EmpowerID provides organizations the ability to automate the disabling and eventual deletion of EmpowerID Persons and all user accounts linked to those Persons based on the value of the ValidUntil attribute set on those Persons. This type of termination automation, known as the "Advanced Leaver" or "Planned Leaver" event differs from unplanned Leaver events, which are typically performed by an administrative user via the EmpowerID web user interface.
Configuring EmpowerID to implement planned Leaver events involves the following tasks:
Creating an EmpowerID Person and assigning to that Person the Initiator Access Level for the TerminatePersonAdvanced workflow - This workflow is used by the EmpowerID system to terminate all people submitted to it. As a best practice, the Person account you use should not belong to an actual EmpowerID user.
Configuring the TerminatePersonAdvancedInitiator system setting - To configure this setting, you edit it to specify the PersonID of the Person account you assigned Initiator Access Level for the TerminatePersonAdvanced workflow.
Configuring the PersonTerminationGracePeriod system setting - To configure this setting, you edit it to specify the number of days past the ValidUntil date on a Person before sending that Person for final termination in the TerminatePersonAdvanced workflow.
Enabling the TerminatePersonAdvanced permanent workflow - When enabled, this workflow runs in a continuous loop, executing once every five minutes to terminate all people with a ValidUntil expiration that has passed the number of days specified by the PersonTerminationGracePeriod system setting.
To assign the TerminatePersonAdvanced workflow initiator
In the Navigation Sidebar of the EmpowerID Web interface, expand Identities and click People.
From the Actions pane of the Find Person page, click the Create Person Simple Mode action.
This opens theCreate Person Requestform.
Type the first and last name of the Person you are creating in the First Name and Last Name fields, respectively.
EmpowerID recommends you choose a name that identifies the purpose for this Person, such as "Planned Leaver" or something similar.
Optionally, fill in the eMail, Personal Email and Comments or Justification fields with the appropriate information.
Below Primary Business Role and Location, click the Select a Role and Location link and in the Role and Location Selector that opens do the following:
EmpowerID recommends this Person be given the Temporary Business Role and Temporary Location.
Search for and select the appropriate Business Role for the person.
Click the Location tab.
Search for and select the EmpowerID Location for the person.
Click Select to close the Role and Location Selector.
Back in the main form, click Save.
After EmpowerID creates the person, you are directed to the Edit Person page for that person. Take note of the PersonID for the person you just created as you will need this ID to configure the TerminatePersonAdvancedInitiator system setting. You can get the PersonID from the address bar of your browser as shown in the image below.
From the Edit Person page, click the Access Assignments tab.
Select Direct from the Assign direct to resource or other method? drop-down.
Click the Add New button on the grid header and in the Select the resource(s) to grant access to dialog that appears do the following:
Select workflow from the Resource Type drop-down.
Enter TerminatePersonAdvanced in the Enter a Workflow Name to Search field and then click the tile for that workflow to select it.
Select Initiator from the Access Level drop-down.
Close the Select the resource(s) to grant access to dialog.
Click the My Cart icon at the top of the page, enter a reason for the access assignment and then click Submit.
To configure the TerminatePersonAdvancedInitiator system setting
In the Navigation Sidebar, expand Admin, then EmpowerID Servers and Settings, and click EmpowerID System Settings.
Search for TerminatePersonAdvancedInitiator and then click the Edit button to the left of the setting.
In the dialog that appears, enter the PersonID of the person you just created in the value field and then click Save.
To configure the PersonTerminationGracePeriod system setting
From the EmpowerID System Settings page search for PersonTerminationGracePeriod and then click the Edit button to the left of the setting.
In the dialog that appears, enter the desired number of days to wait before sending the person for final termination in the value field and then click Save.
To enable the TerminatePersonAdvanced workflow
In the Navigation Sidebar, expand Admin, then EmpowerID Servers and Settings, and click Permanent Workflows.
From the Permanent Workflows page, click the Submit Person Terminations link to open the Details page for the workflow.
From the Permanent Workflow Details page, click the Edit link. Edit links have the Pencil icon.
Select Enabled and then click Save.
To automatically transfer any resources for which the person is the Responsible Party to the person's manager, you must enable the Transfer Resources to Manager option on the Terminate Person Advanced workflow that is called by this workflow.
In the Navigation Sidebar, expand Resources, then Workflows, and find the Terminate Person Advanced workflow.
Expand the Request Workflow Parameters accordion and click the Edit icon on the TransferOwnershipToManager parameter.