Maintain Role Dependency

[schwoerb]

I am wondering if anyone has built a good way to maintain role dependency for Role and Resource requests.

Specifically I am trying to setup a way to ensure that when a person looses one role that self service (and approved) requested roles and resources, that are dependent on that role, start a workflow to remove dependent role and resources.

As an example, people in DeptA have a role by virtue of job data being in HR. They request access and are approved for additional roles (DeptA-RoleX) and services (DeptA-App42) based upon their job duties. When they take a new job in DeptB and loose the role for DeptA, that this starts a workflow to remove their DeptA-RoleX and DeptA-App42.

Thanks

Brad

[klasen]

Hi Brad,

On 2018-09-27 17:44, schwoerb wrote:
>
> I am wondering if anyone has built a good way to maintain role
> dependency for Role and Resource requests.
>
> Specifically I am trying to setup a way to ensure that when a person
> looses one role that self service (and approved) requested roles and
> resources, that are dependent on that role, start a workflow to remove
> dependent role and resources.
>
> As an example, people in DeptA have a role by virtue of job data being
> in HR. They request access and are approved for additional roles
> (DeptA-RoleX) and services (DeptA-App42) based upon their job duties.
> When they take a new job in DeptB and loose the role for DeptA, that
> this starts a workflow to remove their DeptA-RoleX and DeptA-App42.

You can attach meta-data to roles, e.g. add categories such as
"department-DeptA" or put them in hierarchical roleDefs containers. Then
in a loop-back driver, start a request to remove additional roles that
relate to DeptA if the DeptA role is removed.


--
Norbert

[geoffc]

On 9/28/2018 4:47 AM, Norbert Klasen wrote:
> Hi Brad,
>
> On 2018-09-27 17:44, schwoerb wrote:
>>
>> I am wondering if anyone has built a good way to maintain role
>> dependency for Role and Resource requests.
>>
>> Specifically I am trying to setup a way to ensure that when a person
>> looses one role that self service (and approved) requested roles and
>> resources, that are dependent on that role, start a workflow to remove
>> dependent role and resources.
>>
>> As an example, people in DeptA have a role by virtue of job data being
>> in HR.  They request access and are approved for additional roles
>> (DeptA-RoleX) and services (DeptA-App42) based upon their job duties.
>> When they take a new job in DeptB and loose the role for DeptA, that
>> this starts a workflow to remove their DeptA-RoleX and DeptA-App42.
>
> You can attach meta-data to roles, e.g. add categories such as
> "department-DeptA" or put them in hierarchical roleDefs containers. Then
> in a loop-back driver, start a request to remove additional roles that
> relate to DeptA if the DeptA role is removed.

I think the point is, UA/RBPM by itself does not really support this use
case, directly. You would need logic in a driver to do the work.