Hi all, happy new year! 🎆
Is there a more efficient way to solve the user question below?
User:
'I need access to "Invoice summaries"'
Okay, lets go:
- Use SF "Translations" to find candidate entities, tasks and reports
- Use SF "Menu --> shortest path" to find candiate screens where this property is found
- use the provided screenshot and user impersonisation to find the actual screen in the end application
- Use Alt-F1/"Location" in the end application to find the property name. It turns out not to be the screen "Invoice summaries", but the report that is generated via a task
- The task name is task_summarize_invoices, it uses report invoice_overview
- Use SF "Model rights", tab Tasks, and filter task_summarize_invoices
- There are five roles that have this task: "all_rights", "invoicing_all_rights", "accounting_overview_all", "invoice_basic" and "create_invoice_summary"
- I think I want to give the user access to "create_invoice_summary" or "invoice_basic", as they are not in accounting, and certainly don`t need all rights
- Use IAM "User grous", put a filter "invoice" on the detail tab "Authorization" , to get a manageable list of twelve roles that contain %invoice% under "all_rights"
- Next I go through all of 75 groups, created by another department in another language, to find a group that has as few extra roles as possible in addition to the roles that the user already has access to via the groups the user is member of.
- Finally, make the user member of the found user group, apply rights to the database and, restart impersoniation to verify, and have the user restart their application.
This is quite time consuming.
It would be nice if there was a way in IAM to
- Browse the complete authorisation model (as there is for example for the "all rights" role),
- with the "Explain" button not listing just the first hit on a role, but
- having it list all hits for
- roles and especially
- groups that give either read or read/write access to that property;
- Bonus for having a task to give group membership to a user from there
In the meantime, do I overlook an obvious improvement to my workflow?
