Skip to main content
Version: 10.3.2

Migrate from qualifications to ACL

The Work.AI platform no longer supports qualifications. Instead, Workspace employs an approach to managing user permissions and restrictions, where:

  • Each assignment has its owner and an ACL (Access Control List).
  • ACL is based on users and user groups managed via WorkFusion User Management. The WorkFusion User Management system is built on top of Keycloak.

The approach allows Business Processes (BPs) and assignment data to be securely restricted only to users who are allowed to access the data and complete the assignment.

Migrate qualifications to Workspace​

If your Business Processes use qualifications and you want to move these BPs to Workspace together with the qualifications, you need to complete the following steps:

  1. Make sure you have the platform v10.2+ deployed, and your users are migrated to WorkFusion User Management. For the migration, use the built-in Identity Brokering and User Federation features or create users manually.

  2. Configure user groups in WorkFusion User Management.

  3. Configure a Manual Task in Control Tower.

Configure user groups in User Management​

The configuration flow is as follows:

  1. Log in to WorkFusion User Management and create user groups to match your qualifications. Name the created user groups the same way you used to name the qualifications.

  2. Add users to the created user groups.

Configure Manual Task in Control Tower​

Control Tower utilizes the Workspace API to set access to assignments via the Workspace preview mechanism, which requires using a system attribute—for example, _sys_user_groups. To set the attribute, complete the following steps:

  1. Configure a field scheme:

    1. Go to System Settings > Field Schemes. Click Create Field Scheme.

    1. Enter the name of the scheme you want to use. Click Add answer.

    1. Set the Answer type field to Free Text and the Unique Code field to _sys_user_groups. Click Save Answer.

  2. Add a _sys_user_groups column to your input data file. Write a group with a slash, for example, /your user group.

  3. To map the column to the Field scheme field, go to the Workspace preview tab, choose the scheme you created, and click Save.

note

Instead of creating a field scheme, you can update an existing one. For more information, refer to the Check migration use case section.

When everything is set as described above, your BP creates assignments in Workspace with access based on the user groups configured in User Management.

Check migration use case​

The use case below illustrates the migration from qualifications to ACL under the following assumptions:

  • You have 2 BPs. BP1 has one Manual Task (MT), BP2 has two MTs.
  • MT1 has Qualification 1 Requirement, MT2 has Qualification 2 and 3 Requirement, MT3 has the Qualification 3 Requirement.
  • You have 5 workers: worker 1 has no Qualifications, worker 2 has Qualification 1, worker 3 has Qualifications 2 and 3, worker 4 has Qualification 3, worker 5 has Qualification 2.
  • You have the platform v10.2+ deployed, and the workers are migrated to User Management and available as User Management users.
note

For migrating users to WorkFusion User Management, use its built-in Identity Brokering and User Federation features or create users manually.

The general migration flow is to create groups in User Management to match the Qualifications, distribute the workers across the groups based on their Qualifications, and configure the Manual Tasks related to the migrated BPs in CT.

Create groups in User Management​

Log in to WorkFusion User Management under the Admin account and create three user groups with the names Qual_1, Qual_2, Qual_3 following the instruction:

  1. On the left menu, select Groups and click Create group.

  2. In the Create a group dialog, type the group name, for example, Qual_1, and click Create. The created group appears in the hierarchical structure on the right.

  3. Repeat steps 1 and 2 to create two more groups. Name them Qual_2 and Qual_3.

Distribute workers across User Management groups​

Considering the above assumptions, distribute workers—who are User Management users now—across the created groups as follows:

  • Add worker 2 to the Qual_1 group.
  • Add worker 3 to the Qual_2 and Qual_3 groups.
  • Add worker 4 to the Qual_3 group.
  • Аdd worker 5 to the Qual_2 group.
  • Worker 1 does not belong to any group based on qualifications.

To add workers to the created user groups, follow the steps below:

  1. Log in to User Management. On the left menu, click Users and find your worker in the User list on the right. You can search by name, for example, John Doe.

  2. Click Edit next to the user's name.

  3. Go to the Groups tab. In the Available groups section, select the required group, and click Join.

The Group Membership section updates accordingly.

Configure Manual Tasks in Control Tower​

  1. Edit the existing field scheme for the MT in BP1:

    1. Double-click the MT in the BP1 workflow. Then, go to the Workspace preview tab and click the Edit Scheme button.

    1. In the Edit Field Scheme dialog, click Add Answer.

    1. Set the Answer type field to the Free Text type and the Unique Code field to _sys_user_groups. Click Save answer.

  2. Add a _sys_user_groups column to your input data file for the Manual Task.

  3. To map the column to the field scheme, go back to the Workspace preview tab. Select _sys_user_groups in Data Elements and click Save.

  4. To configure MT1 and MT3, edit the existing field schemes for the tasks and complete steps 1 to 3.

Alternatively, you can create field schemes as described in Configure Manual Task in Control Tower.

troubleshooting

For troubleshooting guides, refer to the following support guides: