Issue with cross-domain approvals

[peterwigham]

Hi all,

I'm busy working on a requirement for cross-domain approvals; the approvals for this change process require approval to be sought from several different domains that essentially move up and down the domain hierachy chain.

We are using domain separation within our instances and currently have a hierachy of:

- BTLG (internal to our company)

- Pan-London (external domain, child domain to BTLG)

> WCC (external sub-domain, child to Pan-London)

> RBKC (external sub-domain, child to Pan-London)

> H&F (external sub-domain, child to Pan-London)

So, BTLG is the main domain, underneath this is Pan-London and this contain the three other domains.

All internal employees are in the BTLG domain whilst the Pan-London employees are spread amongst the domains of WCC, RBKC and the H&F domains.

We have a workflow in place called 'Comprehensive Change LF' that includes four approval group steps; Change Manager Approval, CAB Aproval: CAB1, Client CAB Approval: CAB2, CAB Aproval: CAB3. All of these steps require approval from BTLG users apart from Client CAB Approval: CAB2 which requires aproval from a user group consisting of users across the three Pan-London sub-domains.

When testing this I've noticed that when I log this with a user in the WCC domain if there are no WCC users within the groups from the same user domain as the user logging the record, the step is skipped and no approval is requested. I understand why this is however, we need to find a way to get approvals to be generated back up the hierachy to the BTLG level.

I've set up the relevant domain 'Contains' and 'Visibility' for the Pan-London sub-domains so that they can all see one another however it would seem that the approvals will not be generated back up to the BTLG users. Has anyone ever has to create a workaround for this using domain 'Contains' and 'Visibility' or within the workflow.

Any help or suggestions would be hugely apreciated.

Cheers,

PW

[williamsun]

Sorry for the late reply,

On the workflow editor add a "Timer" box of 1 second before any Approval box that might need to cross-domain (or before all approvals just in case).

It is now my default workflow design that just before all approvals I always put a Timer of 1 second.

[scottlmco]

Hi Peter,

We've been having the same issue. We were able to work around this (in lieu of an official ServiceNow solution) by looking at the WorkflowApprovalUtils Script Include. There are several functions in there that you can trace around that are called by approval records' business rules and such. There's one method in particular that we modified to create group approvals across domains. The getMembersOfGroup() function queries for user records of a group ID that is passed in by another function that creates the user approvals for a group approval activity in a workflow. The query itself we changed to the domain-agnostic queryNoDomain() call which (in the case of this function) returns a list of users regardless of the domain context in which the workflow is running.

For example, in the getMembersOfGroup function at about line 108 you see the code

           var gr = new GlideRecord('sys_user_grmember');

           gr.addQuery('group', groupID);

           gr.query();

           while (gr.next()) {

                 var id = gr.getValue('user');

                 var grUserRec =   new GlideRecord('sys_user');   

                 if (grUserRec.get(id) && grUserRec.getValue('active') == 1)

                       ids.push(id);

           }

We modified this to call the queryNoDomain function mentioned above and changed the if statement to not instantiate a GlideRecord of the user object:

           var gr = new GlideRecord('sys_user_grmember');

           gr.addQuery('group', groupID);

           //gr.query();

           gr.queryNoDomain();           

           while (gr.next()) {

                 var id = gr.getValue('user');

                 //var grUserRec =   new GlideRecord('sys_user');   

                 //if (grUserRec.get(id) && grUserRec.getValue('active') == 1)

                 if (id)

                       ids.push(id);

           }

This yielded the results we were looking for in cross-domain group approvals in workflows. If you're looking for single approval records in a workflow, look through this script include and see where it might be reasonable to replace the query() function with the queryNoDomain() function.

**NOTE - we contacted our consultant to see if it was OK for us to just modify a system script include, and he said that if that script is updated by a patch or upgrade in the future, the patching/upgrade process will skip it because we made modifications to it. However, you have the capability to apply the change via the log. Keep this in mind when editing a system script include that you or your developers did not create.

Hope this helps!

[Deepak Ingale1]

Hi Scot,

Even we have a similar situation now where you require to have something like this.

Thank you for posting this. Really appreciate it.

We will test it to check if approval are getting applied by incoming mails.

[davidmcdonald]

Hi Scott,

Thanks for the champion of a post.

Continuing on from you, if you specify your users / groups via script, it passes through the following WorkflowApprovalUtils functions. Slightly modifying them will allow using a script to specify users or groups from across domains.

_isValidUser: function(id) {
   //var user = GlideUser.getUserByID(id); //Original
   //return user.exists();


   var ugr = new GlideRecord("sys_user");
   ugr.addQuery("sys_id", id);
   ugr.queryNoDomain(); //Domain androgynous
   return ugr.hasNext();
},

_isValidGroup: function(id) {
   //var group = GlideGroup.get(id);
   //return group.isValid();

   var ugr = new GlideRecord("sys_user_group");
   ugr.addQuery("sys_id", id);
   ugr.queryNoDomain(); //Domain androgynous
   return ugr.hasNext();
},

[krishna191]

How can we achieve this same functionality in flow designers.