The extras module contains additional workflows, which can be used for the approval of role assignment. If you are not familiar with the approval process, please read Approval of role assignment and Role assignment - approval process configuration.
Some of the approval workflows make use of the Role authorizer type. You will use this typically in the cases, if you want to have 2 distinct approvers (or group of approvers) and you want for both of them to approve the assignment of the role. The approval process creates the approval task first for the authorizers in the first group (type A). After approving, then an approval task is created for the authorizers in the second group (type B).
Create the code list (Settings → Code lists) with the code guarantee-type (if it doesn't exist).
Create two items in this code list - you can use e.g. "guaranteeTypeA" and "guaranteeTypeB".
Set the desired approval workflow for the role priority level (criticality) which you want to use (1-4) in the application configuration. Example:
Set the configuration properties for worflows:
Finally, set the desired priority level for the selected roles and specify the role authorizers. When adding a new authorizer, you will always select its type from the above mentioned code list.
import eu.bcvsolutions.idm.core.api.dto.IdmIdentityDto;
List<IdmIdentityDto> candidates = new ArrayList<IdmIdentityDto>();
candidates.add(identityService.getByUsername("user_for_approval"));
return candidates;
The script must return List of IdmIdentityDto.