Skip to main content
Version: 10.3

Configure access control list

Access control list (ACL) specifies which users are granted access to objects and what operations are allowed on given objects. For Workspace, ACL-based approach is used by providing an access control mechanism where each assignment has its owner and ACL.

Workspace limits access to assignments based on user groups in WorkFusion User Management, thus allowing Business Processes and assignment data to be securely restricted only to users who are authorized to access and complete the assignment.

The diagram below illustrates the interaction of the Workspace ACL components:

Dynamic user group configuration is based on business attributes in input data or Data Store.

The procedure for obtaining the list of assignments is as follows:

note

All other operations with assignments use similar logic.

Grouping in WorkFusion User Management​

Groups in WorkFusion User management allow you to manage a common set of attributes and role mappings for a set of users. Thus, you restrict tasks to users who are allowed to access them to complete. These users can be members of zero or more groups.

In Control Tower, you can provide access to user groups for each Manual Task in input data. Tasks with no groups defined are available for all users.

Groups may contain subgroups. Tasks of children groups will be available for users from the parent group. Meanwhile, users from a child group are able to see tasks of the child group only.

Let's say we have the following group hierarchy:

  • Portugal
    • Finance
  • France
    • Marketing
    • Finance

and three users:

  • User 1 belongs to the Portugal group and the Marketing subgroup within the France group
  • User 2 belongs to the France group and the Finance subgroup in the Portugal group
  • User 3 does not belong to any group

For example, you create the following tasks in Control Tower:

  • Task 1 for the Finance subgroup in the Portugal group
  • Task 2 for the Marketing subgroup in the France group
  • Task 3 for the France group
  • Task 4 for the Finance subgroup in both the Portugal and France groups
  • Task 5 with no group

In this case, the availability matrix looks like this.

UserTask 1Task 2Task 3Task 4Task 5
User 1++-++
User 2+++++
User 3----+

Setup in User Management​

note

Steps mentioned below are for local use only. The installer has already set them up.

General settings​

  1. Sign in to User Management as the Administrator user.

  2. Go to the Clients tab and select wf-workspace.

  3. On the Settings tab, check the Service Account Enabled property. Do not forget to click Save.

  4. As soon as Service Account Enabled is on, the Service Account Roles tab becomes available. Go to Service Account Roles and start typing realm in the Client Roles field until realm-management becomes visible.

  5. Select realm-management. A new section containing Available Roles appears.

  6. Select the view-users role and click the Add button.

    The role is moved to the Assigned Roles section and role mappings are updated.

  7. Go to the Mappers tab and click Create.

  8. In the Create Protocol Mapper, create a mapper with the following values:

    • Name: User Groups
    • Mapper Type: Group Membership
    • Token Claim Name: groups

  9. Enable all toggles and click Save.

Create groups​

  1. Sign in to Keycloak and select the Groups tab in the Manage section.

  2. To create a group, click the New button. In the Create group dialog, enter a group name and click Save.

Groups have a hierarchical structure. You can add one group within another. If you want to add a child to a group, select a parent group and click New.

tip

For more information on User Management groups, refer to User Management | Create groups.

Add users to group​

  1. Log in to User Management, go to Users, find the user, and click Edit.

  2. Go to the Groups tab > Available Groups. Select a group and click Join to add a user to the group.

    The Group Membership section updates accordingly.

  3. To view users in the group, go to Groups, select a group, and click Edit. On the Members tab, there is the list of group users.

tip

For more details on user group configuration, refer to User Management | Configure users.

Setup in Control Tower​

Control Tower uses the Workspace API to manage access to assignments via the Workspace Preview mechanism. It can be some system attribute, for example, _sys_user_groups.

There are several ways to set _sys_user_groups in Control Tower:

  • Сonfigure a Manual Task in Workspace preview manually.
  • Сonfigure user groups dynamically based on user group attributes from a source (input data or a data source).
note

You can configure user groups dynamically using business attributes from a source and user group attributes from User Management. The source can be an input data file or a Data Store. For details, refer to User Management | Create groups.

Create attribute​

User group information must be sent in the _sys_user_groups attribute in the input data.

  1. To create an attribute, go to System Settings > Field Schemes.

  2. Click Create Field Scheme and enter the name of the scheme you want to use.

  3. Add an answer of the Free Text type with the _sys_user_groups name. Click Save.

    info

    Field schemes are also used for the attribute feature. If you already have a scheme in use, update it instead of creating a new one. See more in Set up filter attribute.

  4. After creating a Manual Task, double-click it in the Business Process flow. Go to the Worspace preview tab, select the scheme you created, and click Save.

Syntax​

A task can be available to multiple groups. To define it, use comma (,). Group hierarchy is defined with a slash (/).

The group path must be set from the root. For example, if you want tasks to be available to the Finance subgroups within the France and Portugal groups, configure it as /EMEA/France/Finance,/EMEA/Portugal/Finance.

troubleshooting

For troubleshooting guides, refer to the following support guides: