Restricting Inspector actions for online workflow servers

You can limit Process Designer Inspector actions for specific workflow servers or environment types.

About this task

Someone with administrative authority for a process application can use the Process Designer Inspector to inspect a process from that process application on any connected server. They can use the Inspector to stop the process or run tasks. However, the organization can restrict Inspector actions on particular connected servers. For example, an organization can allow only users in the tw_admins group to use the Inspector on production servers.

Note: The following configuration steps should be completed only on the IBM® Workflow Center. The configuration applies only to online workflow servers that are viewed in the Process Designer Inspector.

Procedure

Add an <inspector> element in the <authoring-environment> section of the appropriate 100Custom.xml file in your topology.
For more information about the location of the 100Custom.xml file that must be updated, see the topic Location of 100Custom configuration files.
```
<properties>
...
   <authoring-environment>
   ...
      <inspector>
      </inspector>
   </authoring-environment>
</properties>
```
Add one or more <target-server> elements.
The <target-server> element describes the server where the restrictions are applied.
Optional: To apply the restrictions to a particular type of server, add a type attribute to the <target-server> element.
The type attribute can be development, test, staging, or production. To find out the type of the server, open the 99Local.xml of the server you are interested in (see the topic Location of 100Custom configuration files for its location) and look for <environment-type> in the server section.
Optional: To apply the restrictions to a specific server, add a name attribute to the <target-server> element.

To find out the name of a particular server, open the 99Local.xml of the server you are interested in (see the topic Location of 100Custom configuration files for its location) and look for <server-name> (current environment name) in the server section.
Optional: Add one <default-action-policy> element to a <target-server> element.
Add one or more <action> elements to the <default-action-policy> element.
The <action> element describes a particular Inspector action and the roles that are allowed to perform that action.
Add a type attribute to the <action> element.
You can use the following values for the type attribute:
- ACTION_VIEW_INSTANCE - Only the specified roles can view process instances.
- ACTION_RUN_PROCESS - Only the specified roles can run processes.
- ACTION_MANAGE_INSTANCE - Only the specified roles can manage process instances by suspending, resuming, stopping, or deleting instances.
- ACTION_RUN_TASK - Only the specified roles can run or debug tasks.
- ACTION_CHANGE_VARIABLE - Only the specified roles can change variables.
Add one or more <role> elements to the <action> element.
The <role> element specifies the group that the user must be a part of to perform the parent action. The <role> element can contain only one role, and that role must correspond to a group that is defined in Workflow Center.

Example

Here is an example that restricts all of the Inspector actions on servers of type production:

<inspector>
   <target-server type="production">
      <default-action-policy>
         <action type="ACTION_VIEW_INSTANCE">
            <role>tw_admins</role>
         </action>
         <action type="ACTION_RUN_PROCESS">
            <role>tw_admins</role>
         </action>
         <action type="ACTION_MANAGE_INSTANCE">
            <role>tw_admins</role>
         </action>
         <action type="ACTION_RUN_TASK">
            <role>tw_admins</role>
         </action>
         <action type="ACTION_CHANGE_VARIABLE">
            <role>tw_admins</role>
         </action>
      </default-action-policy>
   </target-server>
</inspector>

If an <action> type is not specified or is empty, there are no restrictions for the user on that action. The organization might determine that a process author can use the Inspector to view instances on a staging server but not allow the user to modify the running processes in any way. Assuming that a user has administrative rights to the process application, you can add the following lines to the appropriate 100Custom.xml file. You can add more roles for particular servers or types of server, as shown in this example:

<inspector>
   <target-server name="my staging server">
      <default-action-policy>
         <action type="ACTION_VIEW_INSTANCE">
            <!-- No Restrictions -->
         </action>
         <action type="ACTION_RUN_PROCESS">
            <role>tw_admins</role>
            <role>staging_admins</role>
         </action>
         . . .
      </default-action-policy>
   </target-server>
</inspector>