[midPoint] Role request questions

[Aivo Kuhlberg]

Thanks,

I will try to test it.


Aivo

________________________________
Saatja: midPoint <midpoint-bounces at lists.evolveum.com> nimelPavol Mederly <mederly at evolveum.com>
Saadetud: 12. august 2016 13:29
Adressaat: midpoint at lists.evolveum.com
Teema: Re: [midPoint] Role request questions


Aivo,


having looked at the documentation and the code, I think that:

  1.  it is possible (in 3.4) to allow user "request" removing existing assignments - to be executed immediately, without any approvals - simply by creating an authorization for action of  (...)authorization-model-3#unassign.
  2.  If you'd like to have such unassignments approved by role approver, it could be implemented by cloning and updating AddAssignmentAspect (and its subclasses). It should not be too much work, if needed.

Best regards,

Pavol Mederly
Software developer
evolveum.com


On 12.08.2016 12:11, Aivo Kuhlberg wrote:

Hi Pavol,

Thanks for the answers.

This is an interesting question. Do you want this operation to be carried out automatically (without approval), or to be approved in the same way as assignment creation?

I was thinking about creating request for removing user's current assignment. It is just theoretical question at the moment and I don't think this feature might be much needed in real life - maybe only when user notices that he/she has assigned to wrong role (may happen when there are many roles) and then user sends request to "unassign" the wrong role and assign correct one.


Regards,

Aivo

________________________________
Saatja: midPoint <midpoint-bounces at lists.evolveum.com><mailto:midpoint-bounces at lists.evolveum.com> nimelPavol Mederly <mederly at evolveum.com><mailto:mederly at evolveum.com>
Saadetud: 12. august 2016 12:12
Adressaat: midpoint at lists.evolveum.com<mailto:midpoint at lists.evolveum.com>
Teema: Re: [midPoint] Role request questions


Hello Aivo,


please see answers in your text.


Best regards,

Pavol Mederly
Software developer
evolveum.com


When I request a role (which have approver) then I don't see the request under My Requests. Does the requester needs some authorization to view his/her currently active requests?

Yes.

The background is this: Information about an approval process is stored in midPoint task (as well as in Activiti process instance, but that's not important now). In 3.4, we are not able to specify authorization for tasks to allow displaying only the tasks that are somehow related to the user. We are limited to quite static conditions, like "show tasks that belong to a (fixed) user", or "show tasks that were requested by a (fixed) user". So, basically, you'd need a separate role for each possible requester, and that's obviously a nonsense.

This more flexible mechanism is to be implemented in 3.5, as per https://jira.evolveum.com/browse/MID-3121. (It's little bit unclear if it will really fit into the schedule, but that's another story.)

As a workaround for 3.4, you could give users read access to workflowContext section of all tasks. If you disallow non-GUI access for them, and disallow using Task List page, it could be reasonably secure. (Based on the fact that the users will not know tasks' OIDs to access them directly.) But it depends on how secure you want your system to be.

Can user request to remove the assigned roles? By default it does not seem to work?

This is an interesting question. Do you want this operation to be carried out automatically (without approval), or to be approved in the same way as assignment creation?

Is it possible in request roles dialog to hide from available roles the roles which have already assigned to user and/or roles which user has already requested but have not yet approved?

Currently it is (as far as I know) not implemented. I think it is not a too much work to be done. (Please create a jira if you're interested.)

There is one aspect that comes to mind: An assignment can be e.g. disabled, or valid only through a period of time, or be bound to a specific org or tenant, or have any parameters that make it different from other assignments of the given role. So there might be reason to add a role for which some assignment already exists. Therefore, this feature should be configurable (by administrator, knowing the deployment details), or should be switchable on/off by the user.

By default when role is requestable but have no approver the end user can order a role without any approval - is it possible to avoid such situation, eg by defining some kind of policy that when request have no any approving users then the administrator still has to approve it?

Good idea! I am convinced this can be done using authorizations mechanism: To allow end user see only roles that have non-empty approverRef field.


________________________________
Käesolev e-kiri võib sisaldada asutusesiseseks kasutamiseks tunnistatud teavet.
This e-mail may contain information which is classified for official use.


_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com<mailto:midPoint at lists.evolveum.com>
http://lists.evolveum.com/mailman/listinfo/midpoint



________________________________
Käesolev e-kiri võib sisaldada asutusesiseseks kasutamiseks tunnistatud teavet.
This e-mail may contain information which is classified for official use.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20160812/d266fb0d/attachment.htm>