Asset Bank Organisational Units

Overview

Organisational Units are a feature that can be used to divide your full Asset Bank into separate sections, each of which contains a subset of the assets and users.

For example, you might want to do this if you have several departments or regions in your organisation, and want to devolve administration of user accounts to administrators in each department.

Each of the new organisational administrators can then:

• Manage their own folder structure
• Manage their own user groups
• Approve their own users
• Manage their own users
• Approve Upload, Edit and Download requests for assets in their part of the system

An Organisational Unit consists of the following:

• A folder: contains the images in the Org Unit.
• Sub-levels: optionally, the main folder may contain sub-levels, if you need more fine-grained control over permissions on the images in a department.
• Org Unit Admins: there is a special Admin group for each Org Unit. There must be at least one member who is administrator for the Org Unit.
• Other User Groups and Users: members of the Org Unit.

The following diagram shows the case where an Org Unit called 'Scotland' has been created. There is a sublevel called 'Restricted'. There are three groups: one for the Org Unit Admins, one for Normal Users (who can see standard assets in the Scotland Org Unit), and one for 'Privileged Users' who can see images in the 'Restricted' sublevel.

None of the users can see assets in any of the other Org Units: e.g. users in Scotland can't see images in 'Ireland'.

Setting up Org Units

First you must make sure that Org Units are enabled in your Asset Bank, please speak to the Customer Support team if you're unsure about this.

You need to be logged in as an Asset Bank Admin user to create and manage Org Units.

1. Add Organisational Unit
Use the Admin > Org Units menu item to bring up the Organisational Units screen. Click 'Add an Organisational Unit' and enter the name. This will create the Org Unit and also the corresponding folder.

2. Check the Groups
Go to Admin > Groups. You will see that two groups have been created inside the Org Unit 'Admin' (for the Org Unit Admin users) and 'Users' (for standard users).
Click on 'folders permissions' of the newly created groups to see the permissions that have been assigned to each group.
By default, the 'Users' group has Download permission only on the folder corresponding to the Org Unit.
By default, the 'Admin' group has full Approval permissions on the Org Unit.
You can change the permissions from the defaults if required.

3. Add first Org Unit Admin
You must add at least one Org Unit Admin, so that you can devolve the administration of the Org Unit to them.
Go to Admin > Users, and create a new user. Set their group to be the 'Admin' group of the Org Unit that was just created. 

Note, an Asset Bank Admin user cannot also be an Organisational Unit admin, as the Asset Bank admin status supersedes the Org Unit Admin status.

Org Unit Admins

The Org Unit Admin you just created can now manage the folders, Groups and Users in the Org Unit. Note that Asset Bank Admin users can also do all of these functions if required.

An Org Unit Admin can do the following:

1. Create sub-levels (Optional)
Click on Admin > Org Units. Next to the Org Unit name, click 'folders' to bring up the 'Organisational Unit: folders' screen. On this screen you can add sublevels to the root folder in the Org Unit.
Note: this option is only available if the option orgunit-admin-manage-orgunit=true in the settings file (see 'Enabling Organisational Unit' below).

2. Manage Groups
Click on Admin > Groups to see the groups inside your Org Unit. Note that there is always one special group for the Org Unit Admins. By default there is one group created for standard users, however you can create additional groups for the Org Unit here if required.
You can edit the names of groups, and set permissions on groups as usual.

3. Approve Users
When users register to use Asset Bank, then they are given the choice of which Org Unit they want to join. When they submit the registration form, then the notification email will be sent to the Org Unit Admins of the selected Org Unit (or to the Asset Bank Admin if no Org Unit was selected).
The Org Unit Admin can then approve or reject the user using the Admin > Approve Users screen.

4. Manage Users
The Org Unit Admin can access the usual user management screens at Admin > Users, where they can manage the users in their own Org Unit.

5. Approve Download/Upload requests
By default, the Org Unit Admin group has maximum Approval permission on the folder(s) in the Org Unit. If a standard user group in the Org Unit has 'Download with approval' or 'Upload with approval' permission, then the Org Unit Admins will be able to approve or reject the upload/download requests.

Enabling Organisational Units

To enable Organisational Units, the following change should be made to the file ApplicationSettings.properties.

orgunit-use=true

There are three further properties that control how the application will behave when Org Units is turned on.

orgunit-can-search-all-access-levels

If set to true, then users can search over folders that are not inside their Org Unit: use this option if you want users to be able to find assets from other Org Units.
If set to false, then users can only search over folders in their own Org Unit (so they can't, for example, find and view assets from other Org Units).

orgunit-admin-manage-orgunit

If set to true, then the Org Unit Admin users can edit the name of their Org Unit, and add folders inside their Org Unit.

orgunit-admin-manage-groups

If set to true, then the Org Unit Admin users can add groups inside their Org Unit.