Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
devel:documentation:role_attributes [2019/01/15 15:41]
svandav [Using on the role request] 		devel:documentation:role_attributes [2019/04/16 08:07] (current)
svandav
Line 2: Line 2:
  
 ====== Attributes of role ====== ====== Attributes of role ======
-{{tag>role attributes}} +{{tag>role attributes parameters assigned parametrization}}
-===== What are an attributes of role? ===== +
-Role attributes define what additional information can (must) be filled in the user's assigned role. A typical example can be the IP address of a user's end station, which must be filled in in a role assignment request.+
  
-Definitions of which attributes are to be filled for the role are managed on the role detail (role attributes tab). Here, you define not only what attributes to show in the request, but also their default values and validation settings. This definition is part of the role approval (off by default).+===== What are role attributes ===== 
 +**Role attributes determine** what additional information **can (must)** be filled in a user's **assigned role**. A typical example can be the **IP address** of a user's end station, which must be filled in a role assignment request.
  
 +The **definitions of what attributes** are to be filled for the role are managed on the **role detail** (role attributes tab). Here, you define not only what attributes to show in the request, but also their **default values** and **validation settings**. This definition is part of the **role approval** process (off by default).
 +
 +
 +===== How it works =====
  
-===== How it works? ===== 
 ==== Definition ==== ==== Definition ====
-First, you need to **create main definition** of all attributes witch could be used in role **sub-definition**. **Main form definition** can be created in **Form definitions** agenda. +First, you need to **create the main definition** of all attributes which could be used in role **sub-definition**. The **main form definition** can be created in the **Form definitions** agenda. 
-<note>Attribute from the **main definition** can be used multiple times in multiple roles.</note>+<note>Attributes from the **main definition** can be used multiple times in multiple roles.</note>
 <note tip>**Main definition** must be created for type **IdmIdentityRole**.</note> <note tip>**Main definition** must be created for type **IdmIdentityRole**.</note>
 +<note important>**Now isn't supported **confidential** and **attachment** attributes!**</note>
  
 Then, you need to **create sub-definition** of attributes witch should be filled in requesting a role.  Then, you need to **create sub-definition** of attributes witch should be filled in requesting a role. 
Line 36: Line 39:
 {{ :devel:documentation:request-add-detail.png |}} {{ :devel:documentation:request-add-detail.png |}}
  
-<note important>Form with role's attributes is rendered only if **one role is selectes**! If are selectes more roles on the detail, then user **cannot fill the attribute's values** directly. In this case user can create role-concepts for more roles and then editing the values of attributes for each concept **one by one**. </note>+<note important>Form with role's attributes is rendered only if **one role is selected**! If are selected more roles on the detail, then user **cannot fill the attribute's values** directly. In this case user can create role-concepts for more roles and then editing the values of attributes for each concept **one by one**. </note>
  
 **If you add multiple roles** in one request and some from this roles will have **required attribute** (without default value), then will be created concept **not valid**. In this case you will see **warning icon** on the unvalid concept. **If you add multiple roles** in one request and some from this roles will have **required attribute** (without default value), then will be created concept **not valid**. In this case you will see **warning icon** on the unvalid concept.
Line 49: Line 52:
  
 {{ :devel:documentation:request-task-detail.png |}} {{ :devel:documentation:request-task-detail.png |}}
-==== Provisioning of assigned roles ====+ 
 +Upon successful **completion of the request**, the resulting concept role attributes are **copied** to the **assigned role** (**IdmIdentityRole**). Attributes assigned to roles can be displayed on the **identity detail** (**Roles** -> **detail** -> Tab "**Role's attributes**"). 
 + 
 +{{ :devel:documentation:identity-role-attributes-detail.png |}}  
 + 
 +===== Provisioning of assigned roles =====
 For the purpose of provisioning assigned roles, new attributes (**User assigned roles** and **User assigned roles (for this system)**) were created, which can be used in system mapping for provisioning identities. For the purpose of provisioning assigned roles, new attributes (**User assigned roles** and **User assigned roles (for this system)**) were created, which can be used in system mapping for provisioning identities.
 Input of the transformation into the system is a list of valid assigned identity roles. This assignment is represented by the ** AssignedRoleDto ** object, which mirrors the object ** IdmIdentityRoleDto ** and tries to simplify the work with assigned roles in the transform. This simplification is primarily based on the fact that the object contains the entire DTO (role, identityContract, ...) instead of the UUID and mainly contains a **map of all the attributes of the assigned role** (where the key is the attribute code and the value is a list of all attribute values). Input of the transformation into the system is a list of valid assigned identity roles. This assignment is represented by the ** AssignedRoleDto ** object, which mirrors the object ** IdmIdentityRoleDto ** and tries to simplify the work with assigned roles in the transform. This simplification is primarily based on the fact that the object contains the entire DTO (role, identityContract, ...) instead of the UUID and mainly contains a **map of all the attributes of the assigned role** (where the key is the attribute code and the value is a list of all attribute values).
Line 81: Line 89:
 </code> </code>
  
-====== Read more ====== 
- 
-===== Devel guide ===== 
  
-===== Limitations =====+===== Admin guide (to be completed)===== 
 +  * [[.attributes:adm:attributes|Role attributes]]
  • by svandav