- Overview
- Managing Roles
- Managing Permissions
- PM_LOGIN
- PM_SETUP
- PM_USERS
- PM_FACTORY
- PM_CASES
- PM_ALLCASES
- PM_REASSIGNCASE
- PM_SUPERVISOR
- PM_SETUP_ADVANCE
- PM_DASHBOARD
- PM_WEBDAV
- PM_EDITPERSONALINFO
- PM_FOLDERS_VIEW
- PM_FOLDERS_ADD_FOLDER
- PM_FOLDERS_ADD_FILE
- PM_DELETECASE
- PM_CANCELCASE
- PM_FOLDER_DELETE
- PM_SETUP_LOGO
- PM_SETUP_EMAIL
- PM_SETUP_CALENDAR
- PM_SETUP_PROCESS_CATEGORIES
- PM_SETUP_CLEAR_CACHE
- PM_SETUP_HEART_BEAT
- PM_SETUP_ENVIRONMENT
- PM_SETUP_PM_TABLES
- PM_SETUP_LOGIN
- PM_SETUP_DASHBOARDS
- PM_SETUP_LANGUAGE
- PM_SETUP_SKIN
- PM_SETUP_CASES_LIST_CACHE_BUILDER
- PM_SETUP_PLUGINS
- PM_SETUP_USERS_AUTHENTICATION_SOURCES
- PM_SETUP_LOGS
- PM_DELETE_PROCESS_CASES
- PM_EDITPERSONALINFO_CALENDAR
- Creating and Editing Roles
Overview
A role is a set of permissions to access specified functionalities and resources in ProcessMaker. Each user is assigned a role, which determines what actions that user can perform in ProcessMaker and what parts of the interface that user can access.
Managing Roles
To see the available roles, login to ProcessMaker with a user such as the "admin" who has the PM_USERS permission in his/her role. Then, go to ADMIN > Users > Roles and the following list will display:
PROCESSMAKER_ADMIN
The PROCESSMAKER_ADMIN role is designed for system administrators and process designers who need access to all the features and functionality in ProcessMaker. Users who are assigned this role can do everything, including configure the system, create and edit processes, manage users and groups, manage cases, and oversee productivity with reports and dashboards.
PROCESSMAKER_MANAGER
The PROCESSMAKER_MANAGER role is for users who need to manage cases, users and groups and oversee productivity, but do not need to design processes or configure ProcessMaker.
PROCESSMAKER_OPERATOR
The PROCESSMAKER_OPERATOR role is for normal production users who just need to login and run cases.
Note: If a role is set as INACTIVE, and a user is assigned to that role, the user can NOT login to ProcessMaker until the role is changed to ACTIVE
Managing Permissions
If these three sets of permissions do not suit your organization's needs, the three default roles can be modified and new roles can be created as well. To customize roles, see the following descriptions of the available permissions which can be assigned to a role:
The 3 roles explained below has the following permissions:
To check permissions for each role, select the role and click on Permissions:
PM_LOGIN
The PM_LOGIN permission gives rights to login into ProcessMaker. Every role should include this permission. Without this permission, the following error message will appear when trying to login:
PM_SETUP
The PM_SETUP permission provides access to the ADMIN menu and its basic options, including Email Servers, Calendar, Process Category, Skins, Heart Beat, Environment, Clear Cache, Login and Case Scheduler Log.
Note: From version 3.0.1.8, additional permissions have been created for each ADMIN functionality. These permissions must be accompanied by the PM_SETUP permission in order to gain access to the ADMIN menu.
PM_USERS
The PM_USERS permission provides access to the Users tab under the ADMIN menu and the ability to create, edit and delete users, groups, departments and roles.
Note: This permission does NOT provide access to the ADMIN > Users > Authentication Sources option, which is provided by the PM_SETUP_ADVANCE permission.
PM_FACTORY
The PM_FACTORY permission provides access to the DESIGNER menu and rights to create, edit and delete processes.
PM_CASES
The PM_CASES permission provides access to the HOME menu and the ability to run cases and view lists of cases which the user has been assigned to or participated in. This permission provides access to the Cases section in the sidebar and its suboptions: New Case, Inbox, Draft, Participated, Unassigned and Paused.
In addition, it provides access to the Documents option, which allows users to view any files which were uploaded (Input Documents and attached files) or generated (Output Documents) while running cases.
Warning: Users should only be able to view documents which they have rights to see
PM_ALLCASES
The PM_ALLCASES permission provides access to the Advanced Search option under the HOME tab. The Advanced Search permits users to search particular cases among all cases of all users in the current workspace. This feature narrows the search using the following search criteria: Category, Process, Status, User, Delegated Date, and Case Number.
To search a case, enter the search criteria and click on the "Search" button. All cases matching the search criteria will be listed as follow.
A case listed can be opened by double-clicking on it or selecting the case and clicking on the "Open" button.
In order to view a case, the user needs to be either assigned to work on the case, assigned with Process Permissions, or assigned as a Process Supervisor. Otherwise, only the details of the selected case will be shown.
This permission must be accompanied by the PM_CASES permission in order to gain access to the HOME menu.
PM_REASSIGNCASE
The PM_REASSIGNCASE permission provides the ability to reassign cases to other users. Note that a case can only be reassigned to users who are either in the assignment pool for the current task or in its ad hoc assignment pool. Other users can NOT be assigned to the case.
This permission adds a Reassign option under the Supervisor header in the HOME menu's sidebar, which displays a list of all the case in the workspace which have "To Do" or "Draft" status.
In addition, the PM_REASSIGNCASE permission adds the Reassign option to the Actions menu, which is available under the Inbox and Draft options and when running a case. Note that it is NOT possible to reassign cases under the Review, Advanced, Participated, Participated or Paused options, nor is it possible when opening a case summary or read-only access with Process Permissions.
The PM_REASSIGNCASE permission needs to be accompanied by the PM_CASES permission, in order to access the HOME menu.
PM_SUPERVISOR
The PM_SUPERVISOR permission allows a user to be assigned as a Process Supervisor, which allows a user to view and modify data in DynaForms and Input Documents for designated processes. This permission adds the Supervisor section to the sidebar under the HOME menu and the Review option, which shows a list of cases which the Process Supervisor can review. Only cases with a "To Do" or "Draft" status are shown in the list and the cases must be from processes where the user has been assigned as a Process Supervisor.
Note: Please take note that if the PM_SUPERVISOR permission is removed from the supervisor user's role, he/she won't be able to access the Review option in the Process Supervisor menu or perform any action over the cases even if he/she remains assigned as a user supervisor. Therefore, please remember that if any permission is changed, removed or added to a role, it is necessary to update the process design to fit the new assigned or removed permissions.
After opening the case, the DynaForms and Output Documents which can be edited by the Supervisor will be available inside a "Step List" dialog box.
The PM_SUPERVISOR permission also allows the user to pause cases by going to Actions > Pause, however it doesn't grant the power to delete, cancel or reassign cases. Separate permissions are needed for those abilities.
The PM_SUPERVISOR permission needs to be accompanied by the PM_CASES permission, in order to access the HOME menu. It is a good idea to also assign Process Permissions to the Process Supervisor user. Otherwise, he/she can not use the standard Steps and Information menus to find out more information about the case.
PM_SETUP_ADVANCE
The PM_SETUP_ADVANCE permission provides access to advanced setup options under the ADMIN menu, including the Logo, PM Tables, Dashboards, Languages and Cases List Cache Builder options under the Settings tab, the Plugins tab, and the Authentication Sources option under the Users tab. This permission must be accompanied by the PM_SETUP permission in order to gain access to the ADMIN menu.
PM_DASHBOARD
The PM_DASHBOARD permission provides access to the DASHBOARD menu and the ability to see ratios of completed versus open cases for different time periods. Note that the Dashboards feature is available from version 2.0.34 on.
PM_WEBDAV
The PM_DASHBOARD permission provides the ability to use WebDAV (Web-based Distributed Authoring and Versioning) to upload and download files to the ProcessMaker server from the internet.
PM_EDITPERSONALINFO
The PM_EDITPERSONALINFO permission allows users editing their personal information such as their account passwords without requiring to have the PM_USERS permission in their role. The personal information of a user can be edited by clicking on his/her username in the upper right-hand corner of the ProcessMaker header.
PM_FOLDERS_VIEW
The PM_FOLDERS_VIEW allows a user to view folders and download files under HOME > Documents, but now all users with the PM_CASES permission have access to HOME > Documents. Note that users can only see files from cases which they are designated to work on or they have Process Permissions to access.
PM_FOLDERS_ADD_FOLDER
The PM_FOLDERS_ADD_FOLDER permission allows a user to add folders under HOME > Documents.
PM_FOLDERS_ADD_FILE
The PM_FOLDERS_ADD_FILE permission allows a user to add and delete files under HOME > Documents.
PM_DELETECASE
Only cases which are still in their initial task can be deleted, meaning that they can be removed from the database. Once cases are routed onto subsequent tasks, they can only be canceled, not deleted. Any user who is designated to work on the initial task of a case can delete it by opening the case and selecting Actions > Delete in the menu.
The PM_DELETECASE permission allows cases in their initial tasks to be deleted by a user who NOT the designated user to work on the initial task. However, the only way a non-designated user can open a case so that it can be deleted is to be a Process Supervisor who accesses the case by going to HOME > Review.
Note: When a case is deleted, its record is removed from the wf_
PM_CANCELCASE
The PM_CANCELCASE permission allows a user to cancel cases that have been assigned to him/her, cases where he/she has participated and cases that the user can search as a Process Supervisor under HOME > Review. This means:
- If a user has permissions to see only the cases that he/she is assigned to. He/She will be able to cancel those cases.
- If a user has the PM_ALLCASES permission in addition to the PM_CANCELCASE permission, the user will be able to cancel any case through Advanced Search.
- If a user has the PM_SUPERVISOR permission in addition to PM_CANCELCASE, the user will be able to cancel all the cases that are in the review case list (where the cases of the process where he/she is supervisor will be displayed).
- Code: Enter a unique identifier for the role.
- Name: Enter a name for the role, which will be displayed in the role list.
- Status: Select whether the role is "Active" or "Inactive". A role which is set to "Inactive" can not be assigned to users.
Cases can be canceled by opening a case and going Action > Cancel.
When a case is canceled, its status is changed to Canceled and it can no longer be worked on. The case can still be opened in read-only mode by going to HOME > Participated or HOME > Advanced Search, so its data can be accessed, but not changed. Cases in their initial task can only be deleted, not canceled.
The PM_CANCELCASE permission should be accompanied by the PM_CASES permission to access the HOME menu. If needing to cancel other user's cases, it should also be accompanied by the PM_SUPERVISOR permission.
Note 1: Once a case has been canceled, there is no way to uncancel it in the ProcessMaker interface; however, it is possible to uncancel a case by writing to the database.
PM_FOLDER_DELETE
The PM_FOLDER_DELETE permission allows a user to delete a folder under HOME > Documents.
PM_SETUP_LOGO
Available Version: From 3.0.1.8 on.
The PM_SETUP_LOGO permission allows users editing the logo of ProcessMaker. By default, ProcessMaker appears with its logo at the top of the screen, this logo can be replaced with the logo of your business or organization. This permission must be accompanied by the PM_SETUP permission in order to gain access to the ADMIN menu. For more information, please check the Logo information page.
PM_SETUP_EMAIL
Available Version: From 3.0.1.8 on.
The PM_SETUP_EMAIL permission allows users configuring emails servers to allow ProcessMaker to send out email notifications. This permission must be accompanied by the PM_SETUP permission in order to gain access to the ADMIN menu. For more information, please check out the Manage Multiple Email Accounts page.
PM_SETUP_CALENDAR
Available Version: From 3.0.1.8 on.
The PM_SETUP_CALENDAR permission allows users configuring calendars that allow process designers to specify the hours and days when users are expected to be at work, so that the due dates for tasks can be more accurately calculated. This permission must be accompanied by the PM_SETUP permission in order to gain access to the ADMIN menu. For more information, please check out the Calendars page.
PM_SETUP_PROCESS_CATEGORIES
Available Version: From 3.0.1.8 on.
The PM_SETUP_PROCESS_CATEGORIES permission allows users managing processes categories. This permission must be accompanied by the PM_SETUP permission. For more information, please check out the Process Categories page.
.
PM_SETUP_CLEAR_CACHE
Available Version: From 3.0.1.8 on.
The PM_SETUP_CLEAR_CACHE permission allows users to clearing the ProcessMaker cache in order to speed up ProcessMaker or avoid possible issues. This permission works along with the PM_SETUP permission. For more information, please check Clear Cache page.
PM_SETUP_HEART_BEAT
Available Version: From 3.0.1.8 on.
The PM_SETUP_HEART_BEAT permission allows users sending statistics to the ProcessMaker developers about how ProcessMaker is being used, including the number of workspaces, processes, users and cases. This permission must be accompanied by the PM_SETUP permission. For more information, please check out the Heart Beat page.
PM_SETUP_ENVIRONMENT
Available Version: From 3.0.1.8 on.
The PM_SETUP_ENVIRONMENT permission allows users configuring ProcessMaker Environment settings. This permission must be accompanied by the PM_SETUP permission. For more information, please check out the Environment Settings page.
PM_SETUP_PM_TABLES
Available Version: From 3.0.1.8 on.
The PM_SETUP_PM_TABLES permission allows users to manage PMTables that store data which will be used in DynaForms or Output Documents. This permission must be accompanied by the PM_SETUP permission. For more information, please check out the PM Tables page.
PM_SETUP_LOGIN
Available Version: From 3.0.1.8 on.
The PM_SETUP_LOGIN permission allows users to configure Login Settings. The user with this permission can choose the "Default Language" for the current workspace, and either enable or disable the option "Forgot Password". This permission must be accompanied by the PM_SETUP permission. For more information, please check the Login Settings page.
PM_SETUP_DASHBOARDS
Available Version: From 3.0.1.8 on.
The PM_SETUP_DASHBOARDS permission allows users to manage Dashlets Instances. This permission must be accompanied by the PM_SETUP and the PM_DASHBOARD permission. For more information, please check out the Dashboards page.
.
PM_SETUP_LANGUAGE
Available Version: From 3.0.1.8 on.
The PM_SETUP_LANGUAGE permission allows users to manage languages in ProcessMaker. This permission must be accompanied by the PM_SETUP and the PM_SETUP_ADVANCE permissions in order to gain access to the ADMIN menu.For more information, please check out the Languages page.
.
PM_SETUP_SKIN
Available Version: From 3.0.1.8 on.
The PM_SETUP_SKIN permission allows users to change the visual appearance to the ProcessMaker interface. This permission must be accompanied by the PM_SETUP permission in order to gain access to the ADMIN menu. For more information, please check out the Skins page.
.
PM_SETUP_CASES_LIST_CACHE_BUILDER
Available Version: From 3.0.1.8 on.
The PM_SETUP_CASES_LIST_CACHE_BUILDER permission allows users rebuilding the Cases List Cache. This permission must be accompanied by the PM_SETUP and the PM_SETUP_ADVANCE permissions in order to gain access to the ADMIN menu. For more information, please check out the Clearing the Case List Cache page.
.
PM_SETUP_PLUGINS
Available Version: From 3.0.1.8 on.
The PM_SETUP_PLUGINS permission allows users having access to the Plugins tab. This permission must be accompanied by the PM_SETUP and the PM_SETUP_ADVANCE permissions in order to gain access to the ADMIN menu. For more information, please check out the Plugins page.
.
PM_SETUP_USERS_AUTHENTICATION_SOURCES
Available Version: From 3.0.1.8 on.
The PM_SETUP_USERS_AUTHENTICATION_SOURCES permission allows users configuring properties to authenticate external users. This permission must be accompanied by the PM_SETUP, the PM_SETUP_ADVANCE and the PM_USERS permission. For more information, please check out the External Authentication page.
.
PM_SETUP_LOGS
Available Version: From 3.0.1.8 on.
The PM_SETUP_LOGS permission allows users to have access to review the Logs tab. This permission must be accompanied by the PM_SETUP permission. For more information, please check out the Logs page.
PM_DELETE_PROCESS_CASES
Available Version: From 3.0.1.8 on.
The PM_DELETE_PROCESS_CASES permission enables an additional button on the toolbar inside the Designer Menu. The Delete Cases button allows users deleting all cases of a specific process.
PM_EDITPERSONALINFO_CALENDAR
Available Version: From 3.0.1.8 on.
The PM_EDITPERSONALINFO_CALENDAR permission allows users change their calendar preference in their profile accounts without requiring to have the PM_USERS permission in their role. The calendar preference of a user can be edited by clicking on his/her username in the upper right-hand corner of the ProcessMaker header.
The calendar drop-down box will be available to be changed.
Note: The PM_EDITPERSONALINFO_CALENDAR works along with the PM_SETUP permission and the PM_EDITPERSONALINFO permission.
Creating and Editing Roles
If the 3 default roles are not adequate for the users in your organization, custom roles can be created. To create a new role, go to USERS > ROLES and click on the New link at the top of the list of roles. Then define the properties of the new role.
When done defining the role, click on Save to add the new role.
The new role should now appear in the list of roles. Now assign permissions to the new role by clicking on its Permissions link.
Click on Permissions to add a permission to the role, then click on Edit Permissions and a list of the available permissions will appear:
Select the permission to add and click on ">" for one permission or ">>" for all permissions.
To edit the name and properties of an existing role, go to USERS > ROLES and click on the Edit link for the link.
To edit the list of permissions in an existing role, go to USERS > ROLES and click on the Permissions for the role.
Note: All roles need to include the PM_LOGIN permission in order to function correctly. Without PM_LOGIN, the user can't login to access the rest of the functionality in ProcessMaker.
