1. GMS.NET Security
Overview

2. Security and permissions
Security Aspects
Which system components are available for the user
Which data is accessible for the user and what can he or she modify
Security and permissions
Data Masks
User security permissions in GMS have two aspects: permissions to predefined parts of the user interface and visibility to certain object related subsets of data in the system. User interface permissions are permissions set for a field page, icon, menu item or subsets of such elements. User visibility on the other hand defines which objects in the system the user will be able to see – Program, Findings, Countries, Functions, GL.

3. Security Engine ASPMOD
Security may affect every component of the System
Whole page
Specific element from the page
Title
Menu
Icon
Button …
Components are grouped in business groups
Security is applied on the business groups
UI Permissions Engine (part of the ASPMOD component) is capable of applying effective permissions as granular as a single ASP.NET web control placed on a specific web page. The ASPMOD is an external component that will not be available to any user after the system is completed. Instead a GMS user with special permissions (Permissions Administrator) can use the ASPMOD component to create new Permission Groups, edit existing Permission Groups and assign UI Items as members to these Permission Groups. Note that any action that is performed through the ASPMOD should not be included in the end-user documentation, as the end user will not have access to this functionality.

4. User Roles And Positions
GMS.NET replicates the organizational hierarchy of the organization
Employee Hierarchy
Position
Abdul Tejan Cole
Executive Director
Aita Sarr
Finance Director
Youssoupha Pouye
Finance Office
Bambo CISSOKHO
Finance Officer

5. User Roles
One employee may have one Position and one Role that is equal to this position
One Employee may play several Roles in the organization and have multiple roles assigned for his or her position
Roles access is predefined

6. Special roles
Power User – a role that is usually not assigned to anyone from the organization because the power user has full visibility over the system
Supervisor – This is an automatic role generated from the organizational hierarchy. The supervisor has full visibility over his subordinates created documents

7. Effective User Rights
The user inherits cumulative rights from all Roles assigned to him.
Inherited (Effective) permissions may be further customized for each individual in the organization

8. User login Unique username and password is required
Password expiration
Multiple logins with one username not allowed
Login may be temporary disabled for specific users
Username is unique for one database (if more then one database is hosted)

9. Financial user Required to post transactions
May be limited for specific ledgers (D)
Financial user abbreviation is recoded in each posted transaction (audit trail)

10. Data Masks Limits what data a user may see by: Programs Fundings
Countries
Categories of Work
GL Accounts ….

11. Example
Marie works with Program L called LAW, JUSTICE, HUMAN RIGHTS

12. Objects visibility
Object visibility by default is the list of objects that the user may see according to his masks
The list may be further customized

13. Objects Visibility Scope
Object visibility is applied to the following Objects:
Programs
Fundings
Countries
Categories of work
GL Accounts
Projects
Application and Grants
Contracts
Operational Activities
Financial Requests
Financial Reports
Financial Transfers

14. Security Overview User Access User Access Roles Effective Permissions
Inherits rights from
After customization
Data Access
User
Data
visibility
Masks
Object visibility
Limited by
After customization

15. Audit Trail – Change Log
Change log records all actions in the system
Central page where everything is seen on one page
Custom page of changes applied for each document

16. Audit Trail – Notifications
Responsible people get notified of system action they have been subscribed for By
By the inbuilt tasks module