Workflows
Assign roles automatically – based on the attributes of the sign-in.
Assigning roles one by one works as long as the number of users stays manageable. With a thousand students per semester it stops working. Workflows automate that step: at every sign-in they evaluate the attributes the identity provider supplies and derive actions from them.
Rules instead of manual work
A rule has four parts: the attribute being checked, the condition, the type of comparison and the result. The attributes available are those of the sign-in – e-mail address, name, first name – plus, with SAML2, the values from the assertion: group membership, department, status group.
Comparison uses the usual operators: starts with, ends with, contains, equals, is in a list, greater or less than – and, where it gets more complicated, a regular expression. Several conditions can be joined with and, or and not.
What a rule can trigger
add a role – the matching role is set at sign-in
create and add a role – if it does not exist yet, it is created automatically
allow registration – only those meeting the condition get an account
deny sign-in – those who do not meet it never get in
A typical example
If the e-mail address ends with your own domain, the person gets the role staff; in every other case the role external with far tighter permissions. This is evaluated at every sign-in – if somebody changes department or leaves, that takes effect by itself the next time they log in.
Why this is more than convenience
Permissions granted by hand are forgotten by hand. Somebody who leaves a project often keeps their booking rights for months. Because workflows derive the assignment afresh at every sign-in, it stays tied to the directory that is maintained anyway. The directory service remains the truth and Zeitwart follows it.
Benefits at a glance
roles derived automatically from the attributes of the sign-in
registration allowed selectively, or sign-in denied selectively
conditions combined freely, up to regular expressions
evaluated at every sign-in, so changes take effect without follow-up work
no orphaned permissions, because the assignment hangs on the directory