HR processes

HR processes are mostly a special type of processors or stateful long running tasks. The intent here is to keep the process logic in the Activiti workflow, so it can be easily extensible without the need of digging in the code.

Both HR processors or long running tasks executes the same Activiti workflow process, the difference is in the time of execution: - processors executes process immediately, when identity contract is changed (active operation) - long running tasks are scheduled, mainly over night. So contract change is persisted only and HR processes are executed separately. Choosing the way is configurable - processor can be disabled, long running tasks can be scheduled or not.

The AbstractWorkflowStatefulExecutor bears the responsibility of launching workflow tasks. The idea right now is fairly simple - execute the process synchronously for one user and return the operation result. The convention is that the processed item (of AbstractDto type) is passed into the workflow, which in turn writes the OperationResult as "operationResult" variable. You are advised to list through the standard set of workflow to see the real-world examples.

Developer tip: avoid asynchronous workflow execution if possible.

Following text describes the core set of HR processes solved by CzechIdM. These are nicely customizable and extensible to fit your needs, of course :)

The process starts for every identity contract, which is newly valid at the moment (meaning it was not valid). If the identity, which is the owner of the contract, was originally disabled, the process sets the new identity state to VALID.

This process does not address the assignment of automatic roles, as it is done by an internal feature automatically.

The process is:

• a stateful task, therefore the contract is processed only once while it is valid for a continuous period of time. The process is realized by HrEnableContractProcess executor and hrEnableContract Activiti workflow.
• or processor, which checks, if contact's validity is changed. The same Activiti workflow is used.

The process starts for every identity contract, which is newly not valid at the moment (meaning it was valid, but now it's not). New identity state is evaluated and if the processed contract was the last valid contract of the identity, the identity state is changed to LEFT and identity is disabled.

All added roles, which were assigned to the ended contract, are removed by the process.

The process is:

• a stateful task, therefore the contract is processed only once while it is not valid for a continuous period of time. The process is realized by HrEndContractProcess executor and hrEndContract Activiti workflow.
• or processor, which checks, if contact's validity is changed. The same Activiti workflow is used.

Contract's validity is evaluated by two factors:

1. current date is between or equal to contract's time validity
2. contract state - DISABLED, EXCLUDED

Both 'Enabled contract' and 'End of contract' processes address only the time validity of the contract. However 'Contract exclusion' solves the situation when contract is valid from the time's point of view, but is in state EXCLUDED (manually or synchronized from authoritative resource).

The process starts for all identity contracts that are excluded. New identity state is evaluated and and if the processed contract was the last valid and not excluded contract of the identity, the identity state is set to DISABLED. No roles are removed neither by the process nor by standard CzechIdM features.

The process is:

• a stateful task, therefore the contract is processed only once while it is disabled for a continuous period of time. The process is realized by HrContractExclusionProcess executor and hrContractExclusion Activiti workflow.
• or processor, which checks, if contact's state is changed. The same Activiti workflow is used.

Whenever is identity's contract assigned to a work position in the organization structure, all default roles related to the work position are assigned to the contract. This feature is referred as automatic roles assignment.

Automatic roles are not passed for role approval and are assigned immediately. If given contracts starts in the future, all automatic roles are assigned anyway, but each role's validity date is tied to contracts validity.

Whenever is contract's work position removed or changed, CzechIdM recalculates all assigned automatic roles. For new work position, the Work position assignment process is executed, therefore all automatic roles for new work position are assigned. At the same time all automatic roles for original position are removed from the identity. Only roles that are default for both new and old work position stay assigned without change.