Configure person service attributes

In the Management Portal at Entitlement Catalog, on the Attributes tab of the service page, configure person attributes to retrieve any identifiers or attributes for a person in a workflow action. This enables you to retrieve, for example, the manager of an actor in an Approve Transaction workflow action.

Configuration

Field

Explanation and Tips

Restricted information

Mask the attribute value in the Management Portal. This ensures you can be compliant with the privacy laws of your country or organization, as unauthorized administrators do not have access to private information like e-mail addresses, phone numbers, social security numbers, etc. This functionality applies to the Management Portal only; restricted information is still shown in the Web Portal.

  • Authorized administrators see the icon Eye-outline-vector-256-256 for restricted attributes and their placeholders anywhere in the Management Portal. They can click this icon to view their value. These values are hidden again when the page is refreshed. This prevents situations in which unauthorized administrators can view restricted information by shoulder surfing authorized administrators. Where appropriate, a button is available to view ALL restricted attributes at once.
  • Unauthorized administrators see the icon Evil eye for restricted attributes and their placeholders. At Transactions, restricted attributes are shown as [attributename]. Although unauthorized administrators cannot see the attribute value, this still allows them to verify if the context or definition of the attribute is correct.
  • You can set administrative permissions on this functionality.
  • The value is also restricted if it is determined by a restricted service attribute, people attribute or people identifier.

Person identifier

Specify the person identifier for which Identity Director should retrieve data.

Initial value

Optionally, specify a default value of the service attribute.

You can force mandatory input by enabling Attribute may not be empty after workflow input from actor.

You can use the service attribute in multiple pages of a Provide Information workflow action by enabling Attribute can be used in multiple pages on Provide Information.

Consider the following scenario:

You want to create a service to request a mobile phone:

  1. Users can select available models from a list.
  2. The manager of the requester must approve the request.
  3. If the phone costs more than $600, the manager of the manager must also approve the request.

For a service with single approver (just step 1 and 2 above), you could create an Approve Transaction workflow action that is assigned to the manager of the requester:

Dynamic Actor, determined based on a placeholder for the 'Windows user account of manager' attribute of the Requester

For multiple (dynamic) approvers, you can use a person service attribute.

  1. To prepare the attribute (for example 'Approver') for step 2, you can set the initial value with the same placeholder as above:

    Initial value of person service attribute set to a placeholder for the 'Windows user account of manager' attribute of the Requester

  2. In the Approve Transaction workflow action for step 2, you now define the actor using the 'Windows user account' identifier of the person identified by the 'Approver' service attribute:

    Dynamic Actor, determined based on a placeholder for the identifier 'Windows user acount' of the person in the service attribute 'Approver'

    3. After this workflow action, insert an action that decides if additional approval is necessary. For example, a Compare Attributes workflow action.

  3. In the Approve Transaction workflow action for step 3, you again define the actor using the 'Approver' service attribute.
    But this time you use the 'Windows user account of manager' person attribute of the person identified by the 'Approver' service attribute:

    Dynamic Actor, determined based on a placeholder for the attribute 'Windows user acount of manager' of the person in the service attribute 'Approver'

Placeholders

When you insert a person service attribute as a placeholder in actions, you can use the following options to retrieve data of the person identified by the attribute:

Placeholder

Explanation

#Service[Person.{ServiceAttributeName}.Name]

Resolve the name of the person determined by the service attribute.

Person identifier

#Service[Person.{ServiceAttributeName}.Identifier.{PersonIdentifierName}.{Data}]

Resolve data of the specified identifier of the person determined by the specified service attribute.
Possible data:

  • Value - returns the value that is stored in the attribute
  • Description - returns the description you specified for the attribute
  • Person service attribute: PSAExample
  • Person identifier: Windows user account
  • Data: Value

Resulting placeholder:
#Service[Person.PSAExample.Identifier.Windows user account.Value]

Person attribute (Text)

#Service[Person.{ServiceAttributeName}.{PersonAttributeName}.{Data}]

Resolve data of the specified text person attribute for the person determined by the service attribute.
Possible data:

  • Value - returns the value that is stored in the attribute
  • Description - returns the description you specified for the attribute
  • Person service attribute: PSAExample
  • Person attribute: Windows user account of manager
  • Data: Description

Resulting placeholder: #Service[Person.PSAExample.Windows user account of manager.Description]

Person attribute (Password)

#Service[Person.{ServiceAttributeName}.{PersonAttributeName}.{Data}]

Resolve data of the specified password person attribute for the person determined by the service attribute.
Possible data:

  • Encrypted - returns the password in encrypted form
  • ClearText - returns the password in clear text
  • Description - returns the description you specified for the attribute
  • Person service attribute: PSAExample
  • Person attribute: CRM Password
  • Data: Cleartext

Resulting placeholder: #Service[Person.PSAExample.CRM Password.ClearText]

Person attribute (Table)

#Service[Person.{ServiceAttributeName}.{PersonAttributeName}.{Data}]

Resolve data of the specified table person attribute for the person determined by the service attribute.
Possible data:

  • FullTable - returns the full table
  • CurrentRow.FullRow - returns all data for the selected row
  • CurrentRow.{ColumnName} - returns the value in the specified column for the selected row
  • EntireColumn.{ColumnName} - returns all data in the specified column
  • Number of rows - returns the number of rows in the table
  • Description - returns the description you specified for the attribute
  • Person service attribute: PSAExample
  • Person attribute: Movies
  • Data: EntireColumn.MovieDuration

Resulting placeholder: #Service[Person.PSAExample.Movies.EntireColumn.MovieDuration]

You can also click Placeholders to select from a list of available placeholders and insert them in the field.