GRC-AC 5.3 Firefight Alternative Approver

[Former Member]

Hi, Experts.

We are running GRC-AC 5.3 SP18 and we have a CUP workflow to SPM (Firefighter) access requests.

The workflow was set as follow:

INITIATOR   >>   STAGE 1 (approver = Super Access Owner)   >>   FINISH

As designed by our enterprise, the Firefighter Owner is the same person that Firefighter Controller, what means that the same person who approve the firefighter access receive the access logs.

So far, so good.

But now, we want to set the superuser requests to send to alternative approver after 1 hour, ie, if the owner does not approve the request within 1 hour, the request will send to a substitute approver.

On Workflow > Stage Configuration screen, I had set the waiting time and level change to "1 hour" and "send to alternate approver". But I am not able to find out where can I set the alternative owner once the Super Access Owner was importing from VIRSA Configurations at Backend System.

I had tried to configure Superuser access as roles but it did not work, because I was not able to import the FF_ID and, after importing, set the alternative approver once the CUP ask me to set the role type (single or composite) before save the changes and, if I set the role type, the SU definition desapear.

Any idea of where can I put the Anternative Owner definitions OR some other workflow design to attend our needs?

Thanks in advance.

Welton.

[Former Member · Accepted solution]

Hi, you all.

I've finally find the answer by myself.

It was easier than I thougth.

Steps following:

1. Create a CAD (Configuration

tab > Workflow > Custom Approver Determinators) and set:

          a) CAD Type: "Attribuite",

          b) Workflow Type: "Compliant User Provisioning",

          c) Select Attribute: mark "Business Process" AND "Request Type"

          Obs.: as our Firefighter users was designed by Business Process, I'd mak that options, but if your Firefighter strategy are based on other parameter (Functional Area, for example), you can mark any options you need.

          d) Save and the "Approver" button will be enable;

          e) Click on Approver button and note that the previous selected attribute will be on the table. Click on "Add" button and select the Business Process you want to attribute the Approver and Alternative Approver. Select the Request Type (Superuser access) and set the approvers clicking on yellow arrow.

2. Change or create the Stage you want to set to your SPM workflow.

          a) (Configuration tab > Workflow > Stage) to create or select the stage you want to change.

          b) On Approver Determinator, set the CAD created on previous step.

          c) Set the time you want (days or hours),

          d) On Level change configurations set "Send to Alternative Approver"

          e) Do the additional settings and save.

Now, just put the stage create on your SPM workflow and test.

I hope that help somebody.

I've spent two days trying to find this solutions.

Best regards,

Welton.