Request access
|
Since 4.6
This functionality is available since version 4.6.
|
Request access functionality is a complete rewrite and redesign of midPoint role requesting UI.
New UI takes form of proper wizard with up to four steps:
-
Person of interest
-
Relation
-
Role catalog
-
Shopping cart (checkout)
First two steps may be hidden, or skipped based on configuration or authorizations of user that is currently logged in.
Configuration and some examples can be found here.
Person of interest
Figure 1. Person of interest
First step of request access wizard allows user to choose one or more users for whom new roles will be requested. There are two type of tiles:
-
Myself - to select user currently logged in
-
Group - defined by collection or query filter. Group allow to select one or more users via autocomplete text field or by clicking Select manually button.
Figure 2. Selection from group of users
Figure 3. Manual selection from group of users
Figure 4. User selected
If user can request only for himself then this step is not visible (and skipped).
Relation
Figure 5. Person of interest
Second step of wizard requires user to choose relation which will be used for new roles. List of relations is based on static relations and relations defined in system configuration. Default set of relations is:
-
Default
-
Manager
-
Approver
-
Owner
Set of relations, their label and icon can be configured, see Relations and Configuration.
If there’s only one relation to be selected, then this step is not visible (and skipped).
|
If relations are handled only implicitly via authorizations, then relation step will be visible at least when wizard is initialized. Reason for this is that until user selects at least one user (person of interest), midpoint is not able to compute available relation list and therefore can’t decide whether relation step can be hidden. In case relation step should be hidden at all times, please configure |
Role catalog
Figure 6. Role catalog
Role catalog displays roles (also organizations and services) that can be assigned to list of users defined earlier. Catalog can be currently displayed in two ways:
-
Tiles (picture above)
-
Table (see picture below)
Figure 7. Role catalog in table
Both types of view can be enabled or disabled via configuration. Menu in role catalog consists of 3 types of items also defined in configuration:
-
Role catalog defined via org. structure
-
Collections of objects
-
Roles of teammate
Role catalog
Role catalog is defined via reference to organization tree. Org. tree is then used to load hierarchical menu (up to 3 levels), all roles on deeper levels are shown in that 3rd level menu. Assignable roles have to be part of this org. tree.
Collection of objects
Collection of objects can be used to create custom menu item representing specific set of object via reference to object collection or using query filter.
Roles of teammate
This is custom menu item that uses search for another user and list his assignments. Roles of teammate option can be disabled via configuration.
Figure 8. Roles of teammate
Shopping cart (checkout)
Figure 9. Shopping cart (checkout)
Last step in request access wizard is checkout. In this step user can finalize whole request, review and solve conflicts if necessary. If configuration allows comment for this request can be added also with custom validity period for requested items. This can be done either globally for whole cart or for each item separately.
Conflict solver
Figure 10. List of conflicts
Figure 11. Solved conflicts
Figure 12. Edit shopping cart item