User Access Processor

A common issue in large-scale Archer environments is the need to ensure that all users are assigned to appropriate groups. LDAP synchronization is one way to solve this, but if you don't have an LDAP server which reflects the group assignments you need, your only other option is to manually edit the groups and/or users individually through the Access Control administration UI.

The User Access Processor, combined with the "User Access Request" ODA module provided in the accompanying User_Access_Request_Package.zip file, provides a robust solution to this problem.

To run the User Access Processor, you'll first need to import the User_Access_Request_Package into your Archer environment (the package requires Archer 6.7 at minimum).

The "User Access Request" application allows an Archer user to submit a request for modification of their own group membership, or that of another user (selected via the "Impacted User" field). The groups that they'd like to be added to and/or removed from can be selected via the "Groups to Add" and "Groups to Remove" fields, respectively. Then they can select a "Manager" who will be responsible for approving the request via Advanced Workflow.

Once the request has been approved by the selected manager, the record's "Implemented?" values list field will be set to "No". This is the condition that the User Access Processor looks for in order to find records that it needs to handle.

When the User Access Processor runs, it executes a search query against the "User Access Request" application for records having "No" in the "Implemented?" field. For each that it finds, it asserts that the "Impacted User" is a member of all of the groups listed in the "Groups to Add" field (adding the user to the groups if necessary), and that the user is not a member of any of the groups listed in the "Groups to Remove" field (removing them if so).

After the membership has been correctly asserted, the User Access Processor updates the "User Access Request" record to set the "Implemented?" status to "Yes", indicating that the request has been fulfilled, and logs the details of its activity to the "Processor Activity" rich text field.

If you don't want to incur the cost of an ODA, a simpler solution to the same problem which only uses the core Contacts application is provided by the CHUM Tool.