Reassigning authorisations assigned to a User who has left when there is no replacement member of staff to reassign to.

[Adrian Simpkins]

Hi All,

I have a User who has left, and went to remove her access. I know there was a change recently around further admin tasks assigned to a deleted user which has been introduced, and this user has 26 authorisation tasks assigned to them, and other members of her team. There is no replacement as such for her as yet, so there is no new user to assign these tasks to / they are already assigned to other members of the authorising team as a shared authorisation task.

My question is how to handle these tasks to allow me to remove the Users access? The authorising team had 4 members, which will be 3 members when I remove this user and there is no replacement so I need to delete her tasks rather than reassign them. Am I able to delete the task from her profile without affecting the other users, or do I have to reassign these to be able to remove her user access?

Many thank

Adrian

 

 

[Adrian Simpkins]

bump

 

[Steve Giller]

I think the lack of a response may be because the terminology is confusing.

If the User has left, presumably they can't sign in, so they don't have access to the Task so how to remove access ... seems to already be done?

I can say there is no option in the UI to cancel or delete a Task. Expert Services may be able to do this for you, but as you mention these are Authorisations this will affect the requirements for the Authorisation - e.g. if it's unanimous you would then only have 3 of the 4 available and could never authorise it.

It's difficult to be certain without viewing the Tasks themselves (as alluded to this would be Expert Services) but I would suggest the best way forward would be to reassign them.

[Adrian Simpkins]

Hi Steve,

Apologies if the scenario is not too clear - I have 3 users all who have left whose User access I want to remove so i can get their licences freed up, but they are assigned a group authorisation task which is still outstanding. No one has been assigned to their role to replace them in their current teams so I have no one in effect to reassign their task to. The other team members already have this task assigned to them as a shared authorisation (setup as one person authorises using Individual type, and then all other auth tasks end).

In effect they were a team of 4, but now a team of 3, so I just wanted to clarify am I just able to delete the task assigned to the users who have left without affecting the authorisation assigned to the other remaining team members as there is no one to assign these tasks to / the existing team members already have this task assigned to them. I don't want to assign this to one of them as that becomes a duplicate item. Image below shows the task is set to Individual authorisation as below

Many thanks

 

 

[Steve Giller]

I don't recognise the configuration from the partial screenshot - whereabout is that?

[Adrian Simpkins]

Hi Steve - that is just to show the authorisation node in the BPM to show it is set to Inidvidual on the task rather than weighted / majority vote, so when one of the authorisers hits Authorise / Reject the task for the others is removed,

 

Many thanks !

[Estie]

@Steve Giller- I also have this issue.  I am unable to archive 3 users who have left as there are still outstanding tasks assigned to them.  The only option (when I have finally found the outstanding tasks) is to reassign the tasks.  All other approvers in the approval group already have the task assigned to them.  The tasks are individual as @Adrian Simpkins has explained above.  So I have no-one else to reassign to. 

Although they may not be able to login to our systems this is surely a security issue, as we do not wish to have disabled user accounts showing as active in Hornbill.
I would also like to know how to manage this scenario.

I would also point out that it is really difficult and manually intensive to actually find out which tasks are outstanding for a particular user - see below - unless I am completely looking in the wrong place?
 

I have done the following:

Check the errors in the archived LDAP log
Go to the users in Platform config and attempt to archive manually -

I get the following:

Click Re-Assign

I can hover to get a task ID but no request ID/reference
I click on the name - Hardware request review – New Activity window appears with details of a previous unrelated activity. 
Unable to locate the task/request linked to the account.



Fortunately we have a pre-approval holding queue where I have found most of the tasks, however I have had to manually search through it which is very time consuming.

I have also tried viewing activities logged in as Admin but simply find the search/filter function does not work and I can see some other team's activities but not others.

I would be grateful for any advice or help on this.

Many Thanks

 

[CraigP]

Hi @Estie, not sure if this helps, but I've used this statement in the Database Direct section to retrieve a user's active tasks in the past:

SELECT h_obj_ref_urn,h_title,h_created_on,h_assigned_to,h_assigned_to_group FROM h_sys_tasks WHERE h_State = "1" and h_assigned_to = "urn:sys:user:<username>"

The h_obj_ref_urn contains the associated request ID.

[Estie]

Thank you @CraigP I will give that a go. 

[CraigP]

Funnily enough I've just had to do this for someone who has left our organisation.

It seems you re-assign the tasks by ticking them in the list then using the box in the top right to find and select who you want to re-assign to.

However I agree in thinking the UI is confusing, my first instinct was to do the same thing and click on the task title which navigated to my personal task view and displayed a blank task.

[Estie]

@CraigP - Ahh OK thank you, that does seem straight forward - not sure why I completely missed the tick boxes!  

With a bit of tweaking of the h_status your SQL statement has worked a treat thank you 

I'd like to request an enhancement that the request reference number is also shown on the list of tasks to reassign (in the Before Continue window) - @Steve Giller 

 I am still not sure what to do with the task when there is no replacement approver to reassign to though!

[Steve Giller]

4 minutes ago, Estie said:

I'd like to request an enhancement that the request reference number is also shown on the list of tasks to reassign (in the Before Continue window)

Although Tasks can be linked to Requests they are a Collaboration function, not Service Manager, so they are identified by their Task IDs - there is no requirement for them to be attached to anything, so it is unlikely we would display this in this window.

[Estie]

@Steve Giller I personally would not re-assign a task without looking at the request that it was raised in first.

Can you point me to where I would search for a task ID?

Any advice on dealing with an outstanding task with no other approver to reassign to?

[Steve Giller]

19 minutes ago, Estie said:

Any advice on dealing with an outstanding task with no other approver to reassign to?

The Task can be assigned to anyone with the correct Roles (which would be the Collaboration Role)
I'm not aware that there is anything stopping you assigning it to someone who already has one assigned, although it's not completely clear whether you are referring to Tasks or Authorisation Tasks.
There is also the option of including an Expiry on the Task/Authorisation, and also using Weighting so that the Authorisation does not require all Users to respond - once the required percentage is reached the other Authorisations will cancel.

[Estie]

@Steve Giller Thanks the tasks in question are created from an authorisation node in the BPM, so I think that means they are Authorisation tasks and have been set to Individual authorisation types by role.

I have reassigned one to the other approver in the approver role/group so they now have two assigned to them.

I see there is an option on each task within the request to delete the task.

As per @Adrian Simpkins original post above - if I delete one of the tasks will that affect the tasks assigned to the other users?  

On 27/07/2023 at 13:17, Adrian Simpkins said:

In effect they were a team of 4, but now a team of 3, so I just wanted to clarify am I just able to delete the task assigned to the users who have left without affecting the authorisation assigned to the other remaining team members as there is no one to assign these tasks to / the existing team members already have this task assigned to them. I don't want to assign this to one of them as that becomes a duplicate item. Image below shows the task is set to Individual authorisation as below