Identity Manager: Endpoint Relationship Display Failure in Approval Workflows and Submitted Tasks

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

In Identity Manager 14.x, modifying an Account Template by adding or removing endpoints may result in the updated endpoint information failing to display within the View Submitted Tasks interface or during the Approval Process (Workflow). This visibility issue occurs when the EndpointRelationship tab definition is missing from the specific Admin Task configuration within the environment's Role Definitions.

Environment

Identity Manager 14.x, 15.x

Cause

The "Approve" Admin Task associated with the workflow does not contain the necessary XML tag to render the Endpoint Relationship tab. Even if the primary task (e.g., "Modify Account Template") includes the tab, the corresponding approval task must also explicitly include the EndpointRelationship tab definition to display changes to approvers.

Resolution

To resolve this issue, you must manually add the missing EndpointRelationship tag to your Role Definitions XML file.

1. From the Identity Manager Management Console, export the "Roles and Tasks Settings"
2. Search for the Admin Task Account Template you are using to modify the Endpoints, in this article we are using the "SDK DYN Compound" endpoint
   
3. Inside of <Ims Task name="..."> search for the tag "tabdefinition="EndpointRelationship">"
4. Copy this tag, you will need to paste it into the Approve task you have configured in your workflow process
   
   
   
5. Search for the Approve admin task you have configured in your workflow
   
6. Take a look at the tag and you will not see a tag with "tabdefinition="EndpointRelationship">"
7. Paste the tag from step 4 inside the "<ImsTask name="Approve..."
8. Change the tag from XXXXAccountTemplateEndpoints to tag="Endpoint"
9. In the same tag, change the "ManageMembers" from 1 to 0, this is to avoid the user changing the Endpoints during the approval process
10. Below is the tag after the last modifications
    
11. Import the XML file using the Identity Manager Management Console
12. Restart Identity Manager as requested.

 

Note: To avoid importing the whole "<YourEnvName>-RoleDefinitions.xml" file you can copy the Approve task from step 5 into a new file

You must copy the first lines of your RoleDefinitions at the beginning of the file and add the "</ims:ImsTemplate>" to the end of the file

 

 

Additional Information

Attached are the XML files from the "Approve SDK DYN Compound Account Template" tasks before and after the changes.