Novell Doc: Identity Manager 3.5.1 User Application: Design Guide

7.5 Addressing an Approval Activity

To address an Approval activity, you must enter a valid expression for the Addressee property. In addition, the final number of approvals that are required to approve the activity is determined by the relationship between the Addressee property and the Approver Type property.

NOTE:If the expression specified in the Addressee property of an Approval activity evaluates to a non-existent DN (for example, if the expression was hard-coded incorrectly, calculated incorrectly, or submitted incorrectly by a user selection), no indication is given that the workflow is not processing normally, when it is in fact orphaned. The application server console displays a normal forward message, and the Comment and Flow history shows a normal “assigned” message. To avoid this problem, we recommend that you follow these best practices:

Use a Condition activity before the Approval activity and validate the addressee in the Condition activity.
Since the addressee could still be deleted after the addressee is validated in the Condition activity, you should specify, for the Approval activity, a timeout interval and a link that performs the desired action in case the workflow times out.

7.5.1 Valid Addressee Expressions

An Addressee expression (including expressions that return data abstraction layer Entities) must resolve to one of the following at runtime:

A valid individual addressee that can be a user DN or a group DN.
A valid list of addressees (for example, created using a Java vector object) that can contain multiple User DNs, or multiple group DNs, or a mixture of both.

The maximum number of approvals possible equals the number of Addressees (the number of User DNs plus the number of Group DNs) and does not include or count the individual members of a Group.

NOTE:A Group DN is always processed to contribute a single vote (that is, when one member of a group claims an activity, the rest of the members of the group can no longer see or claim the activity), regardless of the Approver Type.

The following table provides examples of valid addressee expressions that you can create using the ECMA expression builder.

Table 7-4 Examples of Addressee Expressions

Type of Expression	Example
Individual user DN	'cn=jdoe,ou=users,ou=mysample,o=myorg'
Individual group DN	'cn=Accounting,ou=groups,ou=mysample,o=myorg'
A vector of DNs (can include user or group DNs	function DNVector() { v=new java.util.Vector(); v.add('CN=jdoe,' + USER_CONTAINER); v.add('CN=Accounting,' + GROUP_CONTAINER); v.add('CN=jsmith,' + USER_CONTAINER); v.add('CN=bsmith,' + USER_CONTAINER); return v; }; DNVector(); In this example, the total number of addressees is four (three individuals and one user from the Accounting group).

Type of Expression

Example

Individual user DN

'cn=jdoe,ou=users,ou=mysample,o=myorg'

Individual group DN

'cn=Accounting,ou=groups,ou=mysample,o=myorg'

A vector of DNs (can include user or group DNs

function DNVector() { v=new java.util.Vector(); v.add('CN=jdoe,' + USER_CONTAINER); v.add('CN=Accounting,' + GROUP_CONTAINER); v.add('CN=jsmith,' + USER_CONTAINER); v.add('CN=bsmith,' +  USER_CONTAINER); return v; }; DNVector();

In this example, the total number of addressees is four (three individuals and one user from the Accounting group).

7.5.2 Relationship Between Addressee and Approver Type

The behavior of the workflow and the total number of affirmative approvals needed varies depending on the type of Addressee that is specified by the Addressee expression, and the Approver Type that is selected.

Normal Approver Type

The following table describes the workflow behavior when different types of addressee are used with the Normal Approver Type.

Table 7-5 Workflow Behavior with Normal Approver Type

Addressee Value	Description
Individual User DN or Entity	Only the user can see the Approval activity in their task list. Only one approval is needed to complete the activity as Approved.
Individual Group DN or Group Entity	Each member of Group can see the activity in the task list. When one member claims the activity, it is removed from the task lists of others. Only one approval is needed to complete the activity as Approved.
Multiple User DNs or User Entities (Virtual Group of Users)	Not allowed.
Multiple Group DNs or Group Entities (Virtual Group of Groups)	Not allowed.
Mixture of Users and Groups (Virtual Group Mixture)	Not allowed.

Group DNs and Proxy Processing

If a workflow is assigned to a Group and e-mail notification is used for the approvals, all members of the group are sent an e-mail. If a proxy user is assigned to any members of the group, the processing works as follows:

If the approver is a single user then the e-mail notification is sent to both users (the original and proxy users).
If the approver is a group DN and one of the users in the group is assigned a proxy user, the user who is the proxy is NOT notified by e-mail when a new request is placed in the task list.

If you want the proxy user to be notified by e-mail, assign the approval task to the members of the group and set the approver type to Group Approver. For example, if you assign the approval activity to:
```
IDVault.get('cn=Marketing,ou=groups,ou=idmsample,o=novell' , 'group','Member') 
```
When you set the approval type to Group, a notification is sent to each member's proxy, if the member has a proxy. One member of the group can claim and act on the approval task which is the same behavior as if you assigned it directly to the group DN.

Group Approver Type

The following table describes the workflow behavior when different types of addressee are used with the Group Approver Type.

Table 7-6 Workflow Behavior with Group Approver Type

Addressee Value	Description
Individual User DN or Entity	Only the user can see the Approval activity in their task list. Only one approval is needed to complete the activity as Approved.
Individual Group DN or Group Entity	Each member of Group can see the activity in their task list. When one member claims the activity, it is removed from task lists of others. Only one approval is needed to complete the activity as Approved.
Multiple User DNs or User Entities (Virtual Group of Users)	Each user in the virtual group can see the activity in their task list. When one user from the virtual group claims the activity, the activity is removed from the task lists of others. Only one approval is needed to complete the activity as Approved.
Multiple Group DNs or Group Entities (Virtual Group of Groups)	Each member in each of the groups can see the activity in their task list. When one user from the virtual group claims the activity, the activity is removed from the task lists of others in all of the groups. Only one approval is needed to complete the activity as Approved.
Mixture of Users and Groups (Virtual Group Mixture)	Each user and member of each Group of the mixed virtual group can see the activity in their task list. When one member from the virtual group claims the activity, the activity is removed from the task lists of others. Only one approval is needed to complete the activity as Approved.

Multiple Approver Type

The following table describes the workflow behavior when different types of addressee are used with the Multiple Approver Type.

Table 7-7 Workflow Behavior with Multiple Approver Type

Addressee Value	Description
Individual User DN or Entity	Only the user can see the activity in their task list. Only one approval is needed to complete the activity as Approved.
Individual Group DN or Group Entity	Each member of the group can see the activity in their task list. When one member claims the activity, the activity is removed from the task lists of others. Only one approval is needed to complete the activity as Approved.
Multiple User DNs or User Entities (Virtual Group of Users)	Each user in the virtual group can see the activity in their task list. Each user can claim the activity. Approval of each user is needed to complete the activity as Approved. Any single denial completes the activity as Denied.
Multiple Group DNs or Group Entities (Virtual Group of Groups)	Each member in each of the groups can see the activity in their task list. When one member from a group claims the activity, the activity is removed from the task list of others in that Group. Each group must supply one approval to complete the activity as Approved. Any single denial completes the activity as Denied.
Mixture of Users and Groups (Virtual Group Mixture)	Each user and each member of each group of the mixed virtual group can see the activity in their task list. Each user can claim the activity, and one member of each group can claim the activity (then others in the group do not see the task.) Each user and one member of each group must approve to complete the activity as Approved. Any single denial completes the activity as Denied.

Quorum Approver Type

The following table describes the workflow behavior when different types of addressee are used with the Quorum Approver Type.

Table 7-8 Workflow Behavior with Quorum Approver Type

Addressee Value	Description
Individual User DN or Entity	Only the user can see the activity in their task list. Only one approval is needed to complete the activity as Approved.
Individual Group DN or Group Entity	Each member of the group can see the activity in their task list. When one member claims the activity, the activity is removed from the task lists of others. Only one approval is needed to complete the activity as Approved.
Multiple User DNs or User Entities (Virtual Group of Users)	Each user in the virtual group can see the activity in their task list. All users in the virtual group can claim the activity simultaneously. An absolute number or specified percentage of Addressees must approve to complete the activity as Approved.
Multiple Group DNs or Group Entities (Virtual Group of Groups)	Each member in each group can see the activity in their task list. One member of each group can claim the task (then others in the group do not see the task). An absolute number or specified percentage of Addressees must approve to complete the activity as Approved.
Mixture of Users and Groups (Virtual Group Mixture)	Each user and each member of each Group of the mixed virtual group can see the activity in their task list. Each user can claim the activity, and one member of each group can claim the activity (then others in the group do not see the task). An absolute number or specified percentage of Addressees must approve to complete the activity as Approved.