How To: Limit users to set specific expiry policy for groups

Views:

Applies To:

GroupID 8, 9, 10 - Self-Service

Business Requirement:

We do not want to allow users to see all expiry policy options in the Expiration Policy drop-down list in group properties. Instead, we want a few of these options to be available.

Solution:

In GroupID, we can allow different privileges to different roles. We can allow a role to see only specific expiry policies in the Expiration Policy drop-down list. We can also disable the Expiration Policy drop-down list for another role.

The business requirement can be achieved by applying the following configurations to your Self-Service portal.

Show specific options in the Expiration Policy list
Make the Expiration Policy drop-down list read-only

Scenario 1: Show specific options in the Expiration Policy list

Steps:

In GroupID Management Console, select Self-Service > Portals > [Required portal] > Designs. Then select an identity store to modify the expiration policy options displayed in the portal.
On the Custom Display Types tab, select the lstExpirationPolicy option and click Edit.
On the Edit Design Type dialog box, select a value in the Values area and click Edit.
The Values area displays all values defined for the Expiration Policy drop-down list.
On the Combo Value dialog box, select a visibility level for the value. The visibility level determines which role members can view the value in the Expiration Policy drop-down list.
- On selecting a role, the value would be visible to users of the selected role and roles with a priority value higher than the selected role.
- Select Never to hide the value from all users.
Click OK to close the Combo Value and Edit Design Type dialog boxes. Then click the Save icon on top of the Custom Display Types tab.

You can set the visibility level for all the required values in the Expiration Policy drop-down list.
By default or in the absence of these settings, all expiry options are available in the Expiration Policy drop-down list.

After applying the settings, values in the Expiration Policy drop-down list will be visible accordingly. For example, if you selected Never as the visibility level for all but 2 values, then only those two values will be available in the list.

We can also completely hide the Expiration Policy drop-down list or make it read-only.

Scenario 2: Make the Expiration Policy drop-down list read-only

Steps:

In GroupID Management Console, select Self-Service > Portals > [Required portal] > Designs. Then select an identity store to disable the Expiration Policy drop-down list in the portal.
On the Properties tab, select Group in the Select Directory Object list. Then select the General option and click Edit.
On the Edit Design Category dialog box, select the Expiration Policy option in the Fields section and click Edit.
On the Edit Field dialog box, select a role in the Access Role list. The access level determines whether a user can change the value displayed in the Expiration Policy drop-down list.
- On selecting a role, users of that role and roles with a priority value higher than the selected role can change the value.
- Select Never to make the Expiration Policy drop-down list read-only for all users.
  As an alternative, you can select the Is Read Only check box to disable the list for all users, so they can view its value but cannot change it.
Click OK to close the Edit Field and Edit Design Category dialog boxes. Then click the Save icon on the top of the page.

The disabled Expiration Policy drop-down list will be displayed in the portal as follows. The Expiration Date field is also read-only and displays the group's expiry date, as calculated on the basis of the expiry policy.