EmpowHR EmpowHR Security Overview

2 Application Security Administration Permission List Roles User Profiles Row level security Distributed Security Administration Agenda

3 Application Security An application security definition refers to a collection of related security attributes that you create using PeopleTools Security. The three main PeopleSoft security definition types are: Permission list Roles User Profiles

4 Permission List PeopleTools > Security > Permissions & Roles > Permission Lists Permission lists are the building blocks of user security authorizations. You typically create permission lists before you create user profiles and roles. Permission lists may contain any number of permissions such as page permission, peopleTools permission, and process permission

5 Defining Page Permissions Pages are contained within components, which are ultimately contained within a menu name Pages are contained within components, which are ultimately contained within a menu name Page permissions refer to the pages to which a user has access.

6 Defining CI Permissions Grant access to any component interfaces that a user may need to use to complete business transactions.

7 Defining Query Permissions Control the query operations a user can perform and the data a user can access while using PeopleSoft online Query

8 Roles PeopleTools > Security > Permissions & Roles > Roles Roles are an intermediate object that exist between permission lists and user profiles. It combines a set of permission lists into a meaningful collection. The View Definition link will display the permission list definitions.

9 Defining Role Options Members tab is used to view the current list of users assigned to the role.

10 Defining Role Options Options to enable PeopleSoft Workflow notification. Users can notify others of data on a PeopleSoft page through or worklists.

11 Defining User Profiles Permission lists are assigned to roles with the exception of the following, which are assigned directly to the user ID, Navigator Homepage, Process Profile, Primary Permission List, Row Security

12 Defining User Profiles Navigator Homepage: Associated with PeopleSoft Navigator maps Process Profile: Defines a user’s access for running batch processes through PeopleSoft Process Scheduler. For example, the process profile is where users are authorized to view output, update run locations, restart processes Primary: Defines a users organization default values such as Business Units, SetID and Company. Row Security: Defines a user’s access to the rows of data in the system

13 Defining User Profiles ID types and Attribute Name enable you to link user types with the records that are most relevant when a user interacts with the system. (i.e ESS/MSS)

14 User Profiles PeopleTools > Security > User Profiles > User Profiles User profiles define individual PeopleSoft users. You define user profiles and then link them to one or more roles.

15 Defining User Profiles Select an alternate role user to receive routings sent to this role user. Use this option when the role user is temporarily out (for example, on vacation or on leave).

16 The Audit page is a display-only page that enables you to determine: When a profile was last updated. Who updated the profile. Defining User Profiles

17 Understanding Row level security Row level security refers to controlling access to the rows of data in the system with security search views. It enables the system to ensure that users have access only to that which you have granted them access. This diagram shows how permission lists are created, assigned data permission, and assigned to users: User

18 Understanding Row level security The Permission List relationship to the Department Security Tree is what defines the Permission List as a Row-Security Permission List. SETIDs, associated DEPTIDs, and Access Codes are what set apart a Row-Security Permission List from a standard application Permission List. Navigation: Setup HRMS > Security > Department Security > Setup Security Access

19 Understanding the Department Security Tree A security tree is represents the organization's security hierarchy. Security trees enable you to grant / deny access to an employee's data by granting access to DEPTID to which they report. Navigation: Tree Manger > Tree Viewer

20  As the user population increases in size, it can become impractical for one person to centrally administer all of EmpowHR user profiles. You can distribute some or all user profile administration tasks by enabling selected users to use the Distributed User Profiles component. Currently this is only enabled in DHS.  The pages in the Distributed User Profiles component are identical to the corresponding pages in the User Profiles component, except that its User Roles page doesn’t include links for editing the assigned roles.  You can restrict who can use the component, which users they can administer, and what roles they can grant, based on the roles to which they themselves belong. Distributed Security Administration

21 Implementing Distributed Security Use permission lists and roles to configure security to give your selected remote security administrators access to the Distributed User Profiles component (USERMAINT_DIST).

22 Implementing Distributed Security Use the Role Grant page in the Roles component (ROLEMAINT) to specify which roles your remote security administrators can grant with the Distributed User Profiles component.

23 Implementing Distributed Security Navigation: PeopleTools > Security > User Profiles > Distributed Set Up Use the Set Distributed User Profile Search Record page to define a search record that returns only the user IDs that you want remote security administrators to be able to administer. The default search record is PSOPRDEFN_SRC. We defined our own search record to be more restrictive by Primary Permission list. (Z_PSOPRDEFN_SRC)

24 Administering Distributed User Profiles Navigate to: PeopleTools > Security > User Profiles > Distributed User Profiles Clicking the “Search” button will display only the User IDs within the Administrators own component. This is determined by the search record you specified on the Set Distributed User Profile Search Record page. Clicking the “Search” button will display only the User IDs within the Administrators own component. This is determined by the search record you specified on the Set Distributed User Profile Search Record page.

25 Administering Distributed User Profiles The roles that a given remote security administrator can grant are determined by the selections that you made on the Roles - Role Grant page.