Bulk Role Assignment Widget

Definition

The Bulk Role Assignment Widget allows to assign one Role to several Identities.

This Widget is divided into two parts in order to:

search for Identities
assign Role to Identities

Tips

To access the Bulk Role Assignment Widget, you must configure the Widget on a Feature with an object kind set to ROLE.

To optimize the widget use, the best ways are to configure it in a dedicated Feature of type UI_FOR_OBJECT or in Widget To Open (avoid search Feature).

Use

Description

Examples

Identity Selection : a search form allows to customize how the user will be able to search for Identites.

Two search modes are available:

Upload a file with identifiers
Search Identities

Only searchable Attributes can be configured in this part.

A consistent list is displayed and the user can select Identities by clicking on the checkboxes next to each line.

Translations

The label "Select roles" can be configured with this I18N key: "tenant.ui.component.bulk-role-assignment.select-identities.label

Click on the Continue button to access the assign part.

Controls

If the requesting user is not allowed too see an attribute (the confidentiality of the attribute is greater than the confidentiality allowed for the user), the attribute will not be searchable and will not be displayed in the result colums.
If an Identity Constraint is configured on the Role Type, a no-entry sign is displayed next to the identites that match the constraint.
If SoD rules applies to the selected roles, a warn symbole is displayed next to the roles that match the constraint.
- Depending on the SoD type (WARN or FORBID), the role can be selected or not
- When clicking on the warn symbole, a pop up is displayed with information about the concerned SoD rule(s).

In the specific case of roles concerned by a SoD rule, after the click on the button a pop-up is displayed reminding the user of the SOD rules that are being applied.

For each rule, the user has the option to deselect one or several of the affected identity.

In WARN mode, it is possible to continue with the assignment by bypassing the SOD rule.
In FORBID role, it is mandatory to act on the selection to resolve the conflict and then proceed with the assignment.

Assign role : this part allows to assign the Role to the selected Identities.

If the first choosen identity matches the assignment validation rule (on dimension for example), and the following identities do not match to this rule, a pop-up opens with two parts: Valid Role Assignment and Invalid Role Assignment.
In this case, if you click on "Assign to valid Identities" button, the role is only assigned to the identity that matches the validation rule.

Display & Navigation

A Back button allows the user to return to the search part.

Translations

The label "Assign roles" can be configured with this I18N key: "tenant.ui.component.bulk-role-assignment.assign-roles.label".

Each dimension can be translated with these I18N keys:

ui.model.dimensions.<dimensionId>.name (in this case, all dimensions with the same id will be translated on all roles using it).
ui.model.roles.<roleId>.dimensions.<dimensionId>.name (in this case, only the dimension on a specific role will be translated).

Click on Assign button to validate the assignment of Role to the Identities.

Cart icon

The cart button is disabled if the cart is empty.
When a user chooses identities by clicking on checkboxes next to it, the cart icon will be updated with the number of selected Identity(ies).
The user can click on the "cart icon" button to display the selected Identity(ies).
The user can modify the selected Identity(ies) in the cart by clicking on the checkboxes and validate by clicking on the "Apply changes" button.

Validity dates

Validity dates can be:

optional if no rule is configured on it.
mandatory, pre-filled and/or subjected to validation if any rules have been configured on the concerned Role Type. An asterisk is displayed next to the field and a message is displayed below the validity date in orange and italic.

You cannot choose validity dates before today's date.
The validity dates have an impact on the Role Assignment.

When you adding an end date, the Role will be removed from the Identity one day after the chosen date.

The real date of deletion of the Role is visible when the mouse passes over the end date on the Role dashboard.

The goal is to delete the Role at the end of the last authorized day.

Start date	End date	Status	Impact
Not valued	Not valued	ASSIGNED	The Role is assigned directly.
Not valued	Valued (in the future)	ASSIGNED	The Role is assigned directly. The Role will be deleted when: the end date will have passed. the "RoleAssignmentsActivation" job must be executed.
Valued (in the future)	Not valued	DELAYED	The Role is not assigned because the start date has not passed. The Role will be assigned when: the start date will have passed. the "RoleAssignmentsActivation" job must be executed. The Role will never be deleted.
Valued (in the future)	Valued (in the future)	DELAYED	The Role is not assigned because the start date has not passed. The Role will be assigned when: the start date will have passed. the "RoleAssignmentsActivation" job must be executed. The Role will be deleted when: the end date will have passed the "RoleAssignmentsActivation" job must be executed.

Comment

The Comment is mandatory when assigning a Role to several Identities.

Configuration

Properties

Property name	Type	Mandatory	Description	Values (default value in bold)
bordered	`Boolean`	NO	Allows to display a border around the Widget.	true, false
title	`Boolean`	NO	Allows to define a title and a subtitle. Title and subtitle are defined in the following i18n keys: tenant.features.bulk-role-assignment.title.label tenant.features.bulk-role-assignment.subtitle.label	true, false
scope	Dynamic Object Scope	YES	Allows to limit the search results.	-
fields	`List<FieldEditorWidget>`	NO	Allows you to configure field editors to be displayed (see Field Editors) These fields will be accessible when evaluating Role Request Policies and in workflows	-
search	`Object`	YES	Same configuration as for a SearchWidget. <rowClickActions> and <allowExport> tags are not applicable for this Widget.	-

fields Properties

Properties name

Type

Mandatory

Description

Values (default value in bold)

field

FieldEditorWidget

NO

Allows you to configure field editors to be displayed (see Field Editors)

These fields will be accessible when evaluating Role Request Policies and in workflows

-

Example

XML

<columns>
	<column>
		<widgets>
			<widget id="BulkRoleAssignment" xsi:type="ctdbum:BulkRoleAssignmentWidgetType">
				<hidden>false</hidden>
				<displayOptions>
					<modalSize>LG</modalSize>
				</displayOptions>
				<config>
					<bordered>true</bordered>
					<title>true</title>
					<scope type="EXPRESSION" objectKind="IDENTITY">
						<searchExpression/>
						<objectTypes>
							<objectType>Employee</objectType>
						</objectTypes>
					</scope>
					<fields>
                        <field id="fieldTargetId">
                            <hidden>false</hidden>
                            <config>
                                <editor>
                                    <editWidget xsi:type="ctdbum:TextInputEditWidgetType">
                                        <hidden>false</hidden>
                                        <config>
                                            <required>true</required>
                                            <type>text</type>
                                        </config>
                                    </editWidget>
                                </editor>
                                <label></label>
                                <lockedInUi>false</lockedInUi>
                                <mode>READ_WRITE</mode>
                                <multiValued>false</multiValued>
                            </config>
                            <fieldId>fieldTargetId</fieldId>
                        </field>
                    </fields>
					<search>
						<actions/>
						<allowExport>false</allowExport>
						<columns>
							<column>
								<attribute>true</attribute>
								<dataKey>id</dataKey>
								<dataType>string</dataType>
								<dateFormat>DAY_MONTH_YEAR_LONG</dateFormat>
								<ellipsis>false</ellipsis>
								<hidden>false</hidden>
								<sortAs>ALPHA</sortAs>
								<sortDirection>ASC</sortDirection>
								<sortable>true</sortable>
								<sorted>false</sorted>
								<type>general</type>
							</column>
							<column>
								<attribute>true</attribute>
								<dataKey>firstName</dataKey>
								<dataType>string</dataType>
								<dateFormat>DAY_MONTH_YEAR_LONG</dateFormat>
								<ellipsis>false</ellipsis>
								<hidden>false</hidden>
								<sortAs>ALPHA</sortAs>
								<sortDirection>ASC</sortDirection>
								<sortable>true</sortable>
								<sorted>false</sorted>
								<type>general</type>
							</column>
							<column>
								<attribute>true</attribute>
								<dataKey>lastName</dataKey>
								<dataType>string</dataType>
								<dateFormat>DAY_MONTH_YEAR_LONG</dateFormat>
								<ellipsis>false</ellipsis>
								<hidden>false</hidden>
								<sortAs>ALPHA</sortAs>
								<sortDirection>ASC</sortDirection>
								<sortable>true</sortable>
								<sorted>false</sorted>
								<type>general</type>
							</column>
							<column>
								<attribute>true</attribute>
								<dataKey>securityOrganization</dataKey>
								<dataType>string</dataType>
								<dateFormat>DAY_MONTH_YEAR_LONG</dateFormat>
								<ellipsis>false</ellipsis>
								<hidden>false</hidden>
								<sortAs>ALPHA</sortAs>
								<sortDirection>ASC</sortDirection>
								<sortable>true</sortable>
								<sorted>false</sorted>
								<type>general</type>
							</column>
						</columns>
						<rowClickActions/>
						<additionalSearchAttributes/>
						<displayFrozenOperators>true</displayFrozenOperators>
						<frozen>NO</frozen>
						<modes>
							<mode>MULTICRITERIA</mode>
							<mode>SIMPLE</mode>
						</modes>
						<objectReferences/>
						<searchExpression>
							<search:And>
								<search:Prop op="IS_NOT_NULL" name="id"/>
								<search:Prop op="EQUALS" name="firstName"/>
								<search:Prop op="EQUALS" name="lastName"/>
							</search:And>
						</searchExpression>
					</search>
				</config>
			</widget>
		</widgets>
	</column>
</columns>