Configuring a Deprovision activity
A Deprovision activity is intended to apply the Active Roles deprovisioning policies to a particular user or group. This activity causes Active Roles to perform all the tasks prescribed by the deprovisioning policies, thereby deprovisioning the user or group.
When you configure a Deprovision activity, you can specify the rules for selecting the user or group you want the activity to deprovision. Additional options are available such as notification, error handling, and “Run as” options.
To configure a Deprovision activity
-
In the Active Roles Console tree, expand Configuration > Policies > Workflow, and select the workflow containing the Deprovision activity you want to configure.
This opens the Workflow Designer in the Details pane, representing the workflow definition as a process diagram.
-
In the process diagram, right-click the name of the activity and click Properties.
-
Go to the Activity target tab in the “Deprovision” Activity Properties dialog.
-
Click in the Activity performs the operation on this object box to specify the user or group you want the activity to deprovision. This object is referred to as activity target. You can choose from the following options to specify the activity target:
-
Fixed object in directory: The activity target is the given object. You can select the desired object in Active Directory when you configure the Deprovision activity.
-
Object identified by workflow parameter: The activity target is the object specified by the value of a certain parameter of the workflow. You can choose the desired parameter from the workflow definition when you configure the Deprovision activity.
-
Object from workflow data context: The activity target is selected by the activity on the basis of the data found in the workflow environment at the time of running the workflow. When configuring the Deprovision activity, you can specify which object you want the activity to select at workflow run time.
-
Object identified by DN-value rule expression: The Distinguished Name (DN) of the activity target is specified by the string value of a certain rule expression. By using a rule expression, you can compose a string value based on properties of various objects found in the workflow environment at the time of executing the workflow. You can create the desired rule expression when you configure the Deprovision activity.
- View or change notification settings. For more information, see Configuring a notification for a CRUD activity.
- View or change error handling settings. For more information, see Configuring error handling for a CRUD activity.
- View or change the "Run as" options. For more information, see Configuring “Run as” options for a CRUD activity.
- View or change additional settings. For more information, see Configuring additional settings for a CRUD activity.
Configuring an Undo deprovision activity
An Undo deprovision activity is intended to restore a particular user or group that was deprovisioned by using Active Roles. The activity causes Active Roles to roll back the changes that were made to the user or group object by applying the Active Roles deprovisioning policies. As a result, the object reverts to the state it was in before the deprovisioning-related changes were made.
When you configure an Undo deprovision activity, you can specify the rules for selecting the user or group you want the activity to restore. Additional options are available such as notification, error handling, and “Run as” options.
To configure an Undo deprovision activity
-
In the Active Roles Console tree, expand Configuration > Policies > Workflow, and select the workflow containing the Undo deprovision activity you want to configure.
This opens the Workflow Designer in the Details pane, representing the workflow definition as a process diagram.
-
In the process diagram, right-click the name of the activity and click Properties.
-
Go to the Activity target tab in the “Undo Deprovision” Activity Properties dialog.
-
Click in the Activity performs the operation on this object box to specify the user or group you want the activity to restore. This object is referred to as activity target. You can choose from the following options to specify the activity target:
-
Fixed object in directory: The activity target is the given object. You can select the desired object in Active Directory when you configure the Undo deprovision activity.
-
Object identified by workflow parameter: The activity target is the object specified by the value of a certain parameter of the workflow. You can choose the desired parameter from the workflow definition when you configure the Undo deprovision activity.
-
Object from workflow data context: The activity target is selected by the activity on the basis of the data found in the workflow environment at the time of executing the workflow. When configuring the Undo deprovision activity, you can specify which object you want the activity to select at workflow run time.
-
Object identified by DN-value rule expression: The Distinguished Name (DN) of the activity target is specified by the string value of a certain rule expression. By using a rule expression, you can compose a string value based on properties of various objects found in the workflow environment at the time of running the workflow. You can create the desired rule expression when you configure the Undo deprovision activity.
- View or change notification settings. For more information, see Configuring a notification for a CRUD activity.
- View or change error handling settings. For more information, see Configuring error handling for a CRUD activity.
- View or change the "Run as" options. For more information, see Configuring “Run as” options for a CRUD activity.
- View or change additional settings. For more information, see Configuring additional settings for a CRUD activity.
Configuring a Delete activity
When you configure a Delete activity, you can specify the rules for selecting the object you want the activity to delete in Active Directory. Additional options are available such as notification, error handling, and “Run as” options.
To configure a Delete activity
-
In the Active Roles Console tree, expand Configuration > Policies > Workflow, and select the workflow containing the Delete activity you want to configure.
This opens the Workflow Designer in the Details pane, representing the workflow definition as a process diagram.
-
In the process diagram, right-click the name of the activity and click Properties.
-
Go to the Activity target tab in the “Delete” Activity Properties dialog.
-
Click in the Activity performs the operation on this object box to specify the object you want the activity to delete. This object is referred to as activity target. You can choose from the following options to specify the activity target:
-
Fixed object in directory: The activity target is the given object. You can select the desired object in Active Directory when you configure the Delete activity.
-
Object identified by workflow parameter: The activity target is the object specified by the value of a certain parameter of the workflow. You can choose the desired parameter from the workflow definition when you configure the Delete activity.
-
Object from workflow data context: The activity target is selected by the activity on the basis of the data found in the workflow environment at the time of executing the workflow. When configuring the Delete activity, you can specify which object you want the activity to select at workflow run time.
-
Object identified by DN-value rule expression: The Distinguished Name (DN) of the activity target is specified by the string value of a certain rule expression. By using a rule expression, you can compose a string value based on properties of various objects found in the workflow environment at the time of executing the workflow. You can create the desired rule expression when you configure the Delete activity.
- View or change notification settings. For more information, see Configuring a notification for a CRUD activity.
- View or change error handling settings. For more information, see Configuring error handling for a CRUD activity.
- View or change the "Run as" options. For more information, see Configuring “Run as” options for a CRUD activity.
- View or change additional settings. For more information, see Configuring additional settings for a CRUD activity.
Configuring a notification for a CRUD activity
You can configure a CRUD activity to subscribe recipients to the notifications of the following events:
-
Activity completed successfully: When configured to notify of this event, the activity causes Active Roles to send a notification email if no significant errors occurred during the run of this activity.
-
Activity encountered an error: When configured to notify of this event, the activity causes Active Roles to send a notification email if any significant errors occurred during the run of this activity.
To configure a notification for a CRUD activity
-
In the process diagram, right-click the name of the activity and click Properties.
-
Go to the Notification tab in the Properties dialog, and configure the notification settings. For more information, see Configuring a Notification activity.
The notification settings specify the event to notify of, and notification recipients. When initiated by the workflow, the activity prepares a notification message appropriate to the specified event. Active Roles retains the message prepared by the activity, and sends the message to the specified recipients upon occurrence of that event.