ELIS Roles

ELIS Roles

Multitenancy refers to a principle in software architecture where a single instance of the software runs on a server, serving multiple client organizations (tenants). Multitenancy is contrasted with a multi-instance architecture where separate software instances (or hardware systems) are set up for different client organizations. With a multitenant architecture, a software application is designed to virtually partition its data and configuration so that each client organization works with a customized virtual application instance. (http://en.wikipedia.org/wiki/Multitenancy).

Many applications support multi-tenancy by completly separating tenants. Tenant instances run on the same codebase, but have separate databases. This makes it difficult to migrate users and content between tenants. ELIS supports a flexible, hierachical form of multi-tenancy via groups and sub-groups of users, which we call User Sets. In ELIS, tenant User Sets share the same codebase and database, and are separated by permissions. This enables class content to be shared among tenants. Users might be in several different kinds of tenants in an organization, for example you can have a User Set of all Sales staff, with their own internal management hierarchy. Then you can have a different User Set of all staff who live in California, with it's own management and reporting hierarchy. Sales staff in California would be in both User Sets, for example. However, Moodle is still mostly a multiple-instance application, so there are some practices that must be followed to fully take advantage of ELIS' User Set functionality. These will be more fully described in the use cases in this section of the documentation.

From a user's perspective, ELIS Multi-tenancy enables a client to set up an ELIS site that has multiple sub-organizations, with sub-administrators who can manage only users who are in their own organization. For example a content provider who sells content to multiple institutions, can set up each institution as a User Set in the content provider's ELIS site, and deliver the same (or selected) class content to each institution. Selected institution staff can be given user management and reporting permission, to view and schedule reports, edit their own users, and manage enrollments for the their own users, without seeing or knowing about other institution's users on the site.

Caveats:

In order to set up content editing roles in Moodle so that the administrator of a Program or a site administrator can only edit certain Moodle classes, you need to set these roles up in Moodle (for example as category course creator, etc.). During your ELIS quickstart, our training staff can assist you with setting up Moodle and ELIS roles to acheive your project's goals.

Creating Roles

To create a new role go to the Administration block > Site Administration > Users > Permissions > Define roles and select the Add a new role button at the bottom of the page.

Start by figuring out what capabilities the role should have. In this example we will be creating a role that allows a user to assign user sets to programs and tracks at the system level. The name of this role will be User Set Enrollments.

Once we assign the role a name we choose the context types where this role can be assigned. This role will be assigned at the system level.

Then we choose which permissions to allow. Testing different permissions is often needed to find the right combination of permissions to allow for a role. This role will have 4 permissions allowed:

• Associate program management items - local/elisprogram:associate
• View program - local/elisprogram:program_view
• View track - local/elisprogram:track_view
• View User Set - local/elisprogram:userset_view

When finished with the permissions section, select the Create this role button at the bottom of the page.

Since this role is assigned at the system level we go to the Administration block > Site Administration > Users > Permissions > Assign system roles then select the user to assign to the role.

The user assigned this role will be able to view all user sets, programs and tracks. The Associate program management items permission enables a user with this role to associate user sets with program and tracks.

From a user set the user can go to the Programs tab and Tracks tab to associate programs/tracks to the user set. From a track the user can go to the User Sets tab to associate a user set to the track. From a program the user can go to User Sets tab to associate a user set to the program.

Assigning Users to Roles

By assigning users to roles in the context of another user in the system, we can provide a method for a user to manage many other users, edit their profile information, completion records, etc.

In the description below, we'll use the term "Manager" to describe the user who is given administrative rights over another user. Of course, these role names are flexible in ELIS, you can change it by changing the Moodle role.

To assign a user to be the manager of another user you need to be logged in as a Program Administrator (or role with similar capability). First go to the Manage Users section of ELIS. Locate the user you wish to enroll another user as a manager of, and click on the roles tab.

Here there are various roles you can assign - roles are setup on the site in the Moodle roles table (Moodle > Site Administration > Users > Permissions > Define roles). Note that only roles set to show in the user's context type will show in the user's roles tab as assignable at the user's context (https://docs.moodle.org/20/en/Assign_roles).

In the case below, we are choosing the Manager role we have created - this role has administrative rights on all Program Management functions. Since we are assigning the user in the context of an individual user, we will only be giving them these rights over the user's assigned to them (this can be done in 'batch' via upload users or Data Hub).

1. This column shows the name of the role
2. This column shows the description of the role - you can edit the description when you edit or create the role, so if it is a role with a particular function, such as viewing reports or editing users, it is a good idea to put that information in the description.
3. This column shows the number of users currently assigned in that role in the current context. For example if the William Adams role above had 2 users already assigned in the Manager role, that number would show in the "Users" column.

Clicking the role's name here will open a list of users who you can assign to the selected role in the user's context, with the usual filtering interface.

1. The "Unassigned" link will show you users who do not currently have an assigned role in the context you are in.
2. You can filter the list of users to show just the ones you are interested in - the Advanced button opens up additional filtering fields such as custom profile fields, city, country, etc.
3. Enter search terms in the filter fields and click "Add filter".
4. Active filters will show here, for example we added a filter to show only users with a specific name, and so we see the and can select from this list of users.
5. Select the checkbox for the user or users who will have administrator rights over the particular user.
6. Select the "Assign roles" button when finished.

While this may seem like many steps to assign a user to the Manager role one user at a time, a manager can be assigned to many users at once by using the capabilities for batch user actions provided by ELIS Data Hub.

Viewing Assigned Users

The user we just assigned as a manager can login now and view the user information for the user that we just assigned to them. This user has been assigned the Manager role for a user so she/he can see the "Manage Users" link.

The user can see the user(s) they are assigned the Manager role for on the Manage Users screen. Depending on the permissions you have given to the Manager role, the manager can edit/delete his/her users, as well as add/remove them from tracks, user sets, and programs. For instance the administrator might change the user's password, edit their user information, update custom profile fields, etc.

Assigning User Set Roles

In a similar fashion to assigning a Manager user to administer a user, a Manager can be assigned to a user set, and thus be able to edit the user set.

To assign a user to manage a user set, first select the Manage User Sets link (1) and select a user set, then select the Roles tab (2). On the roles tab, select the role (3) you wish to assign users to in this user set.

On the roles screen:

1. Use the filter to search for users.
2. Select a user to assign the role to.
3. Select the "Assign roles" button.

In this example a user is being assigned the User Set Administrator role in a user set, ACME Corporation. Some permissions that are enabled for this type of role are:

• local/elisprogram:assign_userset_user_class_instructor
• local/elisprogram:associate
• local/elisprogram:class_enrol_userset_user
• local/elisprogram:course_view
• local/elisprogram:program_enrol_userset_user
• local/elisprogram:track_enrol_userset_user
• local/elisprogram:user_view
• local/elisprogram:user_edit
• local/elisprogram:userset_enrol_userset_user
• local/elisprogram:userset_view

When a user set administrator also has a role assigned within a program context with the permissions to view, create, and delete tracks, the administrator will be able to view, create, and delete track instances of that program. Then the tracks he or she creates can be assigned to the user set. Likewise, the administrator could also assign the user set or user set users to the tracks he/she has created.

Using Assigned User Sets

We now login as the user we assigned previously as the user set administrator. Because this user is assigned to at least one user set, they see the "Manage User Sets" link, and can select it.

Because the user is enrolled as the User Set Administrator of the Acme Corporation, she/he can see the ACME Corporation user set, and also see the various editing icons for the user set.

The user set administrator can also view/edit the users of the user set on the ELIS Users screen or on the Bulk user actions screen. The Manage Users screen is shown in the next image. The user set administrator can edit any of the user's profiles of his/her user set by clicking on their Name, ID Number, or Edit icon.

As they are only assigned a role in the ACME Corporation user set - they can only see users who are in the ACME Corp. user set. In the image some users have more icons available, this is because some users are only assigned to user sub-sets of the user set so the user set administrator has less permissions with those users.

Assigning Program Roles

A user can be assigned the managers role or an administrator role for an entire program in the same way as we saw in the previous examples, by selecting the Roles tab of the program, selecting the role you want to assign, and then assigning a user or users to the role in the program.

Once an administrator has been assigned to the program, they can see their assigned program when they login and select the Manage Programs link.

Now the Program Administrator can (depending on the permissions given to the role) edit the program information, add or remove user sets, view the courses assigned, set pre-requisites and co-requisites, and add or remove courses. The Program Administrator can also view and edit the users in his/her program, and add or remove users (if the role has been given that permission).

Because Tracks are a subset of a Program, a Program Administrator is often given permission to manage the tracks of the program as well. In this case, they can edit the details, user sets, and users assigned to a track, as well as the classes assigned to the track. In the image above there is one track instance of the program the user is assigned the role in. If the user selects the Add Track button in this example they will only be able to create tracks that are instances of the program they have the role in.