Deployment Security

Every object in Appian has a role map that controls who can view, edit, or administer it. Appian's layered security means a user must have permissions to every object involved in a feature to access it.

These controls become especially important during deployments because each object carries its role map to the target environment. Misconfigured security can grant unintended access, lock out administrators, or drop role map entries for users and groups that don't exist in the target.

Source environment

Developers with Viewer access to an application and objects can create, compare, and inspect packages across environments, and manually export them. Application administrators and system administrators on the source environment are the only roles able to directly deploy to the target using Compare and Deploy.

Target environment

Before your organization can use Compare and Deploy, you must specify a system administrator account in the deployment settings in the Admin Console. The Deploy As account must be in the service account role.

When manually importing a package, you must have administer permissions to both the application and the objects that it contains:

• For new objects, the user must be able to create an object on the environment.
• For existing objects, the user must already be an administrator of the object.

The Last Modified By field displays the user who most recently modified the object and the time at which it happened. If the object supports versioning, the Last Modified By information of previous versions is not affected.

Best Practice: Regardless of deployment type, use a group for each application called <Application_Name>_Administrators.

1. Create the group on the source environment and export it (in an application package) to the target environment prior to importing the main application. The group must be deployed in an application package in order for Appian to recognize it as the same group on both environments.
2. Before exporting the application, add this group to all object role maps. Assign Administrator rights to this group.
3. Temporarily add the users (or user) who imports the application on the target environment to this group before performing an import.
4. After the import, remove users from the <Application_Name>_Administrators group, as needed.

Security role maps in deployments

When objects are deployed to another Appian environment, the deployed objects contain a reference to the users and groups listed in their role maps. For example, an exported process model contains the list of users and groups with rights to the process model.

Role map deployment rules:

• A user or group is only included in the role map of a deployed object if at least one of the following conditions is true:
  • The group is present in the import package or in the target environment.
  • The user exists in the target environment and is not deactivated. All other users are dropped from the role map.
• When importing an object that already exists on the target environment (identified by UUID), the resulting role map of the object is what's defined in the import package.
• Some objects can be configured to inherit their role maps from their parent. This configuration is preserved when the object is exported and imported. If the configuration of the object in the import package differs from what's in the target environment, the setting in the import package is used.

Feedback