could you please help, in clarifying my view on Workflow(MSMP) in AC. I have mentioned below, my understanding.

[Former Member]

-  Rule id is created on BRF+, and this Rule id contains Path(s) and their Rule Result(s).  I have created 1 Rule Result, for a New/Change account.

- after creating this Rule Id, i open MSMP, and the Rule Id appears against the Process Id, in Step1. I am not using any Escape path, so as to have my first workflow creation simple.

- In Step 2, the Rule ID is Result is given a Trigger value description. So, i provide a description, for my Rule Result.However could you please say, the usage of this Trigger value, except that, it proivdes Description of the Rule result

- then i go to Step 5 , for creating Path, Add a Path-> Add a stage (GRAC_SECURUTY). Since, this is for testing purpose, i am not giving GRAC_ROLEOWNER/GRAC_MANAGER. I just want a workflow to be completed for New/Chnage Account request.

- I do not maintain Agents or Variables & Templates.

- In route Mapping, I assig the Path to the Rule Id, Then i generate the version, and it is created succesfully.

So, from the above steps , i understand that When a user raises a New/Change Request(eg. process ID: SAP_GRAC_ACCESS_REQUEST), the Rule ID is identified , from Step1. Then the Rule result is identified from  Decision Table( in BRF+). Then the Rule Result identifies the path from Step 'Route mapping'. Aftre Path is identified, it travels through the Stages, defined in 'Maintain Path'

Therafter , the Security team or Role Owner can provison the request.

Please let me know, about my understanding.

[Colleen · Accepted solution]

Hi Plaban

I wrote a piece about explaining how MSMP works with the mappings. It might help clarify your understanding:

When you submit a request each type has a Process Id. In the case of an Access Request that is the SAP_GRAC_ACCESS_REQUEST. The webdynpro has a heap of code that finds that process id and goes to look at the MSMP configuration.

The very first item to be executed is the Initiator rule. Each Process Id can only have one active Initiator Rule as it is mapped (visible on Step 1 of the MSMP). If you have created a BRF+ Initiator Rule then it will go and execute it. Initiator Rules are designed to handle multiple scenarios (hence the results).

In your BRF+ you would have specified the possible combinations (again look at my post). In MSMP Step 2 for the Initiator rule for Rule Results you need to tell the MSMP how to handle each value that the BRF+ rule might return. As a result, you have to map each value. The description won't matter much except as meaningful information.

After you finish Step 2, you then need to go over to Step 6 to maintain the routings. This is where you have to tell the MSMP which Path the rule result should go to for the Initiator Rule. After that you jump back to Stage 4 for Paths/Stages to maintain them.

This mapping assumes that you are not building any new Agents or Paths. If you were to build a new Path and Stages you would have to configure them first and then go to Step 6 to map them

Please let me know if there is still any further confusion.

Regards

Colleen

[Former Member · Accepted solution]

Hi Coleen, I had earlier, been through your post. But the workflow that a Request goes throough was not clear to me. hence, i asked .

So, to summarize, I will take an example:

- A New request is a GRAC_ACCESS_PROCESS_REQUEST process Id type, and hence the Rule ID is deteremined(from Step 1).

- The Rule ID has Request type associated with Rule Results(in BRF+) .So, the appropriate Rule Result for New request is determined.

- The Rule Result has Path in Step 6(Route mapping). So, path is determined

- The path has stages defined in Step5 . So, request goes through these stages.

Please let know, if my understanding is correct

[Colleen · Accepted solution]

Yes. Every request that gets submitted for access request will cause the initiator rule to be executed. My document shows the mapping for the BRF+ through to paths and stages (pretty much what you are paraphrasing)

when hen you say new request I assume you mean any newly created access request. It could be a new user, change user, firefighter - whatever the request type is. But all of them will be evaluated based on how you configured the process id. The initiator rule (or routing rule on a stage) allows you to split the request or direct it to a path based request attributes.