Introduction

A supervisor role is a special role in BHold. It allows users who have this role to view other BHold objects, and if given appropriate permissions, they can modify those objects. In this post, we are interested in two things:

  • How to allow a user with a supervisor role to manage other users' roles?
  • How to allow a user to delegate his supervisor role?
For more information about supervisor role, please visit the following link: http://technet.microsoft.com/en-us/library/jj134937%28v=ws.10%29.aspx#svrolesperms


Creating a Supervisor Role

When installing BHold Core, a default supervisor role will be created, and linked to all Organizational Units.  You can also create your own supervisor role/s depending on your implementation. The link above has some recommendations from Microsoft regarding Supervisor Roles. To create supervisor role, you need to login to BHold Core Components, and follow the following steps:
  1. On the left hand side, click on Roles
  2. Click on Add

  3. Fill in the Description, and check the box for supervisor role

    As I have mentioned earlier, the default supervisor role can manage all objects, therefore by default it will be linked to this object we are creating.
  4. Click OK


Linking Supervisor Roles to Organizational Units

We would like to allow Ellen (our test user) to manage other users. Right now, using the self-service portal, she can only request roles for herself and view her own roles.

Below are the steps you can take to allow Ellen to manage other users' roles:
  1. Create a new OU under the root "MySupervisorOU"

  2. After the OU has been created, expand Roles, and click Modify

  3. Search for, and add "MyFirstSupervisor" to "MySupervisorOU"

  4. Click Add to proceed

  5. Expand users, and click Modify to Add Ellen to this OU, which will automatically give her "MyFirstSupervisor"

  6. Let us select the OU/s "MyFirstSupervisor" will manage. For that, I created another OU, called "TheSupervisedOU" and I will add "MyFirstSupervisor" to it

Now, Ellen will see a new tab called "Manage Users", and she should be able to add/revoke roles for those users


Allow users to delegate their supervisor role

Delegation is basically assigning user's role to someone else to perform his/her job. In the example above, we linked "MyFirstSupervisor" to "MySupervisorOU" as an effective role, therefore, Ellen will not be able to delegate it.

For that, we will need to change the link between "MyFirstSupervisor" and "MySupervisorOU" to be proposed. We have to go back to step 3 and 4 above, remove "MyFirstSupervisor", and Add it again. However, this time we will choose it to be proposed.

After you click Add, you should be able to expand the roles, and activate it

 

Now, Ellen should be able to go to the self-service portal and delegate the role to someone else. As a result, whoever she delegates the role to, should be able to add/revoke roles for those users in "TheSupervisedOU".