Create and Assign Tenants in Software Factory

Hi @Jefferson Delacruz,

What challenge would the implementation of this idea solve for you?

Default user groups can be created in the Software Factory and have roles assigned to it. After synchronizing to IAM, these User groups may be moved or copied to other Tenants. Usually a developer does not know which Tenants are present in IAM and what User groups and Roles should be assigned to it.

Looking forward hearing from you 😁

Hi Mark,
The challenges would be setting up the user groups only available for specific tenants itself. Currently my colleague is in the process of moving user groups from IAM to SF and we found a case where a user group specifically is only available for tenants.

Also in the IAM when creating user groups you choose between default and the defined tenant(s).
 

Hi Jefferson,

Does the Post-synchronization code suffice? In here you can provision default user groups and change the Tenant if you desire. You can make use of this code: 

declare @default_tenant_id tenant_id

select 
    @default_tenant_id = tenant_id
from tenant
where default_tenant = 1

-- Assign the default user groups and corresponding roles to the default tenant
exec task_provision_default_authorization
    @project_id = @project_id, 
    @project_vrs_id = @project_vrs_id, 
    @gui_appl_id = @gui_appl_id,
    @tenant_id = @default_tenant_id

After this, you can move user groups to the desired Tenant.

More information here: 

• https://docs.thinkwisesoftware.com/docs/sf/default_user_groups
• 

  • Automation of upgrading applications - copying applications applying roles in IAM

   

Thanks for the quick reply but what we need is to be able to assign user groups per tenant group, and there are times that a site can have multiple tenants. Running this code multiple times manually is not ideal. Having the feature itself in the software factory would be better.

Good morning,

In our situation we also need to group the default user groups. It would help us a lot if we could divide the default user groups into different self-defined groups. In this way we can classify default user groups according to different market segments.

This grouping must of course be made available in IAM.

Frank Junger

Having the actual tenants present in the Software Factory with synchronization to IAM is not something we’d want to implement. We try to keep operational data such as users and tenants out of the Software Factory.

Having the user groups and their role assignments as a template in the Software Factory so it can be applied for multiple instances of IAM and for multiple tenants within IAM is already available. This is already on the edge between development and operations.

The user groups are currently a single set. We can add the option to have multiple named default user group sets. Every set will have their own user groups with assigned roles.

As a developer, you’d have the option to match the default user group sets 1-to-1 with tenants. In the first example, ‘Site 1’ and ‘Site 2’.

But you can also choose to give them a more descriptive name that could be reused for multiple tenants as a starting point. For instance organizational user group configurations like ‘Basic’, ‘Functional’, ‘Departmental’ or ‘Matrix’.

The task to apply default authorization would then take the ID of a user group set as an extra parameter, either called via the post_sync / post_deploy or manually from the UI by an administrator for a certain application and tenant.

Would this suit all needs?