Configuring approval workflows

This guide explains how to create approval workflows (also known as Approver Associations) for roles, groups, and resources in OpenIAM.

Defining an Approval workflow

OpenIAM allows you to define approval workflows at two levels:

1. Application Level (Managed System or Manual Managed System).
2. Entitlement Level (Roles, Groups, or Resources).

For applications with a large number of entitlements, defining the approval flow at the application level is recommended. However, you can override this at the entitlement level if necessary.

To define approvers, follow the steps below.

1. Locate the Application or Entitlement

For Applications

1. Go to WebConsole > Access Control > Resource.
2. Filter by Managed System or Manual Managed System in the Type column.
3. Find your application by searching in the Name column.
4. Click the Actions button to view the application details.

For Entitlements

1. Enable Entitlement-Level Approvals.

   • Go to WebConsole > Administration > System Configuration.
   • Navigate to the Workflow tab.
   • Enable the Use approver association or role/group instead of resource checkbox.

2. Find the Entitlement.

   • Determine the entitlement type (Role, Resource, or Group).
   • Go to WebConsole > Access Control > [Entitlement Type].
   • Filter by Managed System name in the Managed System column.
   • (Optional) Further filter by Metadata Type.
   • Find your entitlement by searching in the Name column.
   • Click the Actions button to view entitlement details.

3. Define the Approval flow

   • Click on Approval Associations from the sidebar.
   • Click the + button to add an approver.

3. Configure the Approval flow Fill in the following fields:

• Approver: Select the approver type and name.
• Notify on Approval: Choose who will be notified if this step is approved.
• Notify on Reject: Choose who will be notified if this step is rejected.
• Request Service Level Agreement (SLA) Parameters:
  • Number of Reminders: How many reminders to send.
  • Days Before Sending Reminder: When to send the first reminder.
  • Total Time to Complete (Calculated Value).

Approval flow field descriptions

Adding additional approval steps

To add another step:

1. Save the first approver.
2. Click the + button again.
3. Repeat the configuration process.

Approver Types

Escalations

If a request is not approved or rejected within the defined timeframe, it can either:

• Be automatically rejected by the system.
• Be escalated to a higher-level approver.

To configure escalations:

1. Open the Approver Association screen.
2. Click the blue escalation button.

3. In the Escalation List window:
   • Select the user or group to escalate to.
   • Click Add.
   • Configure reminder frequency and days before escalation.

If the initial approver does not take action, the request is escalated based on these settings. If it remains unapproved past the expiration date, it is automatically rejected.

Enabling escalation processing

Escalations are managed by a batch task. To enable it:

1. Go to WebConsole > Administration > Batch Tasks.
2. Find Escalation of Expired Requests.
3. Click Edit and enable the Is Enabled flag.

Notifications

Approvers can receive notifications about pending requests. However, for notifications to be sent, the corresponding batch task must be enabled.

Enabling approval notifications

1. Go to WebConsole > Administration > Batch Tasks.
2. Find Notification Reminders for Approvers.
3. Click Edit and enable the Is Enabled flag.

This batch task handles reminder notifications. Standard email notifications are sent by default.

Email notifications

Standard email templates are used to notify users about request statuses.

Example email notifications

Request created on behalf of a user

Pending request for approval

Request approved

Preliminary approval notification