A role is a set of permissions to access specified functionalities and resources in ProcessMaker. Each user is assigned a role, which determines what actions that user can perform in ProcessMaker and what parts of the interface that user can access.
To see the available roles, login to ProcessMaker with a user such as the "admin" who has the PM_USERS permission in his/her role. Then, go to ADMIN > Users > Roles and the following list will display:
The PROCESSMAKER_ADMIN role is designed for system administrators and process designers who need access to all the features and functionality in ProcessMaker. Users who are assigned this role can do everything, including configure the system, create and edit processes, manage users and groups, manage cases, and oversee productivity with reports and dashboards.
The PROCESSMAKER_MANAGER role is for users who need to manage cases, users and groups and oversee productivity, but do not need to design processes or configure ProcessMaker.
The PROCESSMAKER_OPERATOR role is for normal production users who just need to login and run cases.
Note: If a role is set as INACTIVE, and a user is assigned to that role, the user can NOT login to ProcessMaker until the role is changed to ACTIVE
If these three sets of permissions do not suit your organization's needs, the three default roles can be modified and new roles can be created as well. To customize roles, see the following descriptions of the available permissions which can be assigned to a role.
Note: Remember that if any of the role's permissions is changed (removed/added), it is necessary to update the process design to fit the new assigned or removed permissions.
The 3 roles explained below has the following permissions:
To check permissions for each role, select the role and click on Permissions:
The PM_LOGIN permission gives rights to login into ProcessMaker. Every role should include this permission. Without this permission, the following error message will appear when trying to login:
The PM_SETUP permission provides access to the ADMIN menu and its basic options, including Email Servers, Calendar, Process Category, Skins, Heart Beat, Environment, Clear Cache, Login and Case Scheduler Log.
Note: Additional permissions have been created for each ADMIN functionality. These permissions must be accompanied by the PM_SETUP permission in order to gain access to the ADMIN menu.
The PM_FACTORY permission provides access to the DESIGNER menu and rights to create, edit and delete processes.
The PM_CASES permission provides access to the HOME menu and the ability to run cases and view lists of cases which the user has been assigned to or participated in. This permission provides access to the Cases section in the sidebar and its suboptions: New Case, Inbox, Draft, Participated, Unassigned and Paused.
In addition, it provides access to the Documents option, which allows users to view any files which were uploaded (Input Documents and attached files) or generated (Output Documents) while running cases.
Warning: Users should only be able to view documents which they have rights to see
The PM_ALLCASES permission provides access to the Advanced Search option under the HOME tab. The Advanced Search permits users to search particular cases among all cases of all users in the current workspace. This feature narrow the search using the following search criteria: Category, Process, Status, User, Delegated Date, and Case Number.
To search a case, enter the search criteria and click on the "Search" button. All cases matching the search criteria will be listed as follow.
A case listed can be opened by double-clicking on it or selecting the case and clicking on the "Open" button.
In order to view a case, the user needs to be either assigned to work on the case, assigned with Process Permissions, or assigned as a Process Supervisor. Otherwise, only the details of the selected case will be shown.
This permission must be accompanied by the PM_CASES permission in order to gain access to the HOME menu.
The PM_REASSIGNCASE permission provides the ability to reassign cases to other users. Note that a case can only be reassigned to users who are either in the assignment pool for the current task or in its ad hoc assignment pool. Other users can NOT be assigned to the case. Note that this permission enables the reassign option for all cases of all processes.
This permission adds the Reassign option to the Actions menu, which is available under the Inbox and Draft options and when running a case. Note that it is NOT possible to reassign cases under the Review, Advanced, Participated, Participated or Paused options, nor is it possible when opening a case summary or read-only access with Process Permissions.
It also enables the Reassign option under the Supervisor menu.
The PM_REASSIGNCASE permission needs to be accompanied by the PM_CASES permission, in order to access the HOME menu.
The PM_SUPERVISOR permission allows a user to be assigned as a Process Supervisor, which allows a user to view and modify data in DynaForms and Input Documents for designated processes. This permission adds the Supervisor section to the sidebar under the HOME menu. This option shows a list of cases which the Process Supervisor can review. Only cases with a "To Do" or "Draft" status are shown in the list and the cases must be from processes where the user has been assigned as a Process Supervisor.
Note: Please take note that if the PM_SUPERVISOR permission is removed from the supervisor user's role, he/she won't be able to access the Review option in the Process Supervisor menu or perform any action over the cases even if he/she remains assigned as a user supervisor. Therefore, please remember that if any permission is changed, removed or added to a role, it is necessary to update the process design to fit the new assigned or removed permissions.
After opening the case, the DynaForms and Output Documents which can be edited by the Supervisor will be available inside a "Step List" dialog box.
The PM_SUPERVISOR permission also allows the user to pause cases by going to Actions > Pause, however it doesn't grant the power to delete, cancel or reassign cases. Separate permissions are needed for those abilities.
The PM_SUPERVISOR permission needs to be accompanied by the PM_CASES permission, in order to access the HOME menu. It is a good idea to also assign Process Permissions to the Process Supervisor user. Otherwise, he/she can not use the standard Steps and Information menus to find out more information about the case.
If the Supervisor user also has the PM_REASSIGNCASE_SUPERVISOR permission, the Reassign menu option will be available.
The PM_SETUP_ADVANCE permission provides access to advanced setup options under the ADMIN menu, including the Logo, PM Tables, Dashboards, Languages and Cases List Cache Builder options under the Settings tab, the Plugins tab, and the Authentication Sources option under the Users tab. This permission must be accompanied by the PM_SETUP permission in order to gain access to the ADMIN menu.
The PM_DASHBOARD permission provides access to the DASHBOARD menu and the ability to see ratios of completed versus open cases for different time periods.
The PM_DASHBOARD permission provides the ability to use WebDAV (Web-based Distributed Authoring and Versioning) to upload and download files to the ProcessMaker server from the internet.
The PM_EDITPERSONALINFO permission allows users to edit their personal information, such as their account passwords, without requiring the PM_USERS permission in their role. The personal information of a user can be edited by clicking on his/her username in the upper right-hand corner of the ProcessMaker header.
The PM_FOLDERS_VIEW allows a user to view folders and download files under HOME > Documents, but now all users with the PM_CASES permission have access to HOME > Documents. Note that users can only see files from cases which they are designated to work on or they have Process Permissions to access.
The PM_FOLDERS_ADD_FOLDER permission allows a user to add folders under HOME > Documents.
The PM_FOLDERS_ADD_FILE permission allows a user to add and delete files under HOME > Documents.
Only cases which are still in their initial task can be deleted, meaning that they can be removed from the database. Once cases are routed onto subsequent tasks, they can only be canceled, not deleted. Any user who is designated to work on the initial task of a case can delete it by opening the case and selecting Actions > Delete in the menu.
The PM_DELETECASE permission allows cases in their initial tasks to be deleted by a user who NOT the designated user to work on the initial task. However, the only way a non-designated user can open a case so that it can be deleted is to be a Process Supervisor who accesses the case by going to HOME > Review.
Note: When a case is deleted, its record is removed from the wf_
The PM_CANCELCASE permission allows a user to cancel cases that have been assigned to him/her, cases where he/she has participated and cases that the user can search as a Process Supervisor under HOME > Review. This means:
- If a user has permissions to see only the cases that he/she is assigned to. He/She will be able to cancel those cases.
- If a user has the PM_ALLCASES permission in addition to the PM_CANCELCASE permission, the user will be able to cancel any case through Advanced Search.
- If a user has the PM_SUPERVISOR permission in addition to PM_CANCELCASE, the user will be able to cancel all the cases that are in the review case list (where the cases of the process where he/she is supervisor will be displayed).
- If a non-supervisor user is assigned with this permission, this user will NOT be able to reassign cases until he/she is marked as supervisor of a process.
- If the PM_REASSIGN_SUPERVISOR permission is assigned to a supervisor user (PM_SUPERVISOR) but the user is not currently assigned to any process, then he/she can NOT reassign any cases.
- If any of the previous conditions fail then the following message will be displayed:
- Code: Enter a unique identifier for the role.
- Name: Enter a name for the role, which will be displayed in the role list.
- Status: Select whether the role is "Active" or "Inactive". A role which is set to "Inactive" can not be assigned to users.
Cases can be canceled by opening a case and going Action > Cancel.
When a case is canceled, its status is changed to Canceled and it can no longer be worked on. The case can still be opened in read-only mode by going to HOME > Participated or HOME > Advanced Search, so its data can be accessed, but not changed. Cases in their initial task can only be deleted, not canceled.
The PM_CANCELCASE permission should be accompanied by the PM_CASES permission to access the HOME menu. If needing to cancel other user's cases, it should also be accompanied by the PM_SUPERVISOR permission.
Note 1: Once a case has been canceled, there is no way to uncancel it in the ProcessMaker interface; however, it is possible to uncancel a case with the PMFUnCancelCase() function.
The PM_FOLDER_DELETE permission allows a user to delete a folder under HOME > Documents.
The PM_SETUP_LOGO permission allows users editing the logo of ProcessMaker. By default, ProcessMaker appears with its logo at the top of the screen, this logo can be replaced with the logo of your business or organization. This permission must be accompanied by the PM_SETUP permission in order to gain access to the ADMIN menu. For more information, please check the Logo information page.
The PM_SETUP_EMAIL permission allows users configuring emails servers to allow ProcessMaker to send out email notifications. This permission must be accompanied by the PM_SETUP permission in order to gain access to the ADMIN menu. For more information, please check out the Manage Multiple Email Accounts page.
The PM_SETUP_CALENDAR permission allows users configuring calendars that allow process designers to specify the hours and days when users are expected to be at work, so that the due dates for tasks can be more accurately calculated. This permission must be accompanied by the PM_SETUP permission in order to gain access to the ADMIN menu. For more information, please check out the Calendars page.
The PM_SETUP_PROCESS_CATEGORIES permission allows users managing processes categories. This permission must be accompanied by the PM_SETUP permission. For more information, please check out the Process Categories page..
The PM_SETUP_CLEAR_CACHE permission allows users to clearing the ProcessMaker cache in order to speed up ProcessMaker or avoid possible issues. This permission works along with the PM_SETUP permission. For more information, please check Clear Cache page.
The PM_SETUP_HEART_BEAT permission allows users sending statistics to the ProcessMaker developers about how ProcessMaker is being used, including the number of workspaces, processes, users and cases. This permission must be accompanied by the PM_SETUP permission. For more information, please check out the Heart Beat page.
The PM_SETUP_ENVIRONMENT permission allows users configuring ProcessMaker Environment settings. This permission must be accompanied by the PM_SETUP permission. For more information, please check out the Environment Settings page.
The PM_SETUP_PM_TABLES permission allows users to manage PMTables that store data which will be used in DynaForms or Output Documents. This permission must be accompanied by the PM_SETUP permission. For more information, please check out the PM Tables page.
The PM_SETUP_LOGIN permission allows users to configure Login Settings. The user with this permission can choose the "Default Language" for the current workspace, and either enable or disable the option "Forgot Password". This permission must be accompanied by the PM_SETUP permission. For more information, please check the Login Settings page.
The PM_SETUP_DASHBOARDS permission allows users to manage Dashlets Instances. This permission must be accompanied by the PM_SETUP and the PM_DASHBOARD permission. For more information, please check out the Dashboards page.
The PM_SETUP_LANGUAGE permission allows users to manage languages in ProcessMaker. This permission must be accompanied by the PM_SETUP and the PM_SETUP_ADVANCE permissions in order to gain access to the ADMIN menu.For more information, please check out the Languages page..
The PM_SETUP_SKIN permission allows users to change the visual appearance to the ProcessMaker interface. This permission must be accompanied by the PM_SETUP permission in order to gain access to the ADMIN menu. For more information, please check out the Skins page..
The PM_SETUP_CASES_LIST_CACHE_BUILDER permission allows users rebuilding the Cases List Cache. This permission must be accompanied by the PM_SETUP and the PM_SETUP_ADVANCE permissions in order to gain access to the ADMIN menu. For more information, please check out the Clearing the Case List Cache page..
The PM_SETUP_PLUGINS permission allows users having access to the Plugins tab. This permission must be accompanied by the PM_SETUP and the PM_SETUP_ADVANCE permissions in order to gain access to the ADMIN menu. For more information, please check out the Plugins page..
The PM_SETUP_USERS_AUTHENTICATION_SOURCES permission allows users configuring properties to authenticate external users. This permission must be accompanied by the PM_SETUP, the PM_SETUP_ADVANCE and the PM_USERS permission. For more information, please check out the External Authentication page..
The PM_DELETE_PROCESS_CASES permission enables an additional button on the toolbar inside the Designer Menu. The Delete Cases button allows users deleting all cases of a specific process.
The PM_EDITPERSONALINFO_CALENDAR permission allows users change their calendar preference in their profile accounts without requiring to have the PM_USERS permission in their role. The calendar preference of a user can be edited by clicking on his/her username in the upper right-hand corner of the ProcessMaker header.
Selecting the Edit button at the end of the profile page.
The calendar drop-down box will be available to be changed.
The PM_UNCANCELCASE permissions allows users to uncancel cases with the help of the PMFUnCancelCase() function. Notice that only roles with this permission are able to uncancel a case.
The PM_REST_API_APPLICATIONS allows users to access the User External Applications section. Only users with this permissions assigned to their role, have access to the following address:
Otherwise, the user will be warned that he/she does not have the rights to access the page.
Permissions to edit the User Profile
The following permissions allow users to edit the information contained in the User Profile. Each field or section of the user profile has one permission assigned.
|PM_EDIT_USER_PROFILE_FIRST_NAME||Allows users to edit the First Name field of the user profile.|
|PM_EDIT_USER_PROFILE_LAST_NAME||Allows users to edit the Last Name field of the user profile.|
|PM_EDIT_USER_PROFILE_USERNAME||Allows users to edit the Username field of the user profile.|
|PM_EDIT_USER_PROFILE_EMAIL||Allows users to edit the Email field of the user profile.|
|PM_EDIT_USER_PROFILE_ADDRESS||Allows users to edit the Address field of the user profile.|
|PM_EDIT_USER_PROFILE_ZIP_CODE||Allows users to edit the Zip code field of the user profile.|
|PM_EDIT_USER_PROFILE_COUNTRY||Allows users to edit the Country field of the user profile.|
|PM_EDIT_USER_PROFILE_STATE_OR_REGION||Allows users to edit the State or Region field of the user profile.|
|PM_EDIT_USER_PROFILE_LOCATION||Allows users to edit the Location field of the user profile.|
|PM_EDIT_USER_PROFILE_PHONE||Allows users to edit the Phone field of the user profile.|
|PM_EDIT_USER_PROFILE_POSITION||Allows users to edit the Position field of the user profile.|
|PM_EDIT_USER_PROFILE_REPLACED_BY||Allows users to edit the Replaced by field of the user profile.|
|PM_EDIT_USER_PROFILE_EXPIRATION_DATE||Allows users to edit the Expiration Date field of the user profile.|
|PM_EDIT_USER_PROFILE_CALENDAR||Allows users to edit the Calendar field of the user profile.|
|PM_EDIT_USER_PROFILE_STATUS||Allows users to edit the Status field of the user profile.|
|PM_EDIT_USER_PROFILE_ROLE||Allows users to edit the Role field of the user profile.|
|PM_EDIT_USER_PROFILE_TIME_ZONE||Allows users to edit the Time Zone field of the user profile.|
|PM_EDIT_USER_PROFILE_DEFAULT_LANGUAGE||Allows users to edit the Default Language field of the user profile.|
|PM_EDIT_USER_PROFILE_COSTS||Allows users to edit the Cost by hour and Units fields of the user profile.|
|PM_EDIT_USER_PROFILE_PASSWORD||Allows users to edit the Password field of the user profile.|
|PM_EDIT_USER_PROFILE_USER_MUST_CHANGE_PASSWORD_AT_NEXT_LOGON||Allows users to edit the User must change password at next logon field of the user profile.|
|PM_EDIT_USER_PROFILE_PHOTO||Allows users to edit the Photo field of the user profile.|
|PM_EDIT_USER_PROFILE_DEFAULT_MAIN_MENU_OPTIONS||Allows users to edit the Default Main Menu Option field of the user profile.|
|PM_EDIT_USER_PROFILE_DEFAULT_CASES_MENU_OPTIONS||Allows users to edit the Default Cases Menu option field of the user profile.|
Once under the Users tab, select the user and click on the Edit button. The form used to create the user will open displaying the personal information of the user where the enabled fields (depending on the corresponding permissions assigned to the user’s role) may be edited.
The PM_EDIT_USER_PROFILE_* permissions need to be accompanied by the PM_EDITPERSONALINFO permission to allow users to modify his/her own profile information by clicking on his/her username in the upper right-hand corner of the ProcessMaker header.
For example, if the user’s role contains the PM_EDIT_USER_PROFILE_FIRST_NAME permission (accompanied by the PM_EDITPERSONALINFO permission) then the user can modify his/her own first name in the form.
This permission enables the Reassign option under the Supervisor header in the HOME menu's sidebar, which displays a list of all the cases in the workspace which have "To Do" or "Draft" status.
The supervisor can also reassign cases by opening them from the Review option under the Supervisor header and selecting the Actions menu.
Notice the following considerations:
If wanting to have the Reassign option enable for all cases without having to be assigned as a Supervisor, the user has to be assigned with the PM_REASSIGN permission.
Creating and Editing Roles
If the 3 default roles are not adequate for the users in your organization, custom roles can be created. To create a new role, go to USERS > ROLES and click on the New link at the top of the list of roles. Then define the properties of the new role.
When done defining the role, click on Save to add the new role.
The new role should now appear in the list of roles. Now assign permissions to the new role by clicking on its Permissions link.
Click on Permissions to add a permission to the role, then click on Edit Permissions and a list of the available permissions will appear:
Select the permission to add and click on ">" for one permission or ">>" for all permissions.
To edit the name and properties of an existing role, go to USERS > ROLES and click on the Edit link for the link.
To edit the list of permissions in an existing role, go to USERS > ROLES and click on the Permissions for the role.
Note: All roles need to include the PM_LOGIN permission in order to function correctly. Without PM_LOGIN, the user can't login to access the rest of the functionality in ProcessMaker.