Locker / Salamander Users... I need your guidance

[Planehazza]

I have UDFs in SIMS that admin enter to tell Locker which groups to put people in. It's currently very basic and 'Support staff' is too vague, so I want to give more detailed options. We have high turnover in several of our schools and IT lads are constantly replying to emails to say groups are outdated, and I don't want to give staff owner rights or anything like that.

 

Anyone that does this sort of RBAC for groups via SIMS, can I ask how you've put the data entry fields? Have you listed every role possible so they have to scroll down a 50+ item lookup field, or do you keep it simple with 'teacher, slt, admin, support' then use yes/no or tick boxes for other things like 'Is DSL', or 'Is pastoral' etc?

 

An example, in case I'm not putting it across well...

 

Say we get a new member of staff in, and their role is SLT but they teach and have a timetable and perform the DSL role. They'd need groups AllStaff, TeachingStaff, SLTStaff, ClassroomStaff, DSLStaff.

 

How would you present that in SIMS for admin to select? Not technically, I mean visually - in a way that doesn't take the admin person too long. Basic lookup for teacher/slt/admin/support then 'bolt ons' that are extra things they do?

 

Thanks!

Edited July 3, 2024 by Planehazza

[TechMonkey]

Salamander should be able to do this with logic. I don't think Locker can do it, except for AllStaff. and maybe TeachingStaff. The alternative is to ensure your AD details are synced, and use Azure dynamic groups based off Job Title.

[howartp]

Say we get a new member of staff in, and their role is SLT but they teach and have a timetable and perform the DSL role. They'd need groups AllStaff, TeachingStaff, SLTStaff, ClassroomStaff, DSLStaff.

AllStaff, ClassroomStaff and TeachingStaff is automatic based on the existence of a timetable.

 

DSLStaff and SLTStaff are manual groups in AD that we maintain manually - but we don't tend to get new DSLs every day...

[coolhands]

We use salamander; we have 'Staffgroup' this is things like Admissions, Caretakers, Catering, Cover Coaches, Finance, etc as well as Teachers, and SLT. This is the employees primary job role, so can only belong to one. So all teachers (even Head of departments / faculties etc) are 'Teachers'. However SLT belong to 'SLT' staffgroup, they are the only teachers not in the 'teachers' staffgroup. The Staffgroup is a UDF in sims (uses Lookup [tools>lookup>maintain] and sets up the OU permissions etc in active directory. So SLT have teacher rights but teachers don't have SLT rights. We also use SIMS UDGs (this is different from UDFs) and these can be used to add staff to other google email groups. So if you are an SLT teacher of maths you can line manage eg humanities so need to get the humanities emails - therefore can be added to the UDG for humanities and this will mean you belong to the facultyHu email group (we have our faculty emails set as such). Salamander can dynamically make every teacher belong to the correct google email group by what subjects they teach. So eg a teacher of art can belong to facultyAr or whatever by virtue of the fact they are currently teaching an art class. They can be nested so teachers of geography, history, sociology etc can all belong to facultyHu.

 

see pic of the SIMS HR page. We use department too but for internal use eg will state if the 'Teacher' in the staffgroup dropdown is Geography or History.

 

 

Hope that gives you some ideas

Edited July 4, 2024 by coolhands

[Planehazza]

Thanks all. Yep Locker has mail lists features where it looks at timetables and adds them to the respective mailing list. I'm trying to work out the best way to set these fields in SIMS so the admin staff can quickly put people in the right categories to hand other mailing lists like SLTStaff, SENCOTeam etc. It's the balance of giving enough resolution whilst getting them to actually do it at induction so we're not faffing about with manual group memberships every day...

 

Thanks all!

[Planehazza]

Salamander should be able to do this with logic. I don't think Locker can do it, except for AllStaff. and maybe TeachingStaff. The alternative is to ensure your AD details are synced, and use Azure dynamic groups based off Job Title.

 

What I have thus far is done via a Powershell script. Locker looks at the UDF label and uses that as a variable. Happy to share it if you like

[TechMonkey]

That would be much appreciated.

[Planehazza]

That would be much appreciated.

So it's two things: Updating their report in SIMS to pull some UDFs and a powershell script that runs on new AD user

SIMS

UDFs

Add your UDFs to SIMS so that admin etc add the required data.

Report

Login to SIMS as the locker service account. This is required so that you can see the private report that is used for Locker to do its various onboarding/email etc. tasks. Open your LockerStaffV2 report and add the user defined fields that you've created to the report. Ensure you give them a caption at the top, as this is what Locker users to refer to.

Locker

Tweak the script to look at the UDFs to put staff in groups and OUs. This is essentially for categorisation and auto groups on account creation. We could look at dynamic groups but it could get complicated quickly as you know teachers are like with random requests for person A to be added to group Z

 

The script (sorry, the VBB won't retain the line breaks...)

$AD = Get-ADUser -Identity "%UN" -Properties DistinguishedNameswitch ("%UDF1"){ "Admin Staff"{(Add-ADGroupMember -Identity AdministrationStaff -Members "%UN"),(Set-ADUser -Identity "%UN" -Description "%UDF0"),(Move-ADObject -Identity $AD.DistinguishedName -TargetPath "")} "SLT Staff"{(Add-ADGroupMember -Identity SLTStaff -Members "%UN"),(Add-ADGroupMember -Identity AdministrationStaff -Members "%UN"),(Set-ADUser -Identity "%UN" -Description "%UDF0"),(Move-ADObject -Identity $AD.DistinguishedName -TargetPath "")} "Early Years Admin Staff"{(Add-ADGroupMember -Identity EYStaff -Members "%UN"),(Add-ADGroupMember -Identity AdministrationStaff -Members "%UN"),(Set-ADUser -Identity "%UN" -Description "%UDF0"),(Move-ADObject -Identity $AD.DistinguishedName -TargetPath "")} "Early Years SLT Staff"{(Add-ADGroupMember -Identity EYStaff -Members "%UN"),(Add-ADGroupMember -Identity AdministrationStaff -Members "%UN"),(Add-ADGroupMember -Identity SLTStaff -Members "%UN"),(Set-ADUser -Identity "%UN" -Description "%UDF0"),(Move-ADObject -Identity $AD.DistinguishedName -TargetPath "")} "Early Years Support Staff"{(Add-ADGroupMember -Identity EYStaff -Members "%UN"),(Set-ADUser -Identity "%UN" -Description "%UDF0"),(Move-ADObject -Identity $AD.DistinguishedName -TargetPath "")} "Early Years Teaching Staff"{(Add-ADGroupMember -Identity EYStaff -Members "%UN"),(Set-ADUser -Identity "%UN" -Description "%UDF0"),(Move-ADObject -Identity $AD.DistinguishedName -TargetPath "")} default {Set-ADUser -Identity "%UN" -Description "%UDF0"}}$AD2 = Get-ADUser -Identity "%UN" -Properties DistinguishedNameswitch ("%UDF2"){ "Yes"{(Add-ADGroupMember -Identity SupplyStaff -Members "%UN")}

}

 

I've replaced the actual OU paths and replaced with for privacy.