I may be on mission impossible:
Setting: Health Care Concern: Restricting Access Based on Job Function of the day.
A person may work 3 days in one of our OU's, and then cover a shift in a different OU for 2 days. I.e. the person is part time in two different departments.
For a single App call it "Patient Record", we want the user restricted to view access to the app when working for OU 1 and only to use Update access on the days they are in OU 2.
I understand that "Member Of" Group is an attribute of the user object, and the typical behaviour for application authorization is to see Member of "View" group, and Member of "Update" group and give the user session one of the levels of access (Most restrictive or most permissive? or just the first one it finds in the list ?
If I asked the user at login with a custom login page to pick the OU (I.e. select their department from a list), is there any way to get an app to give them only the access associated with that OU ?
I know you can do this with two discrete Domains, and with giving the user a different userid in the single domain we have, is their any way to do this and meet the following requirements:
- User must have only one userid?
- User must get different permission based on Org Unit
- User may select which Org Unit
- We want to do this in a single AD domain, trying to achieve single forest single domain, not head the other direction.
- I'd prefer not to have to customize the app to make this work.
Thanks in advance for any help.