Table of Contents

Automatic contract guarantee reassignment transfer

The feature is NOT RELEASED and documentation is a DRAFT

Certain identities are required to always have guarantors on each of their contracts. This feature ensures that this is maintained. When the last active guarantor of a contract is deactivated or deleted, a new guarantor (or several guarantors) resolved by a configurable script is assigned to the contract. The deactivated guarantor is then removed as a guarantor of that contract, i.e. it WILL NOT automatically be a guarantor of that contract again if reactivated.

This feature only works in the time of the event of the guarantor's deactivation or deletion. It will not reassign guarantors to contracts if their past guarantors were deactivated before the feature was deployed. To assign guarantors to those contracts, a schedulable task is provided.
The reassignment runs asynchronously - the result is only visible when once the event is processed. When deactivating a user with many subordinates, this may take some time

Which contracts does this apply to

There is a configuration item idm.sec.core.contract-guarantee.externistFormProjections that contains a comma-separated list of form projection codes that determine which identities need their contracts to be guaranteed by someone. The feature then guards all contracts that belong to those identities.

How does the feature check managers

The feature uses the configured managersFor filter set in the configuration item idm.sec.core.filter.IdmIdentity.managersFor.impl. The most common values are guaranteeManagersFilter (managers are direct guarantees only) and defaultManagersFilter (both direct guarantees and guarantees over tree structure are managers)

When does the reassignment happen

Direct guarantor removal

Direct guarantor removal and reassignment is triggered when the guarantor identity is deleted or deactivated, either manually or due to contract expiration/deactivation/deletion. It does NOT happen when the IdmContractGuarantee object itself is deleted or changed - that can only happen during manual removal of the guarantor done deliberately by an administrator.

During contract synchronization from a system, it can happen that all of an identity's contracts are deactivated but the identity itself stays active until the HR processes run