Skip to main content
Version: 10.3.1

Configure access control list

An access control list (ACL) is a list that shows which users can see certain items and what they can do with them. For Workspace, ACL is used to control access, with each assignment having an owner and its own ACL restrictions.

Workspace limits access to assignments based on user groups in WorkFusion User Management. This allows Business Processes and assignment data to be securely restricted to authorized users. The following sections explain how the ACL mechanism is applied and configured.

The diagram below illustrates the interaction of the Workspace ACL components:

Dynamic user group configuration is based on business attributes in input data or Data Store.

The procedure for obtaining the list of assignments is as follows:

note

All other operations with assignments use similar logic.

Grouping in WorkFusion User Management​

Groups in WorkFusion User Management let you set common rules and roles for groups of users. This way, you make sure only certain users can work on certain tasks. A user can belong to more than one group or none at all.

In Control Tower, you can give user groups access to each Manual Task using the input data. If a task has no group defined, any user can access it.

Groups may contain subgroups (child groups). Tasks of child groups are available for users from the parent group. Meanwhile, users from a child group are able to see tasks of the child group only.

Let's say we have the following group hierarchy:

  • Portugal
    • Finance
  • France
    • Marketing
    • Finance

and three users:

  • User 1 belongs to the Portugal group and the Marketing subgroup within the France group
  • User 2 belongs to the France group and the Finance subgroup in the Portugal group
  • User 3 does not belong to any group

For example, you create the following tasks in Control Tower:

  • Task 1 for the Finance subgroup in the Portugal group
  • Task 2 for the Marketing subgroup in the France group
  • Task 3 for the France group
  • Task 4 for the Finance subgroup in both the Portugal and France groups
  • Task 5 with no group

In this case, the availability matrix looks like this.

UserTask 1Task 2Task 3Task 4Task 5
User 1++-++
User 2+++++
User 3----+

Setup in User Management​

note

Steps mentioned in the sections below are for local use only. The installer has already set them up.

General settings​

  1. Sign in to User Management as the Administrator user.

  2. Go to the Clients tab and click the wf-workspace client name.

  3. On the Settings tab, navigate to the Capability config section, select the Service accounts roles checkbox, and click Save.

  4. Go to the Service accounts roles tab, click Assign role, and select the Client roles option.

  5. In the search box, type in realm-management and press Enter.

  6. In the search results, select the view-users role and click the Assign button. The role is added to the list of roles on the Client details page.

Create groups​

  1. In the Manage section on the left menu, select the Groups tab.

  2. To create a group, click the Create group button. In the Create a group dialog, enter a group name and click Create.

Groups have a hierarchical structure. You can add one group within another. To add a child to a group, select a parent group and, on the Child groups tab, click Create group.

tip

For more information on User Management groups, refer to User Management | Create groups.

Add users to group​

  1. Log in to User Management, go to Users, find the user you want to add to the created group, and click their name in the list.

  2. Go to the Groups tab and click Join Group.

  3. Select a group in the list and click Join.

  4. To view the users in a group, go to Groups and click the group name in the list. On the Members tab, there is the list of the users in the group.

tip

For more details on user group configuration, refer to User Management | Create groups.

Setup in Control Tower​

Control Tower uses the Workspace API to manage access to assignments via the Workspace Preview mechanism. It can be some system attribute, for example, _sys_user_groups.

There are several ways to set _sys_user_groups in Control Tower:

  • Сonfigure a Manual Task in Workspace preview manually.
  • Сonfigure user groups dynamically based on user group attributes from a source (input data or a data source).
note

You can configure user groups dynamically using business attributes from a source and user group attributes from User Management. The source can be an input data file or a Data Store. For details, refer to User Management | Create groups.

Create attribute​

User group information must be sent in the _sys_user_groups attribute in the input data.

  1. To create an attribute, go to System Settings > Field Schemes.

  2. Click Create Field Scheme and enter the name of the scheme you want to use.

  3. Add an answer of the Free Text type with the _sys_user_groups name. Click Save.

    info

    Field schemes are also used for the attribute feature. If you already have a scheme in use, update it instead of creating a new one. See more in Set up filter attribute.

  4. After creating a Manual Task, double-click it in the Business Process flow. Go to the Worspace preview tab, select the scheme you created, and click Save.

Syntax​

A task can be available to multiple groups. To define it, use comma (,). Group hierarchy is defined with a slash (/).

The group path must be set from the root. For example, if you want tasks to be available to the Finance subgroups within the France and Portugal groups, configure it as /EMEA/France/Finance,/EMEA/Portugal/Finance.

troubleshooting

For troubleshooting guides, refer to the following support guides: