Setting Up User Access Management

User Access Management (UAM) in GAM Acquisition Central 1.5 requires initial configuration after installation. If you have not yet installed GAM Acquisition Central, see the Installation Guide first.

The setup process varies depending on whether you are configuring UAM for a new GAM Acquisition Central deployment or adding UAM to an existing customer environment. Both scenarios are covered in this guide, along with guidance on ongoing maintenance as new permissions are introduced.

System prerequisites for UAM setup

Before setting up UAM, ensure your environment meets the following requirements:

• Appian platform running version 26.3 or later.
• A supported version of MariaDB as a business data source.
  • Note: Instructions in this guide are for MariaDB databases. For use with other databases, the SQL scripts may need to be modified.
• A supported web browser.
• GAM Acquisition Central 1.5 installed in the target environment. See the Installation Guide for instructions.

UAM access model

UAM implements a three-tier access model to manage security and access across GAM solutions:

Users → Roles → Permission Sets → Permissions

• Users are credential users of GAM that log into solutions.
• Roles are business groups or personas (e.g., Contracting Officer, Sales, Legal). Roles are backed by Appian Groups.
• Permission Sets are collections of permissions grouped under a business function (e.g., "Manage Contracts", "Approve Vendor"). Permission Sets are NOT backed by Appian Groups—they serve as logical groupings within UAM.
• Permissions are granular security groups that manage specific access to process models, interfaces, data, and other platform objects. Permissions are backed by Appian Groups.

Security is managed by the relationships between these objects. As users are added to roles, the existing relationships between roles, permission sets, and permissions automatically manage the user's access. There is no need to assign individual permissions to each user—the defined relationships handle access propagation throughout the hierarchy.

Post-installation configuration for GAM Acquisition Central 1.5

After installing GAM Acquisition Central 1.5, run the following steps to ensure UAM is correctly initialized. These steps must be completed after each GAM solution installation to ensure updates are reflected correctly in UAM.

To initialize UAM after installation:

1. In Appian Designer, start the AS UAM OTP Add Adm To GAM Groups Wrapper process model.
2. Verify that AS UAM OTP Add Adm To GAM Groups Wrapper completed without errors.
3. Run the AS UAM Nightly Sync Process process model.
   • Note: The AS UAM Nightly Sync Process is scheduled to run nightly at 2 AM. You can wait until it runs automatically or update the AS_UAM_NIGHTLY_SYNC_TIME constant and start the process manually.
4. Run the AS GSM UAM Initialization Wrapper process model.
5. Verify that AS GSM UAM Initialization Wrapper completed without errors.

Configure UAM administrator access

To grant initial access to UAM within the Acquisition Central site, add users to the UAM administrator group:

1. Navigate to the Admin Console or Appian Designer > Users.
2. Locate the AS GSM UAM Administrators group.
3. Add the business administrators who will manage roles, permission sets, and user access.

Configure the sync schedule

By default, the sync process runs nightly at 2:00 AM local time. To change the schedule:

1. In Appian Designer, open the AS_GSM_UAM_NIGHLTY_SYNC_TIME constant.
2. Update the value to the desired time or interval.
3. Save and publish the constant.

The sync process uses the updated schedule on its next run.

Set up initial roles and permission sets

With UAM initialized and administrator access configured, you can begin setting up your organization's role structure:

1. Create permission sets: Define reusable collections of permissions that align with your organization's job responsibilities. Navigate to Permission Sets and click + CREATE PERMISSION SET.
2. Create roles: Define roles that correspond to your organizational structure. Navigate to Roles and click + CREATE ROLE. Assign the appropriate permission sets to each role.
3. Configure role hierarchies: If your organization uses hierarchical roles, set up parent-child relationships between roles to enable permission inheritance.
4. Assign users to roles: Navigate to Users, select a user record, and assign them to the appropriate roles.
   • Note: Existing users must be added to their current roles. Manually update each user, or use the Import action on the Users page to make updates in bulk.

For detailed instructions on each of these tasks, see the Quick Start Guide.

Setting up UAM for existing customers

Follow these steps when adding UAM to an environment with an existing GAM Acquisition Central installation. Ensure all system prerequisites are met before proceeding.

1. Out-of-the-box Roles are added to UAM. The sync process adds out-of-the-box role records to UAM. At this stage, only the role records are created—no relationships are established.

2. Out-of-the-box Permissions are added to UAM. The sync process adds out-of-the-box permission records to UAM. At this stage, only the permission records are created—no relationships are established.

3. Add customer customizations to UAM. For any custom groups the customer has created outside of the standard solution, the following steps are required:
   • Classify custom groups. Update the custom Groups in Appian Designer to classify each as either a Role or a Permission by adding the appropriate description text.
   • Run the sync process. The sync process picks up the newly classified groups and adds them to UAM.
   • Create permission sets. If necessary, create new permission sets in UAM to organize the custom permissions.
   • Define relationships. Establish the relationships between roles, permission sets, and permissions to complete the access model for custom groups.
4. Add existing Users to appropriate Roles. The sync process adds existing Appian users to UAM automatically. However, assigning users to roles requires manual effort by the customer, either through the UAM interface or the Bulk Import feature.

Ongoing maintenance: adding new permissions

With each release of a GAM solution, run the following steps to ensure any newly created permissions are added to UAM.

1. In Appian Designer, start the AS UAM OTP Add Adm To GAM Groups Wrapper process model.
2. Verify that AS UAM OTP Add Adm To GAM Groups Wrapper completed without errors.
3. Run the AS UAM Nightly Sync Process process model.
   • Note: The AS UAM Nightly Sync Process is scheduled to run nightly at 2 AM. You can either wait for it to run automatically or update the AS_UAM_NIGHTLY_SYNC_TIME constant and start the process manually.
4. Run the AS GSM UAM Initialization Wrapper process model.
5. Verify that AS GSM UAM Initialization Wrapper completed without errors.

Next steps after setting up UAM

• User Access Management Overview: Learn about UAM's key capabilities and access model.
• Quick Start Guide: Walk through common UAM tasks step by step.
• Groups Reference Page: Understand how UAM-managed groups work alongside traditional groups.

Feedback