10.2 Workflow Steps That Generate Work Items

Workflow Steps That Generate Work Items

Objective 4.4 asks you to understand workflow steps that generate work items. A work item is a task in someone's IdentityIQ inbox (the bell icon). When a workflow needs a human decision or data, it creates a work item and waits. The WorkflowCase is saved so it can resume when the item is completed.

Which Workflow Constructs Create Work Items?

Other work item types exist outside workflows: Access Review, Challenge, Delegation, Remediation, Request Violation, Impact Analysis, and Signoff.

Approval Steps

A step holds either an action or an approval, never both. Add one in the Process Designer with right-click > Add Approval:

<Step icon="Approval" name="Manager Approval">
  <Approval mode="serial" owner="script:getManagerName(identityName, launcher, fallbackApprover);"
            send="approvalSet,identityDisplayName,identityName,policyViolations"
            renderer="lcmWorkItemRenderer.xhtml">
    <Arg name="workItemDescription" value="Manager Approval - Account Changes for User: $(identityDisplayName)"/>
    <Arg name="workItemNotificationTemplate" value="ref:managerEmailTemplate"/>
    <AfterScript>
      <Source>
        assimilateWorkItemApprovalSet(wfcontext, item, approvalSet);
        auditDecisions(item);
      </Source>
    </AfterScript>
  </Approval>
  <Transition to="Build Owner ApprovalSet"
      when="script:isApprovalEnabled(approvalScheme, &quot;owner&quot;)"/>
  <Transition to="end"/>
</Step>

This excerpt is from the documentation's LCM example, lightly trimmed. Its RuleLibraries declares Approval Library and LCM Workflow Library so that the AfterScript can call those methods.

Approval Modes

• serial: one owner at a time, in order. Any rejection rejects.
• serialPoll: one at a time. All responses are collected, and the AfterScript decides.
• parallel: all owners at once. Any rejection rejects.
• parallelPoll: all at once. Responses are collected, and the AfterScript decides.
• any: all at once. The first response decides for the group.

Child Approvals

Add Child Approval builds structured approvals. For example, one child approval could go to "any HR approver" (mode any) and another to the identity's manager. The parent then only organizes its children and is no longer an approval itself. Children inherit the parent's work item configuration unless they override it.

Work Item Configuration

On the approval's Work Item Configuration tab, choose Override Work Item Configuration to set the Initial Notification Email and an escalation style: None, Send Reminders, Reminders then Escalation (using an escalation owner rule), or Escalation Only. Override Electronic Signature Configuration requires an electronic signature on the decision.

Designing an Approval: A Checklist

1. Who approves? Resolve the owner with a script or call (for example, the manager, with a fallback approver) so a missing manager does not leave the item without an owner.
2. How do several approvers interact? Pick the mode. Use any for a pool such as "any HR partner," serial for a strict chain, and a poll mode only if you will write AfterScript logic.
3. What does the approver need to see? Put those variables in Send, and add a clear workItemDescription using $() references.
4. What must come back? List the decisions or comments in Return, or assimilate them in the AfterScript as LCM does with its approval set.
5. What if nobody acts? Configure reminders and escalation on the Work Item Configuration tab.

Form Steps

Choose Add Form on a step to reference a shared Form object or create one inline. You set a Description, Send (variables used as initial field values), Return (fields copied back into variables), and an Owner. Fields use the same editor as provisioning policies, although Owner, Display Only, and Authoritative do not apply to workflow forms. Buttons define what happens on submit:

Work Item Settings Outside the Workflow

Global Settings > IdentityIQ Configuration > Work Items sets defaults: days before expiration, reminder timing and frequency, notices before escalation, assignment emails, priority editing, which work item types are archived, and rules such as the inactive user work item escalation rule, the global forwarding rule, and the self-certification forwarding rule. The Perform Maintenance task's Forward inactive user work items option forwards items owned by inactive users: by rule, otherwise to their manager, otherwise to the Administrator. Work item actions can be audited (section 8.3).