Maximo

Maximo

Come for answers, stay for best practices. All we're missing is you.

 View Only

  • 1.  Maximo Work Center - Inspection Result status authorization

    Posted 08/28/23 01:31 AM
    Hi Team,
     
    I am looking for ideas to handle the Status Authorization of Inspection Results (Conduct an Inspection) on Maximo Work Center. For example, only few set of users should able to complete the inspection and take followup action on it.
     
    We observed that IBM has introduced attributes like enableReview, but it is available via Maximo Mobile and we are not using Maximo mobile in our implementation of Maximo. 
     
    We tried to enable the changeResultStatus option (wsmethod) for Object Structure MXAPIINSPRESULT from Action Definitions (under more actions), and configure the security groups using this option, but it doesn't seem to have any effect of status authorization (atleast in our Maximo instance, please advise if this is not the case for OOTB Maximo), except the fact that "Take Action" will not be available on Inspection Summary Page if the user is not given access to changeResultStatus.
     
    Furthermore, we tried to put condition (let's say a false condition like 1=2, so none of the user should able to save or change inspection status) on SAVE option for this Object Structure, but this doesn't seem to have any effect either. 
     
    On investigation, we found that the class InspectionResultStatusHandler has defined following methods, but these are empty:
     
    canChangeStatus()
    checkStatusChangeAuthorization()
    checkUserSecurity()
     
    And this explains the reason of no effect of setting the changeResultStatus authorization.
     
    Later, we implemented the Automation Script on Status attribute of object InspectionResult, which works in stopping the unauthorized status change, but this doesn't propagate the authorization error message on Work Center UI, so the user experience won't be very good. 
    Automation script on object structure inbound message won't work because MXAPIINSPRESULT doesn't have inbound processing class, whereas to implement change status via inbound automation script, the statefulMicSetin class or the class that extends the statefulMicSetin class must be registered as the processing class in the object structure.
     
    I guess the last resort (other than java customization obviously) is to update the Conduct an Inspection Work Center UI (using polymer js), to either show the appropriate Unauthorized User access error message or to keep the Complete button disabled. But our client is not in the favour of this (and I can understand their concern for such reservations). So, I am wondering how this is handled at other places and if I am missing any other possibility.
     
    Thanks & Regards,
    Gaurav


    ------------------------------
    Gaurav
    ------------------------------


  • 2.  RE: Maximo Work Center - Inspection Result status authorization

    Posted 08/29/23 09:43 AM

    I'd recommend opening an idea for us to address this in a future release: https://ibm-ai-apps.ideas.ibm.com/ideas/

    Unfortunately, 7.6.1.X won't be getting any new updates so it won't be something we'd be able to backport there. 

    As a FYI, the Conduct an Inspection work center has been removed in MAS to use the same version as Maximo Mobile so your automation script for example would display the error message to the users. But I think we should enable customers to have status restrictions out of the box like we do in other applications in Maximo. Especially because we now have additional statuses like canceling, review, etc. where you may want to be more granular about who can make what status changes.



    ------------------------------
    Steven Shull
    ------------------------------



  • 3.  RE: Maximo Work Center - Inspection Result status authorization

    Posted 08/29/23 11:02 PM

    Thanks Steven for your reply! I agree that there should be some mechanism available OOTB to handle the status authorization while conducting an Inspection. As advised, I will raise the idea for future release.

    Earlier, I had setup the automation script on attribute launch point, which is not showing the error message on Work Center, but now I have changed the launch point to object launch point at Validate method and this is showing appropriate error message on Work Center. So, I can use it as a workaround for now.

    Launch Point:

    Work Center error Message on click on Complete button:

    The automation script to validate the access is as below:

    #active=1
    #description=To validate the Status Access level for Inspection Results
    #interface=0
    #language=python
    #log=ERROR
    #name=INSPSTATUSACCESS
    #status=Active
    #launchpoint.1.active=1
    #launchpoint.1.description=To validate the Status Access level for Inspection Results
    #launchpoint.1.event=1024
    #launchpoint.1.name=INSPSTATUSACCESS
    #launchpoint.1.object=INSPECTIONRESULT
    #launchpoint.1.type=OBJECT
    ##
     
    #------------------------------------------------------
    # Script: INSPSTATUSACCESS
    # Implementing Inspection Result status access control
    # Version 1 - Aug 2023 - Gaurav - Initial commit
    #------------------------------------------------------
    from psdi.util import MXAccessException
    from psdi.security import ProfileRemote
     
    # Setup distinct sigOptions for Object Structure MXAPIINSPRESULT with same names as maxStatus to have a granular control for Status authorization
    def getOptionName(maxStatus):
        # In most cases sigoption will be same as maxStatus (Sigoption for each internal status)
        if maxStatus == 'PENDING':
            # Assuming that user who have SAVE authorization should able to initiate inspection
            optionName = 'SAVE'
        else:
            optionName = maxStatus
        if isDebugEnabled: service.log(logPrefix+"getOptionName()::optionName::"+optionName)
        return optionName
     
    # Checks user access and raises exception
    def checkUserSecurity (maxStatus):
        if isDebugEnabled: service.log(logPrefix+"checkUserSecurity() begins")
        optionName = getOptionName(maxStatus)
        profile = mbo.getMboServer().getProfile(mbo.getUserInfo())
        if (optionName is not None and not(profile.getAppOptionAuth(appId, optionName, mbo.getString("siteid")))):
            if isDebugEnabled: service.log(logPrefix+"checkUserSecurity()::Raising access exception")
            #raise MXAccessException("access", "notauthorized")
            service.error("access", "notauthorized")
     
    #--------------------------
    # MAIN()
    #--------------------------
     
    if mbo.isModified('STATUS') and not mbo.isNew():
        # scriptName = "SWCINSPSTATUSACCESS"
        appId = "MXAPIINSPRESULT"
        
        isDebugEnabled = service.getLogger("maximo.script."+scriptName).isDebugEnabled()
        inspResultNum = mbo.getString("RESULTNUM")
        logPrefix = scriptName + "::CustomLog::ResultNum::"+inspResultNum +"::"
        if isDebugEnabled: service.log(logPrefix+"Begins")
        
        desiredStatus = mbo.getMboValue("STATUS").getCurrentValue().asString()
        desiredMaxStatus = mbo.getTranslator().toInternalString("INSPRESULTSTATUS", desiredStatus)
        
        checkUserSecurity(desiredMaxStatus)
    Also, when Work Center sends the request to change status, it sends it as a web method call (wsmethod=changeResultStatus implemented in InspectionService class) and I guess that it doesn't pass the control to OSIN automation script (if you plan to implement OSIN.MXAPIINSPRESULT autoscript), therefore, none of the methods will be triggered from the OSIN automation script.
    Thanks & Regards,
    Gaurav


    ------------------------------
    Gaurav
    ------------------------------

    Original Message


Related Content