Access Restrictions and Safety Measures for Activate Non-Prod

The following options are useful when setting up QA, UAT or Test environments.

General access to the Activate Web Portal can be restricted by using the AvailableUsers parameter.  Only users in the specified role will be able to use Activate, anyone else will be directed to an unavailable page.  The message on this page can be customised.  This functionality is also useful for temporarily disabling access during an upgrade or more permanently for a QA/UAT environment.

Parameters to set on //Resources/Configuration/Web AvailableUsers – specifies the role to which you must belong to access Activate (note that the referenced role needs to be a dynamic one) UnavailableMessage – the message that shows to anyone who is not in the AvailableUsers role. Warning: The System Roles\Users is not an appropriate Role to use as the user won’t have rights to read the AvailableUsers parameter and it will not work correctly.  To achieve this, copy the users role membership definition and use this as the AvailableUsers value.

There are 2 different approaches to restricting what the Activate UAT Job Service Account can do within Active Directory. You can either use an Activate Function to restrict AD changes to objects in a specified OU only, this will allow the Job to complete without errors and will log in the Audit Log the groups that the user was not added to. Or you can use a different Service Account in AD which has limited rights within AD to make changes - this user could have write access on a specific OU to make testing easier.

Activate Function - OverrideUpdatableOU

This provides the ability to limit Activate to only updating objects in a specified OU within AD. This is designed for UAT environments which reside within the production AD environment where it is desirable to limit the UAT Server from updating production information. 

Navigate to //Resources/Configuration/ and create a new parameter with a type of OU Reference called: OverrideUpdatableOU Non updatable users and groups will fail with an audit log entry on the associated job.

You must restart the Activate Job Service/IIReset after setting this parameter for it to take effect. This can be tested by searching for users in a task like 'Update User' and the user will appear in the search list with a red strike-through. You can also test this by adding a test user to a Role that has a number of DefautUserGroup parameters assigned for Groups that are not in the OU specified for the OverrideUpdatableOU. The user will be added to the Activate Role but should not be added to any of the DefaultUserGroups.



Separate Job Service Account in Active Directory

You can configure the Activate UAT Job Service Account to use a different AD service account to the one being used by the Production Activate Job Service. This UAT Service Account can have limited permissions within Active Directory by using Delegated Access rights.

These options are normally configured with the 'OverrideEmailAddress' function below to send all email notifications to a common mailbox for UAT.

During testing in a production environment, it can sometimes be useful to redirect all emails to a single mailbox. This can be used to test workflows and notifications without sending the emails to production users or test users that do not have a mailbox.

To configure this, create a new parameter on //Resources/Configuration called "OverrideEmailAddress" of a string type, and specify the email address where emails should be redirected to. Ensure you restart the Activate Job Service and the Activate Web Pool (IISRESET).

Any emails to the override email address will have the subject prefixed with the original target, e.g. [email protected]: Services Approval Request: Manager Approval