Approval of role creation

[Former Member]

Hi All

I need to create a WET for role creation, this is simple But I need to incorporate approval of the creation of the new MX_ROLE entry. I can only find documentation/guides on how to implement approval of role and privilege assignment. Does anyone know if it is possible to setup approval on creation on a new entry?

Kind regards,

Heidi

[Former Member]

Solution found I added the NoCache option and now it works.

[Former Member]

I have tried to implement the MX_INACTIVE solution. Now it is not possible to see the role on the "Adminstrate"-tab, and there is an approval task on the "To do"-tab. When I click this task, details on the role are displayed properly, but when I try to process the request by clicking the "Show request"-button (button name translated from Danish, it might be translated differently...) I get an error: "Access denied".

I have set correct approver on the approval task, and I was able to process approval requests, before I set the role to inactive.

On the approval task, I have checked the "Use inactive entries" checkbox.

Does anyone have an idea what could be wrong?

Kind regards,

Heidi Kronvold

[Former Member]

I have created a new WET that creates a new MX_ROLE entry (checked the box "This task cerates a new entry") and then under this ordered task, I have created an approval task. My problem is now, that the role seems to be created even before the approval has been taken care of in the "To do"-tab on the user interface.

Has anyone found a way to deal with this?

I had hoped, that the role would only be created, if the corresponding task was approved. If it was declined, the role would not be created.

Kind regards

Heidi Kronvold

[Former Member]

Hi

My theoretical thougths:

In the WET you create a PVO. If approved, copy the attribute-values from the PVO to the MX_ROLE, if declined delete the PVO.

I think I read this procedure once here on SDN where the idea was to create an MX_PERSON with approval.

Hope this helps.

BR

Michael

[thomas_groth2]

Hello,

you could also use the attribute MX_INACTIVE. With that you would create a new mx_role too, but it would be hidden in UI until you approve it and you can delete it if it gets declined.

Best regards,

Thomas

[Former Member]

PVO = ???

Pending value object? I am guessing here

[Former Member]

The suggestion with MX_INACTIVE might be usefull - I will try it out.

Thank you so much for helping

[Former Member]

I think someone made a blog about this

/people/domink.trui/blog/2010/06/18/custom-approval-objects-with-sap-identity-management

Maybe this helps

[Former Member]

Have found the solution