-
Title
Can Quick Connect / Active Roles Synchronization Service integrate with Active Roles Workflows? -
Description
Will Provision, Update or Deprovision workflow steps run in either Quick Connect or the Active Roles Synchronization Service trigger related Active Roles Workflow rules, if those are configured for the target container?
Also, can Active Roles Workflows be triggered when creating, updating or deprovisioning users with Active Roles Management Shell?
-
Resolution
In most cases, Workflows will trigger and function as expected. Script Activity rules and If-Else Activity rules can be triggered from Quick Connect or PowerShell scripts, as long as they include a Notification Activity rule. The Notification Activity may be just an empty placeholder rule, it may not send any notifications.
However, Approval Workflows configured for the target container in ActiveRoles Server cannot be triggered from Quick Connect / Active Roles Synchronization Service. Please review the Additional Information section in this solution article for details.It is possible to add a Control to cmdlets run in the Active Roles Management Shell which will allow this client to trigger Approvals, but this option should be leveraged with care. Bulk-processing clients like Quick Connect ,the Active Roles Synchronization Service, and the Active Roles Management Shell have the capability to create thousands or the-of-thousands of approval operations in minutes. This can compromise the integrity and stability of the Active Roles Solution.The below PowerShell script sample demonstrates one method by which a Control could be leveraged. Approvals triggered by this method still respect the standard Approval rules - if this code is executed under the security context of an Active Roles Administrator, then Approvals will be bypassed, unless the Approval Workflow has the Force Approval option enabled.
##############################################################################The below script is known to work successfully; however, it has not been officially tested by our Quality Control. If any of these instructions are changed and/or incorrectly used, intentionally or unintentionally, this solution becomes unsupported by our Support and Development. Support and Development recommend always making a backup of the current database prior to execution of any script(s) that may modify it. For customization of the Active Roles Solution, please contact our Professional Services Organization.##############################################################################$reason = "This operation was initiated programatically."$groupDN = ""$userDN = ""$controls = @{}$controls.Add('AllowApproval','Confirm')$controls.Add('OperationReason',$reason)Add-QADGroupMember -Identity $groupDN -Member $userDN -Control $controls -Proxy -
Additional Information
If an Active Roles Approval Workflow is configured for a target container where Quick Connect / Active Roles Synchronization Service attempts to create, modify or delete users, you might observe the following behaviour:
- If the Quick Connect / Active Roles Synchronization Service service account is an Active Roles Administrator, the Approval Workflow rules will be ignored.
By default, Approval requests will be bypassed if the operation initiator is an Active Roles Administrator, or if the initiator is an Approver. The workflow will complete successfully.
- If the service account is not an Active Roles administrator, all the modification, creation and deletion requests will fail with the following message:
Your operation cannot be processed.
The operation you have requested requires approval by authorized persons, whereas the application you are using does not support the creation of approval requests. Use the ActiveRoles Server Web Interface to perform operations that require approval.
- If the Quick Connect / Active Roles Synchronization Service service account is an Active Roles Administrator, the Approval Workflow rules will be ignored.