OVERVIEW
When calling an Okta Workflow from Resource Centric Access Requests (RCAR), the workflow may not execute as expected.
APPLIES TO
-
V2 Resource Centric Access Requests
-
Okta Workflows
ASSUMPTIONS
-
You have enabled and configured the ability to call an Okta Workflow from any kind of OIG Access Request. See instructions here.
UNDERSTANDING THE FLOW
Okta Workflows can be integrated into Access Request Approval Sequences, often to initiate external integrations or orchestrations. The specific workflows invoked and their frequency are determined during the design process.
A common reason for a workflow failing to execute in this context relates to a specific data point configured in the payload when linking an approval sequence to an Okta Workflow.
This crucial piece of data is the Request Assignee’s Email Address.
Note: This is the default state of Resource Centric Access Request based requests. The Assignee, noted, is not assigned.
Access Requests created through the Resource Centric Access Request (RCAR V2) do not automatically have an Assignee. This means the 'Assignee' variable, representing the administrator linked to the submitted request, will be unset by default. Consequently, if an Access Request lacking an Assignee is sent to an Okta Workflow, the Workflow will not run. An Okta administrator needs to manually specify an Assignee within the Access Request Console. Only after the Assignee is designated in the Console will any Okta Workflows waiting for this variable proceed with execution.
RECOMMENDATION
To ensure Okta Workflows triggered by Resource Centric Access Request (RCAR V2) execute automatically, avoid using the Request Assignee Email Address by default when calling the workflows unless truly needed.
Summary
An Okta Workflow might fail to execute when called from Resource Centric Access Requests (RCAR V2) due to the absence of an "Assignee" variable. RCAR V2 requests do not automatically have an assignee, causing the workflow to halt. To resolve this, avoid using the Request Assignee Email Address by default when call the workflows or manually specify an Assignee within the Access Request Console.
