Where exactly is WorkMgr4 access role configured to allow user to perform other's assignments?
Hello,
When you create an application in UI-Kit, system creates two access roles - "Manager" and "User". "Manager" access role inherits from PegaRULES:WorkMgr4 and "User" access role inherits from PegaRULES:User. The difference is, Manager can perform other's assignments while User can only perform his own assignment.
My question here is, where exactly (which rule, in which class) this difference is controlled?
I want to understand the actual configuration, not Access Manager.
The reason I ask is, I just realized that in Cosmos application, system creates only one access role for end users - "User4" and it behaves like "User" in UI-Kit - user can only perform his own assignment, not other's.
However, most of my customers want to configure end user's access role like "Manager" so user can also perform other's assignments. I want to apply the same configuration used in old UI-Kit "Manager" access role.
Regards,
Accepted Solution
Updated: 13 Jul 2023 3:27 EDT
Masking Technology
NL
The rule canPerform on Assign-Worklist is your starting point. Pega checks this rule for every assignment that is opened from a work list. The OOTB version of it has a check on a privilege.
It's unreadable in the picture above, but when copied it reads: @pxCheckPrivilegeInWorkClass(myStepPage, "Perform")
So, everybody that has the privilege Perform on the work class can open an assignment on any work list. This privilege can be on the Work- level, or any other custom level if you have a custom role, i.e. MyCorp-ABC-Work.
The WorkMgr4 access role has a ARO defined on the Work- level. This contains the privilege the system is looking for.
When we look at the User4 role, we can see that it doesn't have this privilege.
The rule canPerform on Assign-Worklist is your starting point. Pega checks this rule for every assignment that is opened from a work list. The OOTB version of it has a check on a privilege.
It's unreadable in the picture above, but when copied it reads: @pxCheckPrivilegeInWorkClass(myStepPage, "Perform")
So, everybody that has the privilege Perform on the work class can open an assignment on any work list. This privilege can be on the Work- level, or any other custom level if you have a custom role, i.e. MyCorp-ABC-Work.
The WorkMgr4 access role has a ARO defined on the Work- level. This contains the privilege the system is looking for.
When we look at the User4 role, we can see that it doesn't have this privilege.
IT Solution Service
SG
@basmasking , @KenshoTsuchihashi
Thank you for the clear explanation! After understanding the mechanism, I was able to customize Sandbox:User4 in Cosmos so users can perform other's assignments.
Regards,
Updated: 13 Jul 2023 3:33 EDT
Pegasystems Inc.
JP
It is correct that WorkMgr4 can perform other's assignments, while User4 can't. Both access roles call the same Access When rule, called canPerform.
Below is the canPerform rule. If you look at A2 row, Perform privilege is checked.
@pxCheckPrivilegeInWorkClass(myStepPage, "Perform")
WorkMgr4 has this "Perform" privilege, and User4 doesn't. You can verify this in Privilege in Work- class of ARO as below.
- WorkMgr4
- User4
It is correct that WorkMgr4 can perform other's assignments, while User4 can't. Both access roles call the same Access When rule, called canPerform.
Below is the canPerform rule. If you look at A2 row, Perform privilege is checked.
@pxCheckPrivilegeInWorkClass(myStepPage, "Perform")
WorkMgr4 has this "Perform" privilege, and User4 doesn't. You can verify this in Privilege in Work- class of ARO as below.
- WorkMgr4
- User4
Now, if you want to customize auto-created User4 access role in Cosmos application in such a way that user can perform other's assignments, you can add "Perform" privilege in your Work class, shown as below.
This is the same effect as when you add "Peform" privilege from Access Manager.
Alternatively, you can replace dependent role from defaulted PegaRULES:User4 to PegaRULES:WorkMgr4 as below.
Or, you can also get rid of A2 row from canPerform Access When rule, but this is not recommended. If you modify this rule, careful attention should be paid.
Thanks,
IT Solution Service
SG
Thanks, and I have one more question.
Below is the screenshot with User4 operator. In UI-Kit, operator can at least see "Begin" button even if he doesn't have a privilege. When clicked, operator will see an error "You are not authorized to perform this assignment".
However, in Cosmos, when operator does not have a privilege, he can't even see a button (In Cosmos, "Go" button instead of "Begin" button), shown as below. Am I missing anything, or has product specification been changed recently?
Regards,
Pegasystems Inc.
JP
Your observation is correct. In UI-Kit, "Begin" button's visibility was simply configured as below:
!pyIsAssignmentResolved
This When rule checks pyAssignmentStatus only.
On the other hand, in Cosmos, "Go" button's visibility is configured as below:
pzCanPerformAssignment && (.pxAssignedOperatorID!='' || .pxAssignedUserName!='') && .pyAssignmentStatus!='' && .pyAssignmentStatus!='Completed' && pxThread.pzACName!='acsecondary'
This When rule now also checks operator's authorization by pzCanPerformAssignment RUF.
Your observation is correct. In UI-Kit, "Begin" button's visibility was simply configured as below:
!pyIsAssignmentResolved
This When rule checks pyAssignmentStatus only.
On the other hand, in Cosmos, "Go" button's visibility is configured as below:
pzCanPerformAssignment && (.pxAssignedOperatorID!='' || .pxAssignedUserName!='') && .pyAssignmentStatus!='' && .pyAssignmentStatus!='Completed' && pxThread.pzACName!='acsecondary'
This When rule now also checks operator's authorization by pzCanPerformAssignment RUF.
In a nutshell, in UI-Kit, the button was always displayed regardless of operator's accessibility to the assignment. This approach was okay because if true security is configured properly, system throws an exception anyways when button is clicked. Cosmos was enhanced to check operator's accessibility to the assignment in UI level to avoid unnecessary click operations.
Thanks,
IT Solution Service
SG
Thanks for the clarification!