Request and Approval

(Versions 7.9.7+, Enterprise+)

This feature allows users to request access to folders or entries. Specific users or roles can be given the ability to request access, for select items. Designated approver(s) can approve or deny the request.

In this method, administrators can provide access that is "available upon request."

Dual Control

This workflow also allows for Dual Control approval (also known as Peer Approval / Four Eyes / Two-man rule):

Limited Time Access

Time-limit options can allow approvers to restrict the access time allowed:

Example Setup

To see a full example setup see the following steps: Requesting View Password access. More detailed explanations are found in the sections below.

Setting Approvers

To set an approver on a folder or entry, the user must go to the User Access window, as shown here. Here, there will be the default tab for Access Levels, but beside that is a tab for Access Approvals. Clicking it will allow the user to set a user or role that has the "Access Approvals" permission as an approver for that entry or folder.

 

The access level selected will determine both what access levels the approver can grant for a request and what access levels a user can request.

Requesting Access

To request access for a folder or entry, the user must have an access level on that folder or entry that has the "Request Access" permission enabled.

 Request Access Permission

Once they do, they can right click the folder or click Folder Actions and select Request Access.

 

For an entry, they can right click the entry or click Actions and select Request Access.

 Request Access

A dialog for Request Access on that folder or entry will appear. If no approvers have been set, the user will get a message instead that they are unable to request access.

 Request Access test folder


Once the request has been properly filled out, the user can hit "Save" to submit their request. This will notify all approvers who are eligible to approve or deny the request, both through e-mail and through notifying them in the Password Server.

 Approval Request

A requesting user is also able to view their pending request, which will display the submitted access level and comment in addition to the time they made the request. For a folder, right click the folder or click Folder Actions then select Pending Request, which takes the place of Request Access.

 Pending Request

For an entry, right click the entry or click Actions then select Pending Request.

 

This will bring up the Pending Request dialog.

 

If a user no longer needs access to the folder or entry, they are able to cancel the request by selecting "Cancel Request".

Approving or Denying Requests

In order to approve or deny a request, an approver must go to the Access Approval page, which can only be accessed by having the "Access Approvals" permission. All pending requests that an approver can approve or deny will shown.

 Permissions Access Approval

If an approver wants to approve a request, they can click the Approve button, which will bring up the Approve Request dialog.

 

Upon approving the request, a new access row will be created for the requesting user on the requested folder or entry, thus granting the requester access on that folder or entry.

Likewise, if an approver wants to deny a request, they can click the Deny button which will bring up the Deny Request dialog.

 

Once a request has been approved or denied, the requesting user will be notified of it through e-mail and through the Password Server.

 

These messages will display each time the requesting user enters the Home page unless the user presses "x" to close them out.

Email Templates

The templates for the emails the users are sent upon a request being created and a request being approved or denied can be viewed in Advanced > Email > Email Templates if the user has "Email Templates" permission. These new email templates are:

More information about email templates can be viewed here.