Hi, I want to change the approver when the approver has specific jobTitle. For example: If the approver is a Director, I want to send all the Approval request to another person (could be his or her assistant). How can I do that? ThanksJuanCC Technology Specialist

You will need to use a FIM query to return a result set which meets both requirements, i.e. something like this which I constructed in a search scope: /Person[(ObjectID=/Person[ObjectID = '%LoginID%' and JobTitle='Director']/Manager) or (ObjectID=/Person[ObjectID = '%LoginID%' and JobTitle!='Director'])] I have used the Manager attribute to determine who to send the approval to when the user in context (%LoginID%) is a Director ... you will need to use whatever reference attribute bound to /Person that you want (if it doesn't exist you may need to extend the Person schema and populate a custom binding). Also, you would need to substitute '%LoginID%' with say '[//Target]' or '[//Requestor]'.Bob Bradley, www.unifysolutions.net (FIMBob?)

My understanding is that you would need to create a custom approval workflow to do what you're trying to do. Even then, I'm not sure you can reference //owner/assistant/email - Ross Currie

Shouldn't be necessary Ross ... standard approval will work fine, as the approver(s) just needs to resolve to one or more Person objects ... and the above xpath query will do just that :).Bob Bradley, www.unifysolutions.net (FIMBob?)

Oops, missed your reply to that one, sorry Bob. Anyway, I'm a bit confused here. In this case, the approvers for Juan's approval workflow would be something like: /Person[(ObjectID=/Person[ObjectID = [//Target/Owner/] and JobTitle='Director']/Assistant) or (ObjectID=/Person[ObjectID = [//Target/Owner] and JobTitle!='Director'])] (or whatever attribute they store the assistant reference in?) Is that correct? I have a feeling I'm muddying the issue - Ross Currie

Correct Ross, except you need '' around the [//*/*] tokens.Bob Bradley, www.unifysolutions.net (FIMBob?)

I changed approver with: /Person[(ObjectID=/Person[ObjectID = ['//Target/Owner/'] and JobTitle='Director']/Assistant) or (ObjectID=/Person[ObjectID = ['//Target/Owner'] and JobTitle!='Director'])] Is it OK? (with ''). Did I missed anything? When I tried to sva the workflow it gives me an error. I found this event in Forefront Identity Manager event log: Log Name: Forefront Identity Manager Source: Microsoft.ResourceManagement Date: 5/3/2011 1:54:40 PM Event ID: 3 Task Category: None Level: Error Keywords: Classic User: N/A Computer: SRVTROIMQAFE001.qa.edenor Description: Requestor: urn:uuid:7fb2b853-24f0-4498-9534-4e10589723c4 Microsoft.ResourceManagement.Service: Microsoft.ResourceManagement.WebServices.Exceptions.PermissionDeniedException: Exception of type 'Microsoft.ResourceManagement.WebServices.Exceptions.PermissionDeniedException' was thrown. at Microsoft.ResourceManagement.WebServices.RequestDispatcher.ExecuteGetAction(RequestType request) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.ExecuteAction(RequestType request) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.ExecuteAction[ResponseBodyType](RequestType request) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.DispatchRequest[ResponseBodyType](RequestType request, Guid requestIdentifier, Object redispatchSingleInstanceKey, Boolean isRedispatch) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.DispatchRequest[ResponseBodyType](RequestType request) at Microsoft.ResourceManagement.WebServices.ResourceManagementService.Get(Message request) Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft.ResourceManagement" /> <EventID Qualifiers="0">3</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2011-05-03T16:54:40.000Z" /> <EventRecordID>290085</EventRecordID> <Channel>Forefront Identity Manager</Channel> <Computer>SRVTROIMQAFE001.qa.edenor</Computer> <Security /> </System> <EventData> <Data>Requestor: urn:uuid:7fb2b853-24f0-4498-9534-4e10589723c4 Microsoft.ResourceManagement.Service: Microsoft.ResourceManagement.WebServices.Exceptions.PermissionDeniedException: Exception of type 'Microsoft.ResourceManagement.WebServices.Exceptions.PermissionDeniedException' was thrown. at Microsoft.ResourceManagement.WebServices.RequestDispatcher.ExecuteGetAction(RequestType request) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.ExecuteAction(RequestType request) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.ExecuteAction[ResponseBodyType](RequestType request) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.DispatchRequest[ResponseBodyType](RequestType request, Guid requestIdentifier, Object redispatchSingleInstanceKey, Boolean isRedispatch) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.DispatchRequest[ResponseBodyType](RequestType request) at Microsoft.ResourceManagement.WebServices.ResourceManagementService.Get(Message request)</Data> </EventData> </Event>JuanCC Technology Specialist

Not quite :). Try this instead: /Person[(ObjectID=/Person[ObjectID = '[//Target/Owner]' and JobTitle='Director']/Assistant) or (ObjectID=/Person[ObjectID = '[//Target/Owner]' and JobTitle!='Director'])]Bob Bradley, www.unifysolutions.net (FIMBob?)

Not quite :). Try this instead: /Person[(ObjectID=/Person[ObjectID = '[//Target/Owner]' and JobTitle='Director']/Assistant) or (ObjectID=/Person[ObjectID = '[//Target/Owner]' and JobTitle!='Director'])]Bob Bradley, www.unifysolutions.net (FIMBob?)

Sorry, I could change the approver definition (I have to do in Advanced View, extended Atribute and chage [//TArget/Owner] with this instruction), but workflow fails when I tried to add amember. This is the error message: WorkflowInstance 'cce89eae-86ff-4e4d-a13c-9a227d712527' could not resolve any of the defined approvers: '/Person[(ObjectID=/Person[ObjectID = '[//Target/Owner]' and JobTitle='Director']/Assistant) or (ObjectID=/Person[ObjectID = '[//Target/Owner]' and JobTitle!='Director'])];' Should I change any MPR? ThanksJuanCC Technology Specialist

Not sure why ... are you sure that there is an owner specified for the group you're changing? Also, is the JobTitle matching? Check all this with the following query for your own login ID in a search scope: /Person[(ObjectID=/Person[ObjectID = '%LoginID%' and JobTitle='Director']/Assistant) or (ObjectID=/Person[ObjectID = '%LoginID%' and JobTitle!='Director'])]Bob Bradley, www.unifysolutions.net (FIMBob?)

I created a search scope replacing %LoginID% with my user's ResourceID (36b57997-fbea-4fad-9f6e-abe2302dcb40) and the search scope works fine (if I configure my JobTitle as Director, the result was my assistant and if I configure my JobTitle different from Director the result was my user). But When I modified the workflow it still gives me the same error. I tried to configure the workflow with the ResourceID instead of //Target/Owner, if I am not wrong, it should ALLWAYS send the approval to the same user (my assitant or myself) depending on my JobTitle: Approval="/Person[(ObjectID=/Person[ObjectID = '36b57997-fbea-4fad-9f6e-abe2302dcb40' and JobTitle='Director']/Assistant) or (ObjectID=/Person[ObjectID = '36b57997-fbea-4fad-9f6e-abe2302dcb40' and JobTitle!='Director'])];" But I receive the same permission error: WorkflowInstance 'b1177b3b-61ba-4af0-b6bf-b7cd87ccead2' could not resolve any of the defined approvers: '/Person[(ObjectID=/Person[ObjectID = '36b57997-fbea-4fad-9f6e-abe2302dcb40' and JobTitle='Director']/Assistant) or (ObjectID=/Person[ObjectID = '36b57997-fbea-4fad-9f6e-abe2302dcb40' and JobTitle!='Director'])];' Am I doing anything wrong? ThanksJuanCC Technology Specialist

OK - I haven't tried your above example in an approval myself, but knowing that the resolution of the query gives the right answer, and (from memory) that there were some improvements made in resolving these queries for approvals/notifications, I was hoping this could be done in a single step. The only alternative is to preceed the approval step in your workflow with a lookup (custom) activity to save your approver(s) to say //WorkflowData/Approvers, then specify this again (//WorkflowData/Approvers) in your approval activity. I'm still hoping you can avoid this though ... have you got all of the latest patches?Bob Bradley, www.unifysolutions.net (FIMBob?)