14.7 Defining request attributes

Using the Central console (nph-psa.exe), define request attributes in ID-Synch to gather extra information about a user when creating a new account. For example, request attributes can be defined to gather human resource information such as date of birth, or social security number.

Information can be collected by:

• A plug-in that automatically collects and/or validates information, such as an employee ID, from a database.

• Users entering the information in the New account form when requesting accounts for themselves or others. For example, they can:
  • Select Yes, No, or (None) for a boolean type attribute
  • Type a numeric-only value in a field according to a specified format
  • Type multiple values in a text field
  • Type memo-type information in a multi-line field
  • Select an item from a drop-down list

Request attributes are defined by the following properties:

Maximum length

Request attribute values can have a maximum length of 9999 characters.

Multiple, restricted values

Items that appear in a drop-down list are set by multiple restricted values. You can either configure the values manually or write a plug-in to generate them. For example, student users may choose from a list of options that change each semester.

Multiple, unrestricted values

When multiple, unrestricted values are allowed, each value must be enclosed in quotation marks and separated by a space. For example, users enter:

    "January" "February" "March"

The following entry is incorrect and would be read as a single value:

    January February "March"

Required/optional

Request attributes can be required or optional. For example, social security numbers may be required for all employees.

A value for a required attribute can be provided at any stage of the request process. That is, an authorizer with assigned rights can enter information, such as salary or Social Security Number, to which the requester does not have access. You configure access controls to determine which users can view or edit certain attributes.

Including information in e-mail

Request attributes can be included or excluded from the information sent via email-request to authorizers. For example, Social Security Numbers are confidential so are excluded from the information being sent.

To include request attributes in the e-mail information that is sent to authorizers, you must edit the EMAILS.Z file. This is explained further in the procedure in HERE, step .

Default values

Attributes can be set up with default values, so that unless a user intervenes and changes the value, the default value is entered with a request. This is the case for both required and optional attributes.

Add, modify and delete request attributes by accessing the Request attribute information page.

14.7.1 Adding request attributes

To add a new request attribute:

1. From the Workflow configuration menu click Attributes then Request attributes to navigate to the Request attribute information form.

2. Type an ID and Description for the attribute in the appropriate fields.

3. Select the Type:
   • Numeric -- accepts numeric characters only in a single-line text field
   • Character -- accepts alpha-numeric characters in a single-line text field
   • Boolean -- set by selecting Yes or No, or (None) if optional, from a drop-down box
   • Memo -- accepts alpha-numeric characters in a multi-line text box

4. If the attribute is required for a request to be complete, type a number greater than 0 in the Minimum required number of values field.

5. If more than one value can be entered, type a number greater than 1 to set a Maximum allowed number of values, or type -1 to allow an infinite number of values.

   This means that if users update attributes in the New account form, they will be presented with an additional field or fields for this attribute.

   Boolean attributes can only have one value.

6. Click the Allow this attribute to be sent in e-mails check box if the attribute is to be included in information sent in the e-mail request to authorizers.

7. Click the Display when requesting check box if you want end users to be able to enter the information in a field displayed on the New account form.

8. Type the maximum number of characters/numbers allowed the Maximum field length.

   For attributes with multiple restricted values, this refers to the maximum length allowed for each value.

   For attributes with multiple non-restricted values, this refers to the total number of characters allowed in the text field for this attribute.

9. If required for the attribute, type the following:
   • Description of input values-- For example, type YYYY-MM-DD for a Date of birth field. This is displayed to users when they update attributes.
   • Format string of input values-- For example, type NNNN-NN-NN to indicate a series of numbers
   • Regular expression used for validation-- See Regular expressions for more information.

     Note:

     If you use a regular expression for validation the Description of input values is required.

     
     

   • Plug-in used to generate a list of restricted values-- A plug-in may be used to supply a set of values that can be applied to this attribute (e.g. union membership or course enrollment).

     You can also set restricted values manually. To do so, leave this field blank and continue with the procedure.

     Note:

     Restricted values are allowed only with numeric or character type attributes.

     
     

   • Default values for the attribute- Unless the user changes the value of this attribute, the default value is copied to the newly created account. For existing users, only mandatory attributes can have default values.

10. Click Add at the bottom of the form.

    ID-Synch updates the request attribute and displays the Restricted values form at the bottom of the page.

    Note:

    The access control for this attribute should be configured before usage.

    
    

11. If you want to restrict the values that can be applied to this attribute (and you are not using a plug-in to generate the list) type them in the appropriate fields and click Add next to the value.

12. If you enabled the Allow this attribute to be sent in e-mails check box, the attribute must be added to the EMAILS.Z file in the \<instance name>\cgi-bin\en-us\ directory.

    You do this by modifying the M4 file corresponding to EMAILS.Z, by adding
    %ATTRIBUTE-$<$AttributeID$>$% and any text that you require.
    The tag will be replaced by the value entered by the end user when submitting a request.

    See the full manual shipped with the ID-Synch software for more information about editing M4 files.

13. Restart the IDAUTH service:
    1. From the Windows Start menu, select Control Panel -$>$ Administrative Tools -$>$ Services.
    2. Right-click on ID-SYNCH AUTHORIZATION SERVICE and select Stop, then Start.

14. Click Back to return to the Select an attribute page or Main to return to the Central console (nph-psa.exe) main menu.

If you change the Sendable status at a later time, you must restart the IDAUTH service again.

14.7.2 Deleting request attributes

To delete request attributes:

1. Log in and navigate to the Specify attribute search criteria page.
2. Type search criteria and click Search to see the Request attribute information page for the request attribute you want to delete.
3. Select the check box next to Delete.
4. Click Delete.
   ID-Synch displays the Specify request attribute search criteria page
5. If the attribute was allowed to be sent in e-mails, delete the attribute tag (for example, %ATTRIBUTE-$<$AttributeID$>$%) and any text, in the EMAILS.Z file in the \<instance name>
   [0]\services
   [0]\ directory as required.

14.7.3 Grouping attributes

You can organize attributes into groups to:

• Avoid exposing users to hundreds of attributes on one page.

  This means you have a number of sub-pages where you can configure related attributes to be displayed together in groups.

• Assign read and write privileges to:
  • Authorizers in the Request approval module (nph-idp.exe)
  • Requesters in the New account request module (nph-idr.exe) and Request tracking module (nph-ids.exe)
  • Recipients in the New account request module (nph-idr.exe)

See HERE for details.