Admin User Management - User & Permissions Management Scenarios

Scenarios

As part of Development, the following permissions have currently been set: /wiki/spaces/TISDEV/pages/111116298

Process Name	AM-1 Create New User Profile (manual)	Comments
Description	Once a new user has been imported via Oriel, or has been added to one of the internal HEE teams, a new profile is required so that they can login	Non-tis / manual process
Actors	System Admin (TIS Team) HR	TBC
Pre-Conditions	Notification received by team to set up new user on TIS Relevant authorisation given to create user	How should requests be made? Reuben Noot (Deactivated)
Post-Conditions	User profile setup on TIS
Process Steps	Login to Keyclock Add new user Assign applicable permissions for role Notify individual or applicant that user profile is available
Alternative Process	Automated profile creation (trainees only)	Is it possible to automate this process?
Rules	usual Keycloak rules user must have authorisation to proceed	Authorisation to be defined Request process to be defined
Jira Reference
Audit log

Process Name	AM-2 Remove a user profile (manual)
Description	Remove user access to TIS
Actors	System admin (TIS team) HR	TBC
Pre-Conditions	User should have access rights terminated via HR or line manager
Post-Conditions	User should no longer be able to login
Process Steps	Login to Keyclock Remove user Notify individual or applicant that user profile is now unavailable
Alternative Process	AM-3 Remove a user profile (automated)	Is it possible to automate this process?
Rules	Present error message when user attempts login	WIll users be restricted to using HEE / NHS email address? Can they change this at any point? Is audit log data retained and can it still be displayed on the front end once a profile has been removed? Do login attempts need to be tracked?
Jira Reference
Audit log

Process Name	AM-3 Remove a user profile (automated)
Description	Remove user access to TIS
Actors	TIS system
Pre-Conditions	User should have access rights terminated via HR or line manager
Post-Conditions	User should no longer be able to login
Process Steps	User is flagged as "inactive" in TIS / ERS	Is this possible? to be discussed with Graham
Alternative Process	AM-2 Remove a user profile (manual)
Rules	Notify HR when	Does anyone need to be notified when this occurs?
Jira Reference
Audit log

Process Name	Edit user profile
Description	Edit an existing user profile
Actors	System Admin User
Pre-Conditions	User already on TIS user database User request approved by relevant individual
Post-Conditions
Process Steps	User requests additional access System admin team receives requeset & authorisation Login to Keyclock Find user Assign applicable permissions according to request Notify individual or applicant that user profile is updated	Do we need SLAs defined for this?
Alternative Process	N/A
Rules	N/A
Jira Reference
Audit log