The actions give you the ability to act as a proxy for another user. In addition, they allow you to view your proxy and delegate assignments. If you are a Provisioning Administrator, or a Provisioning Manager or Team Manager for the Provisioning Domain, you might also be permitted to define proxy and delegate assignments, as well as team availability settings.
A delegate is a user authorized to perform work for another user. A delegate assignment applies to a particular type of request.
A proxy is a user authorized to perform any and all work (and also define provisioning settings) for one or more users, groups, or containers. Unlike delegate assignments, proxy assignments are independent of process requests, and therefore apply to all work and settings actions.
Proxy and Delegate Assignments Have Time Periods: Both proxy and delegate assignments are associated with time periods. The time period for a proxy or delegate assignment can be as short or as long as you need it to be. The time period can also have no expiration date.
Proxy and Delegate Actions Are Logged: If logging is enabled, any actions taken by a proxy or delegate are logged along with actions taken by other users. When an action is taken by a proxy or delegate, the log message clearly indicates that the action was performed by a proxy or delegate for another user. In addition, each time a new proxy or delegate assignment is defined, this event is logged as well.
Delegate Assignments When a Role Is the Approver: The User Application does not perform delegate processing when a workflow approver is a role. Any user in a role can perform approvals assigned to the role so delegation is not necessary.
Proxy Assignments When a Role Is the Approver: When you make proxy assignments, the User Application does not perform any checks on the roles already held by the user. It is possible that the user might already be assigned to all of the same roles as the person for whom they are acting as proxy. It is also possible that there are conflicts with the roles of the person for whom they will act as proxy.
This section describes two business scenarios where proxies and delegates might be used:
Suppose you are a manager who is responsible for approving (or denying) a large number of workflow tasks on a daily basis. In addition, you are also responsible for editing provisioning settings for a large number of users in your organization. In this situation, you might want to assign a proxy so that some of your work can be off-loaded to a trusted member of your team.
Suppose you are a manager who is responsible for approving or denying requests for ten different types of provisioned resources. All ten request types need regular attention, but you would rather have another individual in your organization attend to six of them. In this case, you could define a delegate for these six process request types. If necessary, you could restrict this delegate relationship to a period of hours, days, or weeks. Alternatively, you could specify no expiration for the delegate relationship, thereby establishing this relationship as a more permanent arrangement.
The menu on the Work Dashboard displays the following options to all users who log in to the User Application:
Table 12-1 Settings Menu Options Available to All Authenticated Users
|
Settings Menu Option |
Description |
|---|---|
|
Edit Proxy Mode |
Lets you act as a proxy for another user. For details, see Section 12.2, Acting as a Proxy. |
|
Edit Availability |
Lets you view or edit the requests you are available to act on, and which requests your assigned delegates can act on. To edit availability, you must have the Configure Availability permission. For details, see Section 12.3, Specifying Your Availability. |
|
My Proxy Assignments |
Lets you view or edit your proxy assignments. To edit proxy assignments, you must have the Configure Proxy permission. For details, see Section 12.4, Viewing and Editing Your Proxy Assignments. |
|
My Delegate Assignments |
Lets you view or edit your delegate assignments. To edit delegate assignments, you must have the Configure Delegate permission. For details, see Section 12.5, Viewing and Editing Your Delegate Assignments. |
When a Provisioning Administrator, Provisioning Manager, or Team Manager logs in to the User Application, the menu shows the following additional menu options:
Table 12-2 Settings Menu Options Available to Administrators and Team Managers
|
Settings Menu Option |
Description |
|---|---|
|
Team Settings>Team Availability |
Lets you specify which requests your team members are available to act on, and which requests the team member’s delegates can act on. The Configure Availability permission must be enabled in the team configuration. When this permission is disabled, this action is not allowed. For details, see Section 12.8, Specifying Your Team’s Availability. |
|
Team Settings>Team Proxy Assignments |
Lets you specify proxy assignments for members of your team. The Configure Proxy permission must be enabled in the team configuration. When this capability is disabled, this action is not allowed. For details, see Section 12.6, Viewing and Editing Your Team Proxy Assignments. |
|
Team Settings>Team Delegate Assignments |
Lets you specify delegate assignments for members of your team. The Configure Delegate permission must be enabled in the team configuration. If the team rights allow managers to make a team member a delegate for other team member's provisioning requests, this action is allowed for these requests. When this permission is disabled in the team configuration, this action is not allowed. For details, see Section 12.7, Viewing and Editing Your Team Delegate Assignments. |
|
Team Settings>Make Team Process Requests |
Lets you make a process request for a member of your team. The Initiate PRD permission must be enabled in the team configuration. When this permission is disabled in the team configuration, this action is not allowed. For details, see Section 12.9, Making a Team Process Request. |
The behavior of the Team Settings menu options varies depending on whether the current user is an administrator or team manager, and on which permissions have been granted, as described below:
Table 12-3 User Access to the Team Settings Menu Options
|
User |
Capabilities |
|---|---|
|
Provisioning Administrator (or Security Domain Administrator) |
Can select a user without having to select a team. Has all permissions associated with the Provisioning Domain, and can therefore see the Team Proxy Assignments, Team Delegate Assignments, and Team Availability menu options. Can access the button on the Team Proxy Assignments, Team Delegate Assignments, and Team Availability pages. |
|
Provisioning Manager |
Can select a user without having to select a team. Needs to be given security rights to see the Team Proxy Assignments, Team Delegate Assignments, and Team Availability menu options. Can access the button on the Team Proxy Assignments, Team Delegate Assignments, and Team Availability pages, if the proper security rights have been given. In the Team Delegate Assignments user interface, the Provisioning Manager is only able to select provisioning requests that they have rights to assign. When the Provisioning Manager submits a delegate assignment request, only assignments they are allowed to make are successfully completed. |
|
Team Manager |
Must select a team before choosing a user. Needs to be given security rights to see the Team Proxy Assignments, Team Delegate Assignments, and Team Availability menu options. Can access the button on the Team Proxy Assignments, Team Delegate Assignments, and Team Availability pages, if the proper security rights have been given. |