Ask MY-Community
Anouar AGNAOU
Anouar AGNAOU
·PS at Memority

Role request reporting – Real time tracking

Resolved

Hello,

I have a client with a very specific reporting requirement related to role requests.

The client would like to generate a dedicated report for manual role requests with the ability to track each request in near real time and export the data in CSV format. More specifically, for every manual role request, they need visibility on :

  • the current status of the request

  • the exact step of the approval workflow the request is in

  • the validator pool to which the request has been assigned

  • and the user who validated the previous approval step

The goal is to follow the full lifecycle of each role request as it progresses through the validation workflow with up-to-date information available for reporting purposes.

At this stage, I am not entirely sure which is the best approach to address this requirement within Memority (native reporting, APIs, policies, etc).

Do you have any recommendations or best practices to implement such a reporting mechanism?

Thank you

Reporting
1 reply
Best reply by Anouar AGNAOU

Hi there,

This is a very relevant requirement and can be addressed by leveraging Memority’s reporting collections combined with object policies and workflow enrichment.

As a first step, you should create a dedicated reporting collection (custom collection). This collection will serve as the data foundation for your CSV report and allow you to store all role requests related information in a structured format.

The next step is to populate this collection automatically. To do so, you need to create an Object Policy that is triggered whenever a role is requested by a user. This policy will detect changes on role assignments and capture the relevant data at request time.

At the policy level, the trigger condition should be defined in the handleEvent section as follows :

<handleEvent>
   <script><![CDATA[
      return CHANGES.hasRolesChanged()
   ]]></script>
</handleEvent>

Within the policy script, you then need to identify the values that were added to the role attribute :

AttributeValueChange attributeValueChange = CHANGES.attributeValueChanges().find { AttributeValueChange it ->
    it.attrId == "roles"
}

If new roles have been added, you can extract the requested role and retrieve the associated metadata (role name and application) :

if (!attributeValueChange.addedValues.empty) {
    def addingRole = attributeValueChange?.addedValues[0]

    addingRole?.properties.each { key, value ->
        if (key == "role") {
            addedRole = FIND.role()
                .withAttributesProjection("roleApplication", "roleName")
                .matching(expr { prop("id").eq((String) value) })

            roleName = addedRole?.roleName
            applicationId = addedRole?.roleApplication

            applicationName = FIND.resource()
                .withAttributesProjection("rsrcName")
                .matching(expr { prop("id").eq((String) applicationId) })?.rsrcName
        }
    }
}

Once the relevant data has been retrieved, you can insert a new document into the reporting collection using the Reporting API:

API_REPORTING.on("accessRequest").document()
    .field("requestDate", Instant.now())
    .field("requestType", "Access request")
    .field("requesterEmail", requesterEmail)
    .field("email", OBJECT.email)
    .field("status", requestStatus)
    .field("requestName", requestName)
    .field("roleName", roleName)
    .field("applicationName", applicationName)
    .end().save()

Finally, to enrich the report throughout the approval workflow, you should configure each workflow step individually. For every step, go to the Notifications section and choose the appropriate execution moment (at the beginning or at the end of the step). You can then add a Groovy script to update the same reporting collection with additional information, such as:

  • the current workflow step,

  • the validator pool involved,

  • and the user(s) who validated the previous step.

This approach allows you to track the full lifecycle of a role request in near real time and generate an up-to-date CSV report reflecting the exact status and approval history of each request.

This should address your need 🙂

Best regards,

Anouar

View original