Skip to content

Admin By Request (ABR) Service Request Automation → Ivanti

Overview

This automation playbook manages the creation and updating of "Admin By Request" (ABR) service requests in Ivanti ITSM, triggered by scheduled or external events. It ensures that ABR requests are properly created, validated, and updated, integrating with Passwordstate for credential management and Ivanti for ticket lifecycle.

High-Level Flow

  1. Retrieve Ivanti API credentials from Passwordstate
  2. Fetch active ABR service requests from Ivanti
  3. Check for existing requests matching the current AdminByReqId
  4. If no matching request exists:
    • Validate the user in Ivanti
    • Create a new ABR service request with all relevant parameters
  5. If a matching request exists:
    • Retrieve related tasks
    • Add a note to the existing task

Execution Flow

sequenceDiagram
    participant Scheduler as Scheduler/External Trigger
    participant AAP as Ansible Automation
    participant PWS as Passwordstate
    participant Ivanti as Ivanti ITSM

    Scheduler->>AAP: Trigger ABR request playbook
    AAP->>PWS: Get Ivanti API credentials
    PWS-->>AAP: API credentials
    AAP->>Ivanti: Fetch active ABR service requests
    Ivanti-->>AAP: List of active requests
    alt No matching request
        AAP->>Ivanti: Validate user
        Ivanti-->>AAP: User info
        AAP->>Ivanti: Create new ABR service request
        Ivanti-->>AAP: New request created
    else Matching request exists
        AAP->>Ivanti: Retrieve related tasks
        Ivanti-->>AAP: Task info
        AAP->>Ivanti: Add note to existing task
        Ivanti-->>AAP: Note added
    end

Components

Ivanti ITSM

  • Service Request Management: Handles creation and updating of ABR service requests and related tasks.
  • Task Notes: Allows adding status updates to existing tasks.

Passwordstate

  • Credential Storage: Stores Ivanti API credentials securely, retrieved at runtime.

Playbook Logic

Variables

  • pws_ivanti_api_key: Title of the API key in Passwordstate
  • ivanti_request_offering: Name of the ABR request template in Ivanti

Main Steps

  1. Get Ivanti API Key from Passwordstate

  2. Retrieves API credentials for Ivanti from Passwordstate using the provided key title.

  3. Fetch Active Ivanti Service Requests

  4. Queries Ivanti for active service requests matching the ABR offering.

  5. Set Facts for Existing Requests

  6. Filters active requests to find any matching the current AdminByReqId.

  7. Create New Service Request (if needed)

  8. Validates the user in Ivanti by email.

  9. Creates a new service request with all ABR parameters if no match is found.

  10. Add Note to Existing Service Request (if found)

  11. Retrieves tasks related to the existing service request.
  12. Finds the 'Goedkeuring ABR' task and adds a note with the latest request details.

Task Input & Output

Input Parameters

  • AdminByReqId: Unique identifier for the ABR request
  • AdminByReqUser: User email for whom admin rights are requested
  • AdminByReqAuditLogLink: Link to the ABR audit log
  • AdminByReqComputer: Target computer
  • AdminByReqFile: File involved in the request
  • AdminByReqReason: Reason for the request
  • AdminByReqRequestTime: Timestamp of the request

Output Actions

  • On New Request: Creates a new Ivanti service request and assigns it to the Systeemsoftware team
  • On Existing Request: Adds a note to the related task with updated information

Error Handling & Idempotency

  • Uses facts and filters to ensure duplicate requests are not created
  • Ignores errors on user validation to allow for fallback or manual intervention
  • All credentials are handled with no_log: true for security

Benefits

  • Automates ABR request lifecycle in Ivanti
  • Prevents duplicate service requests
  • Ensures audit trail via task notes
  • Integrates securely with Passwordstate for credential management
  • Reduces manual overhead for ITSM operations

Notes

  • The playbook is designed to be idempotent and safe for repeated runs
  • All sensitive operations are delegated to localhost for security
  • Task notes provide traceability for request updates