Example: Allowing RMA approvers to approve all RMAs

By default, return merchandise authorization (RMA) approvers for a store are only permitted to approve RMAs for their own stores. In some cases, you may want to allow RMA approvers to approve RMAs for any store. This might be desirable if several stores are owned by the same organization or if the same person handles the RMA approvals for multiple stores.

In this example, you will create a new access group and use it in a new resource-level policy. To allow RMA approvers to approve RMAs against any store, you need to do the following:

  • Determine the resource-level policy that permits RMA approvers for an organization to approve RMAs for their organization.
  • Note the name of the resource group and action group used in the policy.
  • View the policy's access group, RMAApproversForOrg, and note the roles it includes. The access group is defined using both organizations and roles as selection criteria. To give users authority to perform an action across multiple organizations, the access group must be defined without organizational criteria.
  • Create a new access group, RMAApprovers, that uses the same roles but does not include the organizational criteria.
  • Create a new policy using:
    • The new access group, RMAApprovers
    • The action group from the existing policy
    • The resource group from the existing policy

Identify the action group and resource group to use in defining the new policy

  1. Determine the resource-level policy that authorizes RMAApproversForOrg to approve RMAs for their stores. The policy is: RMAApproversForOrgExecuteRMAApproveCommandsOnRMAResource
  2. From the Organization Administration Console, click Access Management > Policies.
  3. For View, select Root Organization to display the policies that it owns.
  4. Locate the policy in the list.
  5. Note the name of the policy's action group--RMAApproveCommands. This is the action group you will use in defining your new policy.
  6. Note the name of the resource group--RMADataResourceGroup, This is the resource group you will use in defining your new policy.
  7. Note the name of the access group--RMAApproversForOrg. View this access group to see the roles to include in your new access group.

Identify the roles to be used in the new access group

  1. Click Access Management > Access Groups.
  2. From the list of access groups, select RMAApproversForOrg.
  3. Click Change.
  4. Select Criteria to display the Criteria page.
  5. Under Selected Roles and Organizations, note the roles used in the access group:
    • Customer Service Supervisor
    • Seller
    • Sales Manager
    • Operations Manager
  6. Click Cancel to return to the list of access groups.

Define the new access group

  1. Click New to display the Details page for the new access group.
  2. For Name, specify RMAApprovers.
  3. For Description, specify a description of the access group.
  4. For Parent Organization, select Root Organization.
  5. Click Next to display the Criteria page for the new access group.
  6. Click Criteria based on organizations and roles.
  7. From the list of roles, select the following roles:
    • Customer Service Supervisor
    • Seller
    • Sales Manager
    • Operations Manager
  8. Click Finish.

Define the new policy

  1. Click Access Management > Policies.
  2. Click New to display the New Policy page.
  3. For Name, specify: RMAApproversExecuteRMAApproveCommandsOnRMAResource
  4. For Display Name, specify a short description of the policy in your local language.
  5. For Description, specify a longer description of what the policy does, in your local language.
  6. For User Group, click Find and select RMAApprovers.
  7. Click OK.
  8. For Resource Group, select RMADataResourceGroup.
  9. For Action Group, select RMAApproveCommands.
  10. Click OK.

Update the access control policy registry with your changes

  1. Open the Administration Console.
  2. Click Configuration > Registry.
  3. From the list of registries, select Access Control Policies.
  4. Click Update.