Access Request is provisioned but WF status is updated with "ERROR"

[former_member184114]

Hi All,

I noticed that one of the Access Requests was processed by all the approvers and was provisioned successfully in the target system. However, the "Stage Status" is updated with "ERROR"!

I tried to get some useful information from the audit log of the request and could find:

"Error in End of Path, Escape for 'Auto Provisioning Failure' not Enabled

I am unable to determine the cause of this error yet. And wondering how the provisioning is done if there was some error.

I also checked in SLG1 and GRFNMW_DBGMONITOR_WD MSMP tcodes. But was unable to get some clue out of them.

Can anybody please advise me on this?

Regards,

Faisal

[Former Member]

Going back to something asked earlier, have you got an "Escape Path/Route" established in your workflow?

The remaining line item causing the issue will be awaiting additional check/approval within the request in the escape path.

Having said that, by any chance is the issue being caused by any custom fields you may have created/utilised recently?

[former_member184114]

Harinam,

Thanks for your reply.

No, escape route is not yet configured. It will be configured shortly.

Secondly, no custom fields are used yet.

Regards,

Faisal

[Former Member]

Hi Faisal,

It's quite strange.

Usually we see the issues with access request not getting provisioned due to some error. But in your case it gets provisoned but status is with error.

Does it happen to all of your access requests or this is the only request with this strange behaviour.?

Ideally this shouldn't happen.

Have you recently changed any of the provisioning work flow?

Regards,

Ameet

[Colleen]

oops.. I missed provisioning was successful - good pick up Ameet

Faisal - did the access really provision or was it there already? Are you able to replicate it and run a trace to see what's happening?

Regards

Colleen

[former_member184114]

Ameet,

Thanks for your reply.

Yes, even I am amuzed with this. I thought that I would be getting some useful information in Audit Log. However, I could not get any.

I noticed this with 2 requests and those 2 requests are belonging to the same user! I suspect something with this specific user id. But not sure how to determine this.

Regards,

Faisal

[former_member184114]

Colleen,

As far as I remember, User was already available but some of the roles are newly assigned.

I could not replicate this in our test system, but thinking to replicate the same soon.

Regards,

Faisal

[Former Member]

Hi Faisal,

Okay, one more check.

could you please confirm if these requests have been provisioned with the lately created access requests. I suspect that the provisioning might have been done with some other requests in past.

But again in that case you shouldn't have been aable to raise the request for the account which has already been provisioned.

There can't be any issue with the user ids as per my understanding. Issue is with the provisioning.

Not sure if timezones have any role to play to cause this error.

As Colleen suggested, replicating the same issue should be your next move. Let usknow how does it go.

Regards,

Ameet

[Colleen]

Hi Faisal

In your MSMP do you have configuration for Step 1 for Escape conditions (one for when approver not found and the other for when access could not be provisioned)? I assume you do not have the second escape condition configured.

As to why it could not be provisioned you will need to have a look at what sort of access was being requested for that step. Possibly the object was locked or role didn't exist, etc.

Regards

Colleen

[former_member184114]

Colleen,

Thanks for your reply.

The Escape route is not yet configured for some reason and this will be shortly configured.

As far the problem, I mentioned that the request is provisioned but status is updated as "ERROR".

Regards,

Faisal

[Colleen]

Hi Faisal

As I alluded to, there could be a few possibilities as to why it couldn't be provisioned and troubleshooting that will come down to what was the attempt to assign.

Regards

Colleen