Hello everyone

When a new acccess/account is added to an user, we raise up a new request in ISIM wich goes to appropriated approver.

We need to customize this message sent to the approver showing the following information, basically.

System requested: (LDAP, DB, Oracle, SAP, AD, etc)

The role: Access Admin, Analyst, etc

No default template provide these info and we need to know the parameters that get those info and display through request AND email.

Have someone faced this situation or have any idea on how to do that?

IBM support closed the case stating they dont know how to help.

Thank you

Hi Edson...

You should be able to modify the notification sent to the approver in the Notification tab of the Approval node in your workflow/operation. Any data you can access within the workflow, you should be able to reference in the notification as well.

Example: If this is an Account Add Operation, you could get the name of the Service the Account is being provisioned for by doing something like the following in your Nofication:

If you also want these details displayed for the Approver within the approval in the ISIM UI, you just need to make sure this is done in the "Text" section of the Notification tab of the Approval node... AND you have selected "Use Notification Text as Action Text" on the "Action Text" tab. This will show the "Text" portion of the notification in the Instructions on the Approval Requests.

Hey Grey

Thx a lot for your attention and inputs.. I believe you totally got the point and I deeply appreciate your help and followed your script however I got the message below.

Do you have any idea where I have mistaken? I added the entry in: Design Workflows > Manage Access Request Workflows > Approva node > Notification > Text >

deselecting an option "Use default template" and checking ""Use Notification Text as Action Text" in "Action Text" tab

CTGIMA001E An error occurred while processing the following JavaScript.

JavaScript: var acct = account.get(); var svc = acct.getProperty('service')[0]; return svc.name;

The following error occurred.

Error: Script interpreter error, line=1, col=20: [ReferenceError] 'account' not found

Different Operations/Workflows have different Input/Relevant Data, and refer to the data by different names. So in the example I posted, this was an Account Add operation, where the Account Input data item was named "account". In your case it appears you're doing this in an Access Request Workflow, where there is no data item named "account".

The default Access Request Workflow has the following Data Items available:

entity (which is the UserAccess being requested)

service (the Service object associated with the Access)

owner (the Person for which the Access is being requested).

so using the example i had previously posted, you should be able to get the Service Name by doing the following:

Service Name: <JS>return service.get().name;</JS>

The above script is actually what i had meant to send originally and should work in either Account Operation or Access Workflow, since they both have "service" data items...sorry about that.

Hey Grey,

Thanks a lot for your help. I believe I'm getting closer but still getting some errors when try to update.

The template I'm trying to customize is the default below. Just need to include the system and role info and not yet lucky

https://www.ibm.com/support/knowledgecenter/SSRMWJ_7.0.1/com.ibm.isim.doc/reference/ref/ref_ic_xttl_wkflo.html

Manual Activity Approval Template

Provides information that the user should provide information for a request. By default, this template is enabled.

For example, the template provides this message:

The subject statement is:

The plain text is:

So when you say this isn't working yet...are you getting errors? I don't see in the notification above where you're attempting the script.

As for "Role", last I recalled, Role-base Accesses couldn't be configured with Access Request Workflows (only Group-based Accesses). So I'm wondering...are you just looking to see what Role(s) the User has...or is the "Role" on the Account/Resource (like an AD Group or Oracle Role) they're requesting Access to?

We need to add in Approval request the "Role" on the Account/Resource (like an AD Group or Oracle Role) they're requesting Access to so the approver can see what he's approving/reject as appropriated.

I'm adding the entry in bold in the last line (with "entity") expecting that the new request has it included... but for now, I get error CTGIMA001E.

<RE key="wiApproval_message" />

<ITIMURL/>

<RE key="description"/>: <RE><KEY><JS>process.description;</JS></KEY></RE>

<RE key="requestedFor"/>: <JS>process.requesteeName;</JS>

<RE key="subject"/>: <JS>process.subject;</JS>

<JS>if (process.subjectAccess!=null) if (process.subjectAccess.length>0)

{ '<RE key="accessName"/>: <JS>process.subjectAccess;</JS>\n'; }</JS>

<RE key="requestInit"/>: <RE key="readOnlyDateFormat"><PARM>

<JS>if (process.started != null) return process.started.getTime();

else return '';</JS></PARM></RE>

<RE key="processRef"/>: <JS>process.id;</JS>

<JS>if (process.parentId == '0') { '<RE key="requestedBy"/>:

<JS>process.requestorName;</JS>'; }</JS>

<JS>if (process.parentId != '0') { '<RE key="parent_process"/>'; }</JS>

<JS>if (process.parentId != '0')

{ '<RE key="processID"/>: ' + process.parentId; }</JS>

<JS>if (process.parentId != '0') { '<RE key="processName"/>:

<RE><KEY><JS>if (process.parentId != '0') { process.getParent().name; }

</JS></KEY></RE>'; }</JS>

<JS>if (process.parentId != '0') { '<RE key="description"/>:

<RE><KEY><JS>if (process.parentId != '0')

{ process.getParent().description; } </JS></KEY></RE>'; }</JS>

<JS>if (process.parentId != '0')

{ '<RE key="requester"/>: ' + process.getParent().requestorName; }

</JS>

<JS>if (process.parentId != '0')

{ '<RE key="requestedFor"/>: ' + process.getParent().requesteeName; }

</JS>

<JS>if (process.parentId != '0')

{ '<RE key="subject"/>: ' + process.getParent().subject; }</JS>

<JS>if (process.parentId != '0') { '<RE key="entity"/>: 

<RE><KEY><JS>if (process.parentId != '0') { process.getParent().entity; }

</JS></KEY></RE>'; }</JS>

The error code should contain more details regarding what it was in your script that caused the error. That said, I can see that your script where you're attempting to call: process.getParent().entity would not work. There is not "entity" on a Process object. Here are the JavaScript reference docs for the Process object: https://www.ibm.com/support/knowledgecenter/SSRMWJ_6.0.2/com.ibm.isim.doc/reference/ref/ref_ic_javext_process.html

It also appears that line has JS tags nested in JS tags, where you're essentially calling the same if statement: if(process.parentId != '0'). So you might want to revisit that line to see if that's valid and/or could be cleaned up and made more efficient.

If this is the line where you're trying to get the "Role" from the account object....then you'd likely want something like:

<JS>account.get().getPropertyAsString('<ROLEATTRIBUTEONACCOUNT>');</JS>

Where <ROLEATTRIBUTEONACCOUNT> would be the attribute on the Account object that contains the "Role" data.

Example: if this was a Linux Account this would be: <JS>account.get().getPropertyAsString('erposixprimarygroup');</JS>

If this still doesn't work, I would suggest opening a Case with IBM Support, and hopefully that will help expedite the solution.

The error code should contain more details regarding what it was in your script that caused the error. That said, I can see that your script where you're attempting to call: process.getParent().entity would not work. There is not "entity" on a Process object. Here are the JavaScript reference docs for the Process object: https://www.ibm.com/support/knowledgecenter/SSRMWJ_6.0.2/com.ibm.isim.doc/reference/ref/ref_ic_javext_process.html

It also appears that line has JS tags nested in JS tags, where you're essentially calling the same if statement: if(process.parentId != '0'). So you might want to revisit that line to see if that's valid and/or could be cleaned up and made more efficient.

If this is the line where you're trying to get the "Role" from the account object....then you'd likely want something like:

<JS>account.get().getPropertyAsString('<ROLEATTRIBUTEONACCOUNT>');</JS>

Where <ROLEATTRIBUTEONACCOUNT> would be the attribute on the Account object that contains the "Role" data.

Example: if this was a Linux Account this would be: <JS>account.get().getPropertyAsString('erposixprimarygroup');</JS>

If this still doesn't work, I would suggest opening a Case with IBM Support, and hopefully that will help expedite the solution.

Thanks a lot for all your help, inputs and attention, Grey

I trully appreciate your help.

We finally got the info by:

<JS>var serv = service.get(); serv.getProperty("erservicename")[0];</JS>

Big thanks