I have a process with one node to post an event to news feed. process initiator

venkats533 over 9 years ago

I have a process with one node to post an event to news feed. process initiator has very limited access to the process including news feed. So, I did not give permissions to the news feed to the group who will be initiating the process. The node to post an event to news feed is failing because of security. So, I have configured that node to execute as process designer instead of process initiator. So far so good. When this application is migrated to production environment, an Appian admin account is used to import the package. I have recommended to create a system user account some thing like "Deployment Engineer" and use this account to import the package. Since this will increase the number of users for license purpose, the organization went ahead with using the real person account as administrator to import the application. The production environment is synced with LDAP for authentication. So, when this individual ...

Discussion posts and replies are publicly visible

0 venkats533 over 9 years ago

...leaves the organization, the LDAP sync will make the user inactive. What will happen to the process model at that time. Will the process model still works as usual even though the process designer is inactive now ? I am thinking that the process will stop at the node because the designer is inactive user now. How to fix the problem if this happens (in other words, how to change the process model designer to a new administrator ?). A simple republish of the model is good enough ? Or create a new package with just the process models and re-import from UAT environment by the new administrator ?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Bishnu Panigrahi
Appian Employee
over 9 years ago

Is there a reason why they cannot import the application using the Administrator account that comes with the Appian installation? That way it does not take up a user license.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 venkats533 over 9 years ago

no specific reason, just that I consider out of box administrator is more sacred and much more powerful, hence stay away from it. this is a big organization with different groups sharing the same Appian instance. So I am recommending to have one admin account for each group, so we would know who did what.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Stefan Helzle
A Score Level 3
over 9 years ago

To change the model designer just republish it with another user.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Stefan Helzle
A Score Level 3
over 9 years ago

From my experience deactivating users in sync with LDAP can create a lot of trouble. I think creating a process to deactivate users is a better way. This process could handle several scenarios like still active tasks, model ownership, admin groups membership and so on. This process could be started when the user gets deactivated in AD.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PhilB
A Score Level 1
over 9 years ago

As Bishnu says, the models should be imported as an administrator account that will not be deactivated; I'd recommend creating a non-AD deployment account for exactly this purpose.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PhilB
A Score Level 1
over 9 years ago

Also, when we've had issue in the past with processes failing due to inactive users, we've created an application containing everything in the environment, exported it and then imported as the deployment user, which solves the problem by republishing everything as the deployment user.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel