<div id="google_translate_element"></div> <script type="text/javascript"> function googleTranslateElementInit() { new google.translate.TranslateElement({pageLanguage: 'en'}, 'google_translate_element'); } </script> <script type="text/javascript" src="//translate.google.com/translate_a/element.js?cb=googleTranslateElementInit"></script> |
The Approvals module stores and queues DNS actions made by selected User Groups, and sends those actions to a Pending Changes list for administrative review. Later, an administrator (or combination of administrators) can approve or reject these stored actions.
The admin Approvals Tab contains two sub-tabs: Pending Approvals and Permission Groups, which are the primary areas to manage Approvals items.
Currently, Approvals is available only for DNS related actions, while we gather feedback and use cases to inform possible future updates. If you are interested in providing feedback, a use case, or requests for future additions to the Approvals system, please contact feedback@6connect.com. |
The ProVision Approvals system gives administrators an additional layer of flexibility and oversight to manage which changes are allowed to DNS items by users.
With Approvals, administrators can set group permission rules requiring that certain types of DNS changes made by a user are either 1) automatically denied or 2) approved by an administrator. In the latter case, one or more admin group(s) must be assigned to approve those action types.
Viewing requested changes and managing the group permission rules are both managed from the admin Approvals tab, under the Pending Approvals and Permission Groups sub tabs.
The approvals system revolves around three primary concepts: Policies, Family-Action Types, and User Groups. An understanding of all three is necessary before setting up Approvals, and additional steps may need to be taken to ensure proper use of Approvals - such as creating additional User Groups.
When setting up Approvals Permission Groups, a policy will need to be selected to apply to the User Group / Family-Action Type combination selected. The set policy determines how the Approvals system handles an attempted change by a member of the associated User Group.
There are three available policies:
Ensure that for any group/action set with an "Action to be Approved" policy, another group is set with "Must Approve" for the same family-action type. Failure to provide groups for both submitter and approver may result in changes not being processed, due to not having a user assigned to approve the request.
In Approvals, the "Action" listed in the Pending Approval information or when setting Approval Permission Groups will be one of the following change types:
It is important to note that Action types in Approvals is related-to-but-different than CRUD permissions as set in User groups - although the "Add" Action type and "Create" CRUD permission seem the same, the action type "Add" only applies to a specific event occurring, rather than a holistic overarching system-level permission. In order to perform a certain Approval Action Type, a user must already have the CRUD permissions to attempt it.The CRUD permissions determine whether the user can even view an area or attempt an action to begin with, Approvals Policies on Action Types determine what is done with the Action after the attempted change.
Further fine-tuning of the action types for permissions is done by selecting the combination of "Family" (type of DNS item) with the Action Type. DNS Families include DNS Servers, DNS Groups, DNS Zones, and DNS Records. Each type of action can be performed on each family, so when setting up Approval Permission Groups you may choose to set the policy for the entire Family (ex:"All DNS Group actions"), Action (ex:"Add actions for all DNS Families"), or just a specific combination (ex: "Only DNS group Delete").
Approvals uses ProVision User Groups to determine which users must have a change approved, denied, or can approve others' actions. Therefore, User Groups must be set up with the appropriate users and basic permissions under each group before using Approvals. For information on setting up User Groups and how the basic permissions structure works in ProVision, see Users & Permissions, Global Permissions, and Users and Groups.
Before using Approvals, a review of your user and User Groups is highly recommended to ensure the following:
Below are a couple of sample scenarios to illustrate common Approval situations, with example notes on Approval Settings.
One Admin group and two DNS worker groups with different levels (high - low) of oversight needed, with restrictions set for particular Action types.
Group 1A (Admin) | Group 1B | Group 1C |
---|---|---|
Approval Group Settings:
|
Approval Group Settings:
|
Approval Group Settings:
|
Expand the following link to view example images of setting the assignments for all three groups:
These examples use the "Assign" button for the Group under the Approvals Permission Groups sub-tab, Groups page. Scenario 1 Group A: Group B: Group C, Deny Policy: Group C, Action to be Approved Policy: These settings may also be set by Action Type instead of Group, from the Approvals Permission Groups sub-tab, Actions page. |
Two Admin approval groups exist: One general Approver group that can approve any action type, and a second Group containing one person, Bob, who must sign off on any action taken under DNS Groups.
Group 2A (Admin Approvers) | Group 2B (Admin Approver Bob) | Group 2C |
---|---|---|
Approval Group Settings:
|
Approval Group Settings:
|
Approval Group Settings:
|
The high level process to use when first setting up approvals is as follows:
Review User Groups and Approval Process Needs
Step 1 - Review Existing User Groups and Process NeedsWhen setting up Approvals for the first time, review the information in the previous section under "Approvals Fundamentals" to ensure a basic understanding of how Policies, Actions, and User Groups relate together in Approvals. Then, take a few minutes to think about the following questions to get a better sense of how to use Approvals with your specific organization:
Once your User Groups are optimized for use with Approvals, you may want to write down a quick note on which Action Types and policies are planned for each group. |
Edit User Groups / Create Approvals-Specific User Groups, if needed
Step 2 - Add or Edit ProVision User GroupsFrom here, depending on the answers to the questions in step 1, you may need to do one or more of the following from the Users tab:
For more information on adding and editing ProVision User Groups, see Users & Permissions, Global Permissions, and Users and Groups. |
Assign Action and Policy Settings to User Groups
Step 3 - Assign Approval Action Settings to GroupsFrom the Approvals Tab, navigate to the Permission Groups sub-tab. Then, under the Groups page tab, find the ProVision User Group you wish to want to assign a policy to and click "Assign". Clicking the "Assign" button for a group brings up a checklist to select what policy to apply to the group for what Family and Actions (i.e. DNS Zone 'Add' or DNS Group 'Update'). You can "quick-select" all actions for a DNS Family (Severs, Groups, Zones, Records) by clicking the checkbox next to the family name, or only select individual action types for each Family. Once you've selected the applicable Family/Action combinations to apply a policy for, select either "Deny", "Action to be Approved", or "Must Approve Action" under Policy. When done, Click "Assign", and repeat as needed for other Policy types or User Groups. |
If using Approvals notifications, enable notifications for the appropriate Permissions Group(s)
Step 4 - Enable Notifications (Optional)From the Approvals Tab, navigate to the Permission Groups sub-tab Groups page tab. Click on the group name for which you want to set notifications - the Group Permissions Detail page will provide additional information on the group's settings. For any Family/Action that you want to enable notifications, click the checkbox under "Enable Notifications". All users of that group will get email notifications when a change of the selected type(s) are made. |
If using Approvals notifications, set up a Scheduler task for "Approvals - Process Subscription"
Step 5 - Add Scheduler Task: "Approvals - Process Subscription" The "Approvals - Process Subscription" task processes approval request events and handles the sending of notification emails to subscribed Approvals Groups - this task must be created and running on a regular interval in order for Approval Notification emails to be sent. In order to receive the most up to date information in the Approval Notifications, is recommended to create this task with a run time of "every 5 minutes" and no end date. For information on setting up Scheduler Tasks, see Scheduler. |
Set up a Scheduler Task for "Approvals - Delete events older than 1 month", to occasionally clear out old and obsolete Approval request events
Step 6 - Add Scheduler Task: "Approvals - Delete events older than 1 month"The "Approvals - Delete events older than 1 month" task deletes any Approvals history events older than 30 days. It is recommended to set this task to run monthly with no end date, to clear out obsolete approvals items, reduce data storage space needs, and reduce approvals page load time. For information on setting up Scheduler Tasks, see Scheduler. |
On a day-to-day basis after initial setup, an Approvals Workflow will be similar to the following (with "Submitter" as the user whose actions require approval, and "Approver" as the admin with the ability to approve/reject the change):
The requested change is sent to the Approvals Tab Pending Approvals list, and also to the DNS Resources Awaiting Approval module (the submitter may see their own submitted action under "Resources awaiting approval", but only Approvers can take approve/reject actions)
The Pending Approvals list is under the Approvals Tab. It shows Approvals events (change requests) for which the user has the ability to Approve or Deny - it does not show approval requests for all of ProVision or those for other users. |
A "Resources Awaiting Approval" module will display in selected DNSv3 pages to Users with Admin / Approval permissions, if a change has been submitted on that page that is pending approval by the User's Approval Group. |
The Approver reviews the change in either their Approvals Tab Pending Approvals list, or the DNSResources Awaiting Approval module, and chooses to Approve or Reject the change:
|
See the following areas for more information on Approvals and using Approvals with DNS: