Admin User Management (roles and permissions)

Page Contents:

• Description
• Scope
• User Journey 
• Related JIRA ticket links
• For Discussion & Assumptions
• Agreed Next Steps
• Admin User Management - User Profile Creation
• Admin User Management - Roles & Permissions
• Admin User Management - Field Validation (PLACEHOLDER)
• Admin User Management - User & Permissions Management Scenarios
• Admin User - Password Management Scenarios DRAFT (WIP)
• Admin User Management - Password Management Policy
• Admin User Management - Exploring the User Management solution design | Keycloak and TIS Profile service for Managing Users
• Admin User Management - Feedback

Description

Admin User Management encompasses creating accounts on TIS for new admins, roles management, admin authentication (login), password self management (password recovery) and leavers. It will include any advances in admin security such as two factor authentication.

Component: TIS-709

Linked to Admin UI

Scope

• profile creation
• manage users << as specified for Admin UI
• user password reset << as specified for Admin UI

MVP

There are 9 roles available in TIS

• HEE Trust Admin
  - can view/edit trainees associated with their Trust in either a training or employment capacity
• HEE Admin
  - can view/create/edit/delete all components except Revalidation, Sensitive Data (within People) and Reference data
• HEE Admin Sensitive
  - can view/create/edit/delete all components except Revalidation and Reference data
• HEE Admin Reval
  - can view/create/edit/delete all components except Sensitive Data (within People) and Reference data
• HEE TIS Admin
  - can view/create/edit/delete everything
• HEE Trust Observer
  - can view trainees associated with their Trust in either a training or employment capacity
• HEE Programme Observer
  - can view trainees associated with their Programme
• HEE Programme Admin
  - can view/create/edit trainees associated with their Programme
• HEE User Admin
• - can view/create/edit/delete TIS users via the UM pages

Roles consist of the following:

(i) HEE Trust Admin

• can view/edit People limited to Trainees and Trainers 'related' to their Trust - (Trainee → Placement - Post - Employing Body and/or Training body)
• can view/edit the People L3 tabs containing Personal Details, Placements and Programme Memberships, Sensitive Data (the 4 actual Sensitive Data fields are hidden)
• cannot view/edit the People L3 tabs containing Qualifications or Assessments
• can view only / not edit Posts, limited to posts 'related' to their Trust (Post → Employing Body and/or Training body)
• can view only / not edit all Programmes.
• For clarity, HEE Trust Admins will NOT have access to the TIS Admin section, Revalidation & Concerns
• For clarity, as the Trainee/trainer 'related' to their Trust includes 'All' Placements, historical, current and future. The HEE Trust Admin will therefore see Trainees across a range of Local Offices.

Users with this role would have specified permissions as above

(ii) HEE Admin

• can view/create/edit/delete the following components (People, Posts, Programmes, Placements, Assessments)
• can view/delete Form Rs
• cannot view/create/edit/delete Sensitive Data fields in the Sensitive Data L3 (in People)
• cannot view/create/edit/delete Admin L1
• cannot view/create/edit/delete Concerns, Revalidation and Manage Connections

(iii) HEE Admin Sensitive

• can view/create/edit/delete the following components (People, Posts, Programmes, Placements, Assessments)
• can view/create/edit/delete Sensitive Data L3 (in person data fields in the Sensitive Data L3)
• can view/delete Form Rs
• cannot view/create/edit/delete Admin L1
• cannot view/create/edit/delete Concerns, manage connections and Revalidation

(iv) HEE Admin Reval

• can view/create/edit/delete all components (People, Posts, Programmes, Placements, Assessments)
• can view/delete Form Rs
• cannot view/create/edit/delete Sensitive Data fields in the Sensitive Data L3 (in person data)
• cannot view/create/edit/delete Admin L1
• can view/create/edit/delete Concerns, manage connections and Revalidation

(v) HEE TIS Admin

• can view/create/edit/delete everything

Users with this role would have permissions of HEE Admin + HEE Revalidation + HEE Admin Sensitive + Reference Data

(vi) HEE Trust Observer

• can view People 'related' to their Trust - (Trainee → Placement - Post - Employing Body and/or Training body)
• can view the People L3 tabs containing Personal Details, Placements and Programme Memberships, Sensitive Data (the 4 actual Sensitive Data fields are hidden)
• cannot view/edit the People L3 tabs containing Qualifications or Assessments
• can view Posts, limited to posts 'related' to their Trust (Post → Employing Body and/or Training body)
• can view only (not edit) all Programmes.
• For clarity, HEE Trust Users will NOT have access to the TIS Admin section (Reference data), Revalidation, Manage Connections & Concerns
• For clarity, as the Trainee/trainer 'related' to their Trust includes 'All' Placements, historical, current and future. The HEE Trust User will therefore see Trainees across a range of Local Offices.

(vii) HEE Programme Observer

• can view People 'related' to their Programme - (Trainee → Programme Membership - Programme)
• can view the People L3 tabs containing Personal Details, Placements, Programme Memberships, Assessments and Sensitive Data (the 4 actual Sensitive Data fields are hidden)
• cannot view/edit the People L3 tabs containing Qualifications
• can view Posts, limited to posts 'related' to their Programme (Post → Programme)
• can view only (not edit) all Programmes.
• can view only (not edit) all Assessments related to their Programme
• For clarity, HEE Programme Users will NOT have access to the TIS Admin section (Reference data), Revalidation, Manage Connections & Concerns
• For clarity, the HEE Programme User will see the historical and current programmes of the trainee but will only see the Current trainees in their Programme.
• Cannot access Placement Planning Tool

(viii) HEE Programme Admin - 

TISNEW-2791 - Getting issue details... STATUS

• can view/create/edit People 'related' to their Programme - (Trainee → Programme Membership - Programme)
• can view/create/edit the People L3 tabs containing Personal Details, Placements, Programme Memberships, Assessments and Sensitive Data (the 4 actual Sensitive Data fields are hidden)
• cannot view/edit the People L3 tabs containing Qualifications
• Can view/edit/create placements, Personal Details and Programme Memberships, via the People L3 tabs for the People they have access to
• can only view Posts, limited to posts 'related' to their Programme/s (Post → Programme) -  TIS21-77 - Getting issue details... STATUS  - (no edit/create) - This needs correcting on Prod, fine on stage.
• can only view (not edit) all Programmes.

• Can only view assessments in a trainee programme related to their programme - so see the trainee and only those assessments linked to the programme or programmes the user is responsible for - This needs correcting on Prod, fine on stage.
• For clarity, HEE Programme Users will NOT have access to the TIS Admin section (Reference data), Revalidation, Manage Connections & Concerns
• For clarity, the HEE Programme User will see the historical and current programmes of the trainee but will only see the Current trainees in their Programme.
• Can access Placement Planning Tool based for the programme they have been setup with in UM and view/create/edit placements for that programme
• Does NOT have access to the TIS Admin section, Revalidation & Concerns

(ix) HEE User Admin (this is a stand alone role as some service desk users only need to be able to administer users while not being able to access the TIS app)

• can view/create/edit/delete TIS users
• will need ProfileAdmin role to have access to users' profiles.

SERVICE DESK

Users will only be given access to the role/s the TIS Account Management form states they need. If no role is provided the user cannot be created.

Post-MVP Roles

TBC e.g. Trainee etc

_______________________

Reporting Considerations

JIRA Link

https://hee-tis.atlassian.net/secure/RapidBoard.jspa?rapidView=13&projectKey=TIS&view=planning&selectedIssue=TIS-709&quickFilter=64&selectedVersion=11700

Discussion & Assumptions