Provisioning Role Workflow Approval Failures Caused by Character Limit

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

In some environments, Identity Manager provisioning role workflow approvals may fail consistently, even when a valid approver is assigned. This issue typically presents as an "auto-rejected" request where the system fails to identify a valid user to approve the request, despite the configuration appearing correct. This article addresses the root cause of this failure related to database character limitations.

Environment

Identity Manager

Cause

The workflow failure occurs when the list of approvers defined for a provisioning role exceeds 1024 characters. This length causes an overflow issue when Identity Manager attempts to write the approver list into the VAR_VALUE column of the WP_ACTI_DATA table.

Resolution

To resolve this issue, the VAR_VALUE column size in the WP_ACTI_DATA database table must be increased to accommodate longer approver lists.

1. Stop the Identity Manager Server: Ensure all services are stopped to prevent data inconsistency during the schema modification.
2. Back Up the Database: Perform a full backup of your Identity Manager database before executing any structural changes.
3. Identify the Table: Locate the WP_ACTI_DATA table within your Identity Manager database schema.
4. Modify the Column Size: Execute a SQL command to increase the VAR_VALUE column size.
   • Note: Ensure the new size is sufficient for your environment's requirements (e.g., changing from VARCHAR(1024) to VARCHAR(2048) or larger, depending on your database specification and expected approver list length).
5. Restart the Services: Restart the Identity Manager server and verify that the workflow approval requests no longer trigger the auto-rejection error.

Important: Always consult your Database Administrator (DBA) before performing direct schema modifications. Ensure that any changes are tested in a non-production environment first.