The "Add/Remove privileges" action

Applies to version: 2021.1.x and above; author: Konrad Wojtycza

The article is an update of the already existing article, it shows the configuration in version 2021.1.1. For the original see: Adding and removing privileges.

Introduction

In workflow instances, there is often a need for people who do not have active tasks at the indicated steps to have appropriate privileges and be able to e.g. view (read privileges) or edit an instance. In such a situation, you can use the action of adding/removing privileges at the level of individual workflow instances.

You can find these actions in the “Actions” tab of a given workflow. They are most often used for entering/exiting a step and on transition paths. For more information about actions in WEBCON BPS, see Introduction to actions in WEBCON BPS.

Fig. 1. The "Add/Remove privileges" action

Configuration of the "Add privileges" action

The user may be granted one of four possible privileges levels:

• Administration - the highest privileges to read, edit and delete instances
• Modification (can’t delete) - standard privileges to read and edit instances
• Read - only – privileges to read without editing the instance
• Read - only (can’t view attachment) – privileges to read without viewing attachments

Fig. 2. The "Add privileges" action configuration window

Then, define the users that should be granted privileges:

• Always to – by selecting users or groups who will always receive privileges at a given step/path.

Fig. 3. The "Always to" option

• Dynamic – by indicating a form field that stores the appropriate users/groups (If it is a form field other than the “Person or group” type, you must designate a column that contains a user login or group ID).

Fig. 4. The "Dynamic" option

• SQL query – by entering the appropriate SQL query that will return user logins or group IDs (the login or ID should be in the first column returned by a query).

In the presented example, the query returns a person who replaces the person assigned to the processed instance.

Fig. 5. The "SQL query" option

In the right part of the configuration window, you can decide whether the privileges will be kept or removed after following the path to the next step.

You can also define the instance on which the privileges will be added. There are two options:

• Dynamic – by indicating if the privileges are to be granted on the child/current/parent instance

Fig. 6. The dynamic element selection

• SQL query – by creating an SQL query that returns the instance IDs on which the privileges should be granted.

This query returns all instances that have the same parent instance as the current instance.

Fig. 7. The SQL query

Remove privileges

The “Remove privileges” action works similarly to the “Add privileges” action. By using this action you can lower/remove the privileges indicated to the users (if they have them) to the defined level.

Privilege reduction levels:

• No privileges – no access to the selected instance
• Read - only (can’t view attachment) – privileges to read without viewing attachments
• Read - only – privileges to read without editing the instance
• Modification (can’t delete) - standard privileges to read and edit instances

Configuring the privilege level, people/groups, and instances for this action is identical to the “Add privileges” action.