Help with Cross-Domain Approval

mandalorian · ‎10-11-2024

Hi everyone,

I’m seeking help with an issue we're facing after implementing domain separation in our instance. Here's the situation:

Issue:

We have a workflow that involves a group approval step. The workflow is designed to continue once one group member approves the request, and the remaining approvals are marked as "no longer required." This setup was working well until we enabled domain separation plugin for requested items.

Members of the approval group belong to two different domains:

- Domain A: 3 members

- Domain B: 4 members

The approval process typically happens in Domain B, but in some cases, we want Domain A members to be able to approve the request on behalf of Domain B members. Both domains fall under the TOP domain.

Since enabling the domain separation plugin, the workflow no longer recognizes Domain A members’ approvals for requests that are initiated in Domain B. The workflow stalls, as it doesn’t acknowledge the approval from Domain A.

What I've Tried:

I've explored different solutions, including some that suggested using common domain for 2 domains to grant cross-domain approval permissions, but none of them worked due to domain restrictions enforced by the plugin. Maybe I am missing something in the process.

Question:

Could anyone guide me on how to configure the system (maybe through ACLs or another method) so that members from Domain A can approve requests for Domain B and allow the workflow to proceed smoothly?

Any help or suggestions would be greatly appreciated! This is my first post, and I'm excited to hear from the ServiceNow community of experts and enthusiasts.

Thank you in advance!

mandalorian · ‎11-13-2024

Hi Everyone,

I wanted to share a solution I found for handling cross-domain approvals in ServiceNow when the domain separation plugin is enabled.

Here's what I did:

1. I used Flow Designer to create a flow.

2. The flow is triggered by the sysapproval_approver table with specific conditions for update.

3. It then looks up the related sysapproval_group record.

4. If step 3 is successful, the sysapproval_group record's approval state is updated to 'approved'.

4. I set the flow on the global domain, which has access to the top and its related domains.

I hope this post will be helpful to anyone facing similar issues with cross-domain approvals.

Thanks and cheers,

Mando

View solution in original post

Mio Matsushita · ‎10-18-2024

Hello.

Try each of the following two changes to see if they resolve the issue.
- Grant an approver in Domain A visibility to Domain B.
https://docs.servicenow.com/csh?topicname=c_DomainVisibility.html&version=latest
- Change the flow's Run As to "System User".

Also, please let me know some things to solve the problem.
- Is the domain of the record in the Approvals[sysapproval_approver] table Domain B?
- Is the domain of the record in the Flow engine context[sys_flow_context] table Domain B?
- Can a user from domain A see domain B?

- Can a user from domain B see domain A?

mandalorian · ‎10-28-2024

Hi Mio. Thank you for you reply. Please find below information for your questions

1. if the user in the Approvals[sysapproval_approver] is from domain A, then domain is A, if the user from domain B, then the domain is B. So in the approval group there are 2 type of users(abc@domaina.users, abc@domainb.users) from domain A, B.

2. Process Engine of this process is a legacy Workflow. And yes its context runs in domain B

3. No as there is a domain separation plugin enabled...this is causing the issue with the approvals at the moment.

4. No as well. the hierarchy is we have:

TOP:

Domain A

Domain B

mandalorian · ‎11-04-2024

Hi Everyone, I am still struggling to find a solution to this.. any guidance/ help much appreciated!

mandalorian · ‎11-04-2024

@Chuck Tomasi