Emails sent to all Admin Role members during Identity Manager workflow approval

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

During Identity Manager workflow approvals, email notifications are sent to all members of an Admin Role, rather than only to those belonging to the requestor's organization. This occurs when participant resolvers are configured as Admin Role members.

 

Environment

• Identity Manager 14.X, 15.X
• Workflow: Policy-based and non-policy based

Cause

The workflow participant resolver configuration lacks scoping, causing the system to send notifications to all members of the role regardless of organizational boundaries.

Resolution

To ensure email notifications are sent only to Admin Role members belonging to the same organization as the requesting user, enable the "Enforce Scoping" configuration:

1. Navigate to the Workflow participant resolver configuration screen within the Identity Manager console.
2. Locate the participant resolver settings where Admin Role members are configured.
3. Check the box labeled Enforce Scoping.
   
4. Save the changes.

Once enabled, Identity Manager filters recipients to only include users who meet both of the following criteria:

• Are members of the selected Admin Role(s).
• Belong to the same organization as the requesting user.

Additional Information

 For further details on managing workflows, review the Identity Manager Documentation.

If issues persist, please open a support case via Contact Broadcom Support.