IT Process Automation

I've been making great progress on the first App process I've been writing in PAM but I need to query SDM and return a list of Members of a group and then push that list out to a Interaction Request Form. Whats the best way to do that?

I've been attempting to use the get group members sdm soap operator but have yet to figure out how to actually properly configure it and get it to work.

Many thanks!

Take a look at the "Get Group Members Process" in "/Custom Operators/CA SDM" folder of the Library

Hi Joel,

In SDM, the groups are held in the ca_contact table, but are denoted with a contact type, that being "group", and the relationship between the contacts and their groups are held in the Group_Member table (grpmem in the db, Group_Member at the object layer).  So i am guessing that you may need to pass the UUID for the group that you are trying to get the members of.  The group member table will have the UUID of the group in one field and the UUID of the contact in another for each record.   I am not familiar with how to generate the query from PAM, but I figured that knowing the object names may help you out here.

Hope this helps at least a little bit...

Thanks,

Jon I.

I printed out documentation and started drawing out those assertions but wasn't `100% sure that this was how they organised it. Thanks for clearing that up.

Unfortunately the Get Group Members operator does not return the list of all members of the group as a list of userids, which the IRF requires. It only does this for Managers.

You could copy this operator and modify the post execution to create another variable with this data.

Jon is correct that you need to pass the handle(persid) for the group and not the name of the group to this operator.

Also be aware that the Post Execution only puts them in the list if they have the notify flag set as well. Make sure this is what you want.

Andy

If you plan to become a heavy user of PAM and SDM, and build crazy workflows, you need to understand perfectly how SDM works. Mastering doSelect and the object engine is mandatory. You need to be able to extract every piece of information you want. Sooner than you think, you will need to extract data for which there is no OOTB operators nor custom operators. doSelect will be your best friend. 

That said, you may consider using doSelect to get your group members, it'll help you master everything.

objectType : grpmem

whereClause : "group.last_name ='groupName here'"

maxRows = 50

attributes : ['member.combo_name','member.email_address','member.supervisor_contact_uuid.combo_name']

If you understood what grpmem is, you should have noticed that you can retrieve every group that a specific user is a member of :

objectType : grpmem

whereClause : "member.last_name ='Obama' and member.first_name='Barack'"

maxRows = 50

attributes : ['group.last_name']

This is exactly what I was looking for. Perfect.

btw I noticed that the attributes you want to return are list like so:

Am I doing this correct?

Also noticed that like anywhere else in PAM you can inject expressions into any of your arguments to the request constructor. This is powerful stuff!

Thanks Again!

Yep, the attributes you want to fetch need to be added as a string array.

In xml, it is represented by severals <string></string> iterations nested in the <attributes></attributes> node.

My example was written in a simple fashion to help understanding

And a hint : in PAM, when you inject values with dynamic parameters, you replace String1__ in : <string>String1__</string> with your attributes. Since it is string concatenation, opening and closing <string> tag are already there. So if you want to fetch two attributes you need to replace String1__ with :

member.combo_name</string><string>member.email_address

Ok I'm starting to really connect the dots here. I'm getting the xml response out and I can xpath this data to retrieve specific values. All great stuff but now I'm a little hung up on how to go about getting that data over to my IRF. It looks like there are about 20 ways to skin this cat but I'm focused on two right now. The first option I can see is to have the PAM process I'm working on shove the results from the do_select into a global dataset then we reference the global dataset from the IRF in some fashion (essentially creating a global cache to work from), or we mimic the call I just did in PAM out on the IRF using (I think) "ca_pam_getSOAPData" on the load routine. I'm thinking Ideally we just run a live request since the hit shouldnt be to bad on the server and the returned results will be always fresh.

I'm hoping that the material we're covering here is of use to others that run into doing a similar process.

Thanks all for the helpful feedback!

Actually I think I might be onto the answer of my question here... I should be able to kick out initialization setting via the Form data initialization code during asignment of the task.

I'm getting an error back from the service now...

My soap body looks like this:

<impl:doSelect xmlns:impl="http://www.ca.com/UnicenterServicePlus/ServiceDesk">

  <sid>sid__</sid>

  <objectType>cnt</objectType>

  <whereClause>first_name like 'j%'</whereClause>

  <maxRows>50</maxRows>

  <attributes>

<string>combo_name</string>

<string>email_address</string>

  </attributes>

</impl:doSelect>

my response looks like this:

<Envelope xmlns="http://www.w3.org/2003/05/soap-envelope" xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<Body>

<Fault>

<Code>

<Value>soapenv:Sender</Value>

<Subcode xmlns:ns1="http://www.w3.org/2003/05/soap-rpc">

<Value>ns1:BadArguments</Value>

</Subcode>

</Code>

<Reason>

<Text xml:lang="en">string</Text>

</Reason>

<Detail>

<hostname xmlns="http://xml.apache.org/axis/" xmlns:ns2="http://xml.apache.org/axis/">DWSDM004</hostname>

</Detail>

</Fault>

</Body>

</Envelope>

Any Ideas? This is being done from within the IRF.

Did you replace sid__ with an actual value?

That was my immediate thought so I did try that by firing up my parent PAM workflow and pulling the session id from that and I get a 1010 error off that. (bad session)

That was my immediate thought so I did try that by firing up my parent PAM workflow and pulling the session id from that and I get a 1010 error off that. (bad session)

That may mean that the Session ID has expired. You may want to have a login before your doSelect to get an active SID.

Wouldn't that be counter intuitive for the user if they have already logged in to view the IRF? Is it possible to retrieve the current session id?

Viewing the IRF means the user has logged into PAM, not Service Desk. In order for PAM to talk to Service Desk it has to authenticate. Don't you have some configured credentials that you use for PAM to access Service Desk?

Ok that makes sense now. Forgive me I'm still green and showing it.

This points to two more questions though:

• I suppose i could run the login on the pam process & pass the sessid over to the IRF?
• And- If a user doesnt immediately grab the email and respond to the task is it possible for the login to expire while the process is open?

Attempting the login now to solve the issue.

If your process becomes pending at some point, you need to login to SDM again before calling its webservices.

You can configure the webservice session timeout in the options manager in ServiceDesk, under Web Services. "webservice_session_timeout"

I was thinking I could sit in the process and monitor the login status somehow and if it ever fell bring it back up. Is that possible?

Actually I think I have a solution for this tell me if I'm off in left field here. Could I just pass the authentication params off to the IRF through the PAM process when the task is assigned then use those to authenticate, get the session and then pass that into my contacts lookup?

#brainisnowjello

You should use a service account to connect to SDM webService. You will avoid security exception.

You should keep your login and password in a global dataset and load it in your process.

If you want to behave in the name of someone else you can use the "impersonate" method.

I just got it working . And yes we have a global dataset holding those credentials. Just used it for the first time in referencing. hah!

So at the meat of this issue in this case of trying to call soap actions inside the IRF... which is best?

1. having the IRF do a login
   or
2. having the PAM process calling the IRF do the login and consuming its own self retrieved sess id?

Furthermore should I get it to log itself out at the end of all this or is it ok to let itself die off?

Again thanks all!

Also I'm running into this when return the data from the soap service in the IRF...

<Envelope xmlns="http://www.w3.org/2003/05/soap-envelope" xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<Body>

<doSelectResponse xmlns="http://www.ca.com/UnicenterServicePlus/ServiceDesk">

<doSelectReturn xmlns="">&lt;?xml version="1.0" encoding="UTF-8"?&gt;&lt;UDSObjectList&gt;

&lt;UDSObject&gt;

&lt;Handle&gt;cnt:1234123412341234123412341234&lt;/Handle&gt;

&lt;Attributes&gt;

&lt;Attribute DataType="2002"&gt;

&lt;AttrName&gt;combo_name&lt;/AttrName&gt;

&lt;AttrValue&gt;Doe, John &lt;/AttrValue&gt;

&lt;/Attribute&gt;

&lt;Attribute DataType="2002"&gt;

&lt;AttrName&gt;email_address&lt;/AttrName&gt;

&lt;AttrValue&gt;some.consultant@email.org&lt;/AttrValue&gt;

&lt;/Attribute&gt;

.. Obviously they are returning the response wrapped in the doSelect return node encoded. Is there a way to decode this into a useable string to parse to JSON?

Many Thanks!