Role Delegation in a group

[sachinbhasin11]

Ever wondered what’s the use of the ‘Group Manager’ field that available on Group records Out of the box? Off course, it means the user is ‘managing’ the group but what does that mean when it comes to role management in the platform..

Now suppose you want to nominate a user to manage roles for users in the groups they are a part of, how would you do this?

Well, first you need to nominate this user to be a role delegator this can be done by:

1. ‘Designate role Delegator’ module, is available to admin by default and would ask for you to select a group and a user from the same group. Once you select the user the system would auto-generate a change request and using workflow it assigns the ‘role_delegator’ role to the user. You can declare multiple role delegators for a group by using this module
2. Map a user to the ‘Manager’ field on the Group record. The system will then assign the ‘role_delegator’ role with the help of a business rule ‘Group Manager Change’ automatically

Note: ‘Group Manager Change’ business rule is inactive by default, and you must activate it for this to work

Other things to note:

1. The module ‘Designate role delegator’ is only visible to ‘admins’ by default and it helps the admins to declare a role delegator for a particular group
2. You can only assign roles to the members of the group for which you have been declared as a role delegator by the system [ You can check if you are a role delegator for a group by going to the sys_user_has_role table and checking the ‘granted_by’ column
3. If you are a member of more than 1 group and you wish to assign a role to the users of one of the groups, then you have to be a role_delegator for that group. You may however assign any role that you have

e.g. if you are a member of group A which is assigned with ‘itil’ role so you have ‘itil’ role with you, now if you are a member of group B which assigned with ‘csm_consumer’ role you will also have ‘csm_consumer’ role assigned to you. You will be able to assign ‘itil’ role to the users of group B if you are declared as a role delegator for group B

How would you remove role delegators for a group?

Well, if you only have 1 role delegator that is declared as the manager of the group then simply remove that user from the manager field of the group record, and the ‘role_delegator’ role would be removed for that user automatically

Note: ‘Group Manager Change’ business rule is inactive by default, and you must activate it for this to work

But if you have multiple Role delegators for a group then you will have to go to ‘Role delegators’ module and remove the entry from the ‘sys_user_has_role’ one by one [You need user_admin role to delete a record from this table]

Hope you would use this feature when you have a requirement for managing the users and their roles locally without always involving the system administrator