Use > Catalogs > Approval Policies

Approval policies

This tab is available only when configuring a user-defined catalog, not the Global Shared Catalog.

Approval policies are based on one of four template types (see table below). These templates are not pre-configured because they are LDAP dependent. When a catalog is first created, an approval policy is automatically created from the User Context Template.

Template type Description
Delegated Template

Use this template to set up third-party approvals, which are configured by designating a process definition that will be used to communicate about the approval process requirements.

  • If selected, provide the following information:

    • External Approval Action - Select an action that will be used to communicate with Operations Orchestration. To add Operations Orchestration flows, see the "Import Operations Orchestration Flows" section in the Cloud Service Automation Configuration Guide Cloud Service Automation Configuration Guide for more information.

      Click Select and search for flows or actions by name (when searching for a flow, the folders searched in the Operations Orchestration library are determined by a property configured in the csa.properties file; see the "Action Selection Wizard" property description section in the Cloud Service Automation Configuration Guide Cloud Service Automation Configuration Guide for more information) or select the process engine from which to select a flow or action. Then, locate and select the flow or action.

    • Check Automatic Approval and provide the following information:

      • Automatic Approve/Deny - Select one of the following replies:
        • Approved - Automatically approve the request when the specified Wait Time for Automatic Approval (in days) period has elapsed.
        • Denied - Automatically deny the request when the specified Wait Time for Automatic Approval (in days) period has elapsed.
      • Wait Time for Automatic Approval (in days) - Select the number of days after which, if no response is made, the automatic approval or rejection will occur.
Named Approver Template

Use this template to assign one or more users from the organization as approvers for all subscription requests. You can also set the number of approvals required for a subscription request to be fulfilled.

  • If selected, provide the following information:
    • Add Approver - Provide the LDAP user name of the approver you want to add, and click Add Approver. Repeat to add more approvers.
    • Minimum Approvals/Denials - Select the minimum number of approvers required to either approve or reject an approval request.
      • Check Automatic Approval, if desired, and provide the following information:
        • Automatic Approve/Deny - Select one of the following replies:
          • Approved - Automatically approve the request when the specified Wait Time for Automatic Approval (in days) period has elapsed.
          • Denied - Automatically deny the request when the specified Wait Time for Automatic Approval (in days) period has elapsed.
        • Wait Time for Automatic Approval (in days) - Select the number of days after which, if no response is made, the automatic approval or rejection will occur.
Named Group Template

Use this template to base approvals on an LDAP group. By default, csa.properties is set to csa.group.numberOfApprovers=10, which restricts the size of the group that can be selected as a named group for approval. This property validates the minimum number of approvals and denials that are filed. If you specify a number that is greater than the number of group users, or a number that is greater than what is specified in csa.group.numberOfApprovers=10 (where the group has more users than this setting), the approval will not be created. If you want to use groups with more members, you can change the value. However, if you select a very large group (such as thousands of members), you might experience performance problems interacting with LDAP.

  • If selected, provide the following information:
    • Add Group - Select or type the DN for the LDAP group or organizational unit you want to use for approvals. The members of the selected group (at the time of the request) will be set as approvers of the request.
    • Minimum Approvals/Denials - Select the minimum number of approvers required to either approve or reject an approval request.
    • Check Automatic Approval and provide the following information:

      • Automatic Approve/Deny - Select one of the following replies:
        • Approved - Automatically approve the request when the specified Wait Time for Automatic Approval (in days) period has elapsed.
        • Denied - Automatically deny the request when the specified Wait Time for Automatic Approval (in days) period has elapsed.
      • Wait Time for Automatic Approval (in days) - Select the number of days after which, if no response is made, the automatic approval or rejection will occur.
User Context Template

Use this template to base approvals on LDAP membership settings and structure, as configured in the Organizations area of the Cloud Service Management Console.

  • If selected, provide the following information:
    • Approval Levels - Select the number of managers in the organization chain who will be asked to approve the request. For example, if you select two, the subscriber's first and second-level manager will be required to approve the request. Take care when configuring multi-level approvals. If the approval level is configured so that the last approver in the approval chain is the top-level manager who is still at a lower level than the configured approval level, it is important that the manager attribute of that top level manager is set to himself or herself to indicate the end of approval chain.
    • Check Automatic Approval, if desired, and provide the following information:
      • Automatic Approve/Deny - Select one of the following replies:
        • Approved - Automatically approve the request when the specified Wait Time for Automatic Approval (in days) period has elapsed.
        • Denied - Automatically deny the request when the specified Wait Time for Automatic Approval (in days) period has elapsed.
      • Wait Time for Automatic Approval (in days) - Select the number of days after which, if no response is made, the automatic approval or rejection will occur.

Tasks

  • Add a policy — In the Add Approval Policy dialog, enter a name, select one of the four template types, and use the check box if the policy should be automatically approved.
  • Set the default policy — In the Set Default Policy dialog, select the default policy that will be used when publishing service offerings.
  • Edit a policy — All fields are editable, except for the Approval Policy Template. For a certain approval policy, click the gear icon and select Edit.
  • Delete a policy — Deletes the policy that the user created, but the template persists. For a certain approval policy, click the gear icon and select Remove.

Best practices

When you create an approval policy, make sure that all approvers are granted access to the catalogs for which they will be approving subscription requests.