Introduction to OFBiz and OFBiz Security

Objectives Understand how the simulation is set up See how to navigate through the OFBiz applications Understand role-based security Review selected OFBiz organizational units

Navigation (Introduction) It’s a hierarchical menu system based on functional applications The levels of menus varies based on the application

Navigation (Applications) AP / AP ACCOUNTING CATALOG to manage customer catalogs CONTENT to manage catalog content FACILITY to keep track of inventory ORDER to work with purchase and sales orders PARTY manger keeps track of users WEB TOOLS provides access to the OFBiz application itself

Security (Introduction) All ERPs support some form of role-based security In general Users have credentials Users get permission to parts of the system based on their job function SAP and OFBiz work similarly I’ll take a bottom-up approach to describing the system

Security (Diagram 1)

Security (Diagram 2)

Security (Implementation) The lowest level of permission is the SecurityPermission These security permissions map to the OFBiz code

Security (Implementation) SecurityGroupPermission assembles permissions together in a group

Security (Implementation) The SecurityGroup entity lists the unique security groups

Security (Implementation) A user has a login and password stored in the UserLogin entity It’s common to store passwords as an SHA hash

Security (Implementation) The UserLoginSecurityGroup entity maps the UserLogin to the assigned SecurityGroup(s)

Creating a User Users are just a type of party OFBiz contains some predefined party types These are use to create assign parties to particular roles

Party (Personal Information) A party (user) has limited personal information This information can be changed

Party (Contact Information) We can communicate with a party in many ways E-mail, physical address, telephone, Web, etc.. So a party can have several contact entries

Party (Payment Information) We have not worked with this yet, but payment types can be configured for customers and suppliers

Party (Other) We can creates notes about the party We can look at visit history for the party Customers are typically associated with a store where they buy goods