a635dbdb": { "x": 1150.75, "y": 104.91796875 }, "approvalTask-4798fabdde67": { "x": 1362, "y": 21.91796875, "actors": [ { "id": { "isExpression": false, "value": "managed/role/31d9c863-be0a-44d0-bd26-15e724d57488" }, "type": "role" } ], "events": { "escalationDate": 5, "escalationTimeSpan": "day(s)", "escalationType": "applicationOwner", "expirationDate": 7, "expirationTimeSpan": "day(s)", "reminderDate": 3, "reminderTimeSpan": "day(s)" } }, "approvalTask-67b95b1cd6f5": { "x": 1363, "y": 158.91796875, "actors": [ { "id": { "isExpression": false, "value": "managed/role/df1e6ad8-db32-41a5-8368-3d989c71b9f7" }, "type": "role" } ], "events": { "escalationDate": 5, "escalationTimeSpan": "day(s)", "escalationType": "applicationOwner", "expirationDate": 7, "expirationTimeSpan": "day(s)", "reminderDate": 3, "reminderTimeSpan": "day(s)" } }, "approvalTask-3acabb78eec4": { "x": 1366, "y": 292.91796875, "actors": [ { "id": { "isExpression": false, "value": "managed/role/b46856f0-6533-4359-9383-9ca8c146f005" }, "type": "role" } ], "events": { "escalationDate": 5, "escalationTimeSpan": "day(s)", "escalationType": "applicationOwner", "expirationDate": 7, "expirationTimeSpan": "day(s)", "reminderDate": 3, "reminderTimeSpan": "day(s)" } }, "approvalTask-2c95b33799e8": { "x": 1369, "y": 428.91796875, "actors": [ { "id": { "isExpression": true, "value": "\"managed/user/\" + requestIndex.applicationOwner[0].id" }, "type": "applicationOwner" } ], "events": { "escalationDate": 5, "escalationTimeSpan": "day(s)", "escalationType": "applicationOwner", "expirationDate": 7, "expirationTimeSpan": "day(s)", "reminderDate": 3, "reminderTimeSpan": "day(s)" } } } }, "status": "published", "mutable": true }