第 16 課：工作流程 - 使用 IGA 實現管理自動化

HTMLTAG_287__HTMLTAG_288___5.1 變數___HTMLTAG_289__HTMLTAG_290

HTMLTAG_413__HTMLTAG_414___5.2 運算子___HTMLTAG_415__HTMLTAG_416

HTMLTAG_527__HTMLTAG_528___5.3 函數___HTMLTAG_529__HTMLTAG_530

預編碼_4

HTMLTAG_531__HTMLTAG_532___6。管理工作流程___HTMLTAG_533__HTMLTAG_534

HTMLTAG_535__HTMLTAG_536___6.1 CRUD 操作___HTMLTAG_537__HTMLTAG_538

預編碼_5

HTMLTAG_539__HTMLTAG_540___7。定義條件___HTMLTAG_541__HTMLTAG_542

HTMLTAG_543__HTMLTAG_544___7.1 使用者屬性條件___HTMLTAG_545__HTMLTAG_546

預編碼_6

HTMLTAG_547__HTMLTAG_548___7.2 群組會員條件___HTMLTAG_549__HTMLTAG_550

預編碼_7

HTMLTAG_551__HTMLTAG_552___7.3 基於時間的條件___HTMLTAG_553__HTMLTAG_554

預編碼_8

HTMLTAG_555__HTMLTAG_556___7.4 基於事件的條件___HTMLTAG_557__HTMLTAG_558

預編碼_9

HTMLTAG_559__HTMLTAG_560___8。定義步驟___HTMLTAG_561__HTMLTAG_562

HTMLTAG_563__HTMLTAG_564___8.1 指派角色___HTMLTAG_565__HTMLTAG_566

預編碼_10______HTMLTAG_567__HTMLTAG_568___8.2 刪除角色___HTMLTAG_569__HTMLTAG_570

{
  "type": "remove_role",
  "role": "contractor",
  "scope": "realm"
}

HTMLTAG_571__HTMLTAG_572___8.3 加入到群組___HTMLTAG_573__HTMLTAG_574

{
  "type": "add_to_group",
  "group": "/Company/Engineering/Backend"
}

HTMLTAG_575__HTMLTAG_576___8.4 從群組中刪除___HTMLTAG_577__HTMLTAG_578

{
  "type": "remove_from_group",
  "group": "/Company/Marketing"
}

HTMLTAG_579__HTMLTAG_580___8.5 發送通知___HTMLTAG_581__HTMLTAG_582

{
  "type": "send_email",
  "to": "${user.email}",
  "template": "welcome-employee",
  "params": {
    "name": "${user.firstName}",
    "department": "${user.attributes.department}",
    "manager": "${user.attributes.manager}"
  }
}

HTMLTAG_583__HTMLTAG_584___8.6 呼叫外部API___HTMLTAG_585__HTMLTAG_586

{
  "type": "invoke_api",
  "url": "https://hr-system.example.com/api/v1/employees/provisioned",
  "method": "POST",
  "headers": {
    "Content-Type": "application/json",
    "X-API-Key": "${env.HR_API_KEY}"
  },
  "body": {
    "employeeId": "${user.attributes.employeeId}",
    "email": "${user.email}",
    "department": "${user.attributes.department}",
    "provisionedAt": "${event.time}"
  }
}

HTMLTAG_587__HTMLTAG_588___8.7 設定使用者屬性___HTMLTAG_589__HTMLTAG_590

{
  "type": "set_attribute",
  "attribute": "provisionedAt",
  "value": "${now()}"
}

{
  "type": "set_attribute",
  "attribute": "accessLevel",
  "value": "standard"
}

HTMLTAG_591__HTMLTAG_592___9。加入者-移動者-離開者 (JML) 流程___HTMLTAG_593__HTMLTAG_594

HTMLTAG_595__HTMLTAG_596___9.1 加入者 — 自動加入___HTMLTAG_597__HTMLTAG_598

# workflow-joiner.yaml
name: "JML: Joiner - Employee Onboarding"
description: Auto-provision new full-time employees
enabled: true

trigger:
  type: USER_CREATED

conditions:
  - type: user_attribute
    attribute: employeeType
    operator: equals
    value: full-time

steps:
  # Base provisioning cho tất cả employees
  - type: assign_role
    role: employee

  - type: add_to_group
    group: /Company/All-Employees

  - type: set_attribute
    attribute: onboardingStatus
    value: completed

  - type: set_attribute
    attribute: onboardedAt
    value: "${now()}"

  # Department-specific provisioning
  - type: conditional
    condition:
      type: user_attribute
      attribute: department
      operator: equals
      value: engineering
    thenSteps:
      - type: assign_role
        role: developer
      - type: add_to_group
        group: /Company/Engineering
      - type: assign_role
        role: gitlab-user
        scope: client
        clientId: gitlab

  - type: conditional
    condition:
      type: user_attribute
      attribute: department
      operator: equals
      value: sales
    thenSteps:
      - type: assign_role
        role: sales-rep
      - type: add_to_group
        group: /Company/Sales
      - type: assign_role
        role: crm-user
        scope: client
        clientId: salesforce

  # Notify HR system
  - type: invoke_api
    url: https://hr.example.com/api/onboarding/completed
    method: POST
    body:
      employeeId: "${user.attributes.employeeId}"
      email: "${user.email}"

  # Send welcome email
  - type: send_email
    to: "${user.email}"
    template: welcome-employee

HTMLTAG_599__HTMLTAG_600___9.2 移動者 — 部門轉移___HTMLTAG_601__HTMLTAG_602

# workflow-mover.yaml
name: "JML: Mover - Department Transfer"
description: Handle department changes
enabled: true

trigger:
  type: USER_UPDATED

conditions:
  - type: event
    attribute: event.details.updated_attribute
    operator: equals
    value: department

steps:
  # Lấy old department từ event details
  # Remove old department group
  - type: remove_from_group
    group: "/Company/${event.details.previous_value}"

  # Add to new department group
  - type: add_to_group
    group: "/Company/${user.attributes.department}"

  # Log transfer
  - type: set_attribute
    attribute: lastTransferDate
    value: "${now()}"

  - type: set_attribute
    attribute: previousDepartment
    value: "${event.details.previous_value}"

  # Notify managers
  - type: invoke_api
    url: https://hr.example.com/api/transfers
    method: POST
    body:
      employeeId: "${user.attributes.employeeId}"
      fromDepartment: "${event.details.previous_value}"
      toDepartment: "${user.attributes.department}"
      transferDate: "${event.time}"

HTMLTAG_603__HTMLTAG_604___9.3 離開者 — 自動離職___HTMLTAG_605__HTMLTAG_606

# workflow-leaver.yaml
name: "JML: Leaver - Employee Offboarding"
description: Auto-deprovision disabled/deleted employees
enabled: true

trigger:
  type: USER_DISABLED

conditions:
  - type: user_attribute
    attribute: employeeType
    operator: in
    values:
      - full-time
      - contract

steps:
  # Revoke all active sessions
  - type: invoke_api
    url: "http://localhost:8080/admin/realms/my-realm/users/${user.id}/logout"
    method: POST
    headers:
      Authorization: "Bearer ${admin.token}"

  # Remove from all groups (except audit trail groups)
  - type: remove_from_group
    group: /Company/All-Employees

  # Remove sensitive roles
  - type: remove_role
    role: developer

  - type: remove_role
    role: admin

  # Set offboarding metadata
  - type: set_attribute
    attribute: offboardingStatus
    value: completed

  - type: set_attribute
    attribute: offboardedAt
    value: "${now()}"

  - type: set_attribute
    attribute: accountDisabledReason
    value: employee-departure

  # Notify IT and HR
  - type: invoke_api
    url: https://hr.example.com/api/offboarding/completed
    method: POST
    body:
      employeeId: "${user.attributes.employeeId}"
      email: "${user.email}"
      offboardedAt: "${event.time}"

  # Notify admin via email
  - type: send_email
    to: [email protected]
    template: offboarding-notification
    params:
      employeeName: "${user.firstName} ${user.lastName}"
      department: "${user.attributes.department}"

HTMLTAG_607__HTMLTAG_608___10。存取審核工作流程___HTMLTAG_609__HTMLTAG_610

存取審核允許 定期檢查__HTMLTAG_613___以查看使用者是否仍需要目前權限：

# Tự động disable contractor khi hết hợp đồng
name: "Contractor: Auto-disable on contract end"
enabled: true
trigger:
  type: SCHEDULED
  schedule: "0 0 * * *"  # Daily check

conditions:
  - type: user_attribute
    attribute: employeeType
    operator: equals
    value: contract
  - type: user_attribute
    attribute: contractEndDate
    operator: before
    value: "${now()}"

steps:
  - type: disable_user
  - type: set_attribute
    attribute: disabledReason
    value: contract-expired
  - type: send_email
    to: "${user.attributes.managerEmail}"
    template: contractor-expired

# Khi user được sync từ LDAP, auto-assign roles
name: "LDAP: Post-sync provisioning"
enabled: true
trigger:
  type: USER_CREATED

conditions:
  - type: user_attribute
    attribute: LDAP_ID
    operator: exists
  - type: user_attribute
    attribute: department
    operator: exists

steps:
  - type: assign_role
    role: ldap-user
  - type: conditional
    condition:
      type: user_attribute
      attribute: memberOf
      operator: contains
      value: "CN=VPN-Users"
    thenSteps:
      - type: assign_role
        role: vpn-access

# Nhắc nhở user đổi password sau 90 ngày
name: "Compliance: Password rotation reminder"
enabled: true
trigger:
  type: SCHEDULED
  schedule: "0 8 * * 1"  # Weekly, Monday 8 AM

conditions:
  - type: user_attribute
    attribute: lastPasswordChange
    operator: older_than_days
    value: 80

steps:
  - type: send_email
    to: "${user.email}"
    template: password-rotation-reminder
    params:
      daysRemaining: "${90 - daysBetween(user.attributes.lastPasswordChange, now())}"
  - type: conditional
    condition:
      type: user_attribute
      attribute: lastPasswordChange
      operator: older_than_days
      value: 90
    thenSteps:
      - type: set_attribute
        attribute: passwordExpired
        value: "true"
      - type: invoke_api
        url: "http://localhost:8080/admin/realms/my-realm/users/${user.id}/execute-actions-email"
        method: PUT
        body: ["UPDATE_PASSWORD"]