Oim Dynamic Role Assignment Peoplesoft

Setting Up Roles

This chapter provides an overview of roles and discusses how to:

  • Manage roles.

  • Define role options.

  • Create a NEWUSER role.

  • Execute dynamic role rules.

  • Using the PeopleSoft Administrator role.

Understanding Roles

Roles are an intermediate object that exist between permission lists and user profiles. Roles aggregate permission lists so that you can arrange permissions into meaningful collections.

Note. In previous releases, roles were associated with PeopleSoft Workflow. PeopleTools has expanded role definitions so that they are also a part of the security architecture. There is only one type of role definition, and you maintain it within Security.

Users inherit most of their permissions from the roles assigned to the user profile. However, you assign the following permission lists directly to a user profile:

  • Data permissions.

    These are assigned through a primary permissions list or a row security permissions list.

  • PeopleSoft Navigator homepage permissions.

  • Process profile permissions.

When you assign roles to profiles manually, through the Security pages, these users are static role members.

Other users may obtain membership in a role programmatically. You can run a batch process that uses predefined role rules and assigns roles to user profiles according to these rules. Users who become members of a particular role programmatically are dynamic role members.

Use dynamic role assignment to make your security system scale to large user populations. If you have thousands of users and need to make every change to a user profile manually, the security administrator becomes a bottleneck. If you implement dynamic roles, you reduce administrative tasks.

Managing Roles

This section discusses how to:

  • Copy roles.

  • Delete roles.

  • Remove users from roles.

Copying Roles

To copy a role:

  1. Select PeopleTools, Security, Permissions & Roles, Copy Roles.

  2. On the search page, locate and select the role that you want to copy (clone).

    The Role Save As page appears.

  3. On the Role Save As page, enter a new name in the as: edit box.

  4. Click Save.

Deleting Roles

To delete a role:

  1. Select PeopleTools, Security, Permissions & Roles, Delete Roles.

  2. On the search page, locate and select the role that to delete.

    The Delete Permission List page appears.

  3. Click Delete Permission List.

  4. Click OK to confirm the deletion, or click Cancel to cancel the deletion.

Note. If you attempt to delete a role definition that is currently in use by one or more static or dynamic role users, you must confirm deletion of the role definition. When you confirm, you remove all references to the role.

Removing Users From Roles

To delete the users who are assigned dynamically, use the NO_USERS query to locate the users. You invoke this query using the query rule with dynamic roles.

See Also

Displaying Dynamic Role Members

Defining Role Options

This section discusses how to:

  • Assign permissions to roles.

  • Display static role members.

  • Display dynamic role members.

  • Execute dynamic role rules.

  • Set user routing options.

  • Decentralize role administration.

  • Display additional links for user profiles.

  • Run role queries.

  • View when a role was last updated.

Pages Used to Define Role Options

Page Name

Definition Name

Navigation

Usage

General

ROLEDEFN

PeopleTools, Security, Permissions & Roles, Roles, General

Describe the role.

Permissions Lists

ROLE_CLASS

PeopleTools, Security, Permissions & Roles, Roles, Permission Lists

Grant permissions to roles.

Members

ROLE_MEMBER

PeopleTools, Security, Permissions & Roles, Roles, Members

View the current list of static role members.

Dynamic Members

ROLE_DYNMEMBER

PeopleTools, Security, Permissions & Roles, Roles, Dynamic Members

View the current list of dynamic role members. If you aren't using the dynamic roles, this list isn't populated.

Workflow

ROLEWRKFLOW

PeopleTools, Security, Permissions & Roles, Roles, Workflow

Set user routing options.

Role Grant

ROLE_GRANT

PeopleTools, Security, Permissions & Roles, Roles, Role Grant

Decentralize role administration.

Links

ROLE_OTHER

PeopleTools, Security, Permissions & Roles, Roles, Links

View additional links for user profiles.

Role Queries

ROLE_QUERY

PeopleTools, Security, Permissions & Roles, Roles, Role Queries

Run queries about a role.

Audit

ROLE_AUDIT

PeopleTools, Security, Permissions & Roles, Roles, Audit

View when a permission list was last updated.

Assigning Permissions to Roles

Access the Permission Lists page (select PeopleTools, Security, Permissions and Roles, Roles and click the Permission Lists tab).

To add new permission lists to a role, add more rows. Remember that a user's access is determined by the sum of all the permission lists applied to each role to which the user belongs. For instance, suppose you add permission list X and permission list Y to a role. Permission list X has a sign-on time of 8 a.m. to 5 p.m. and permission list Y has a sign-on time of 1 p.m. to 9 p.m. In this scenario, the users assigned to this role can sign in to the system from 8 a.m. to 9 p.m. Always be aware of the contents of each permission list before adding it to a role.

View Definition

Click to open the permission list definition, where you can view the options in the permission to ascertain whether it is suitable for a particular role.

Displaying Static Role Members

Access the Members page (select PeopleTools, Security, Permissions & Roles, Roles and click the Members tab).

If your database contains more than 1000 role members, this page initially retrieves only the first 1000. You can view the other chunks of 1000 members one chunk at a time, either by searching for a user ID or by using the navigation buttons above the Members grid. The navigation buttons enable you to display the first chunk, the previous chunk, the next chunk, or the last chunk.

User ID

Enter part or all of a role member user ID for which to search.

Search

Click to search through the role members for the first chunk of rows that contains the user ID you entered.

View Definition

Click to view the user ID of the role member to ensure that you selected the appropriate definition for inclusion in the role.

Displaying Dynamic Role Members

Access the Dynamic Members page (select PeopleTools, Security, Permissions & Roles, Roles and click the Dynamic Members tab).

Use this page to set the rule to invoke to assign roles. A dynamic role rule is defined or coded in PeopleSoft Query, PeopleCode, or your Lightweight Directory Access Protocol (LDAP) directory. A rule can use a combination of PeopleSoft Query and PeopleCode, or PeopleSoft Query and LDAP. For the rule to successfully assign a role to the appropriate users, you must select the rule type you have in place for a particular role and then specify the object that contains the rule you coded.

Note. You must define your role rules before you apply the options on this page. If you change the name of the rule, add a new rule, and so on, save all changes before you run the rule.

If your database contains more than 1000 dynamic role members, this page initially retrieves only the first 1000. You can view the other chunks of 1000 dynamic members one chunk at a time, either by searching for a user ID or by using the navigation buttons above the Dynamic Members grid. The navigation buttons enable you to display the first chunk, the previous chunk, the next chunk, or the last chunk.

User ID

Enter part or all of a role member user ID for which to search.

Search

Click to search through the role members for the first chunk of rows that contains the user ID you entered.

View Definition

Click to view the user ID of the role member to ensure that you have selected the appropriate definition for inclusion in the role.

Query Rule Enabled

Select if you defined your rule with PeopleSoft Query. The Query Rule group box appears below the Rules group box. Use the Query drop-down list box to select the query that contains your role rule.

PeopleCode Rule Enabled

Select if your rule is a PeopleCode program. The PeopleCode Rule group box appears. Specify the record, field, event, and function associated with your PeopleCode role rule.

Directory Rule Enabled

Select if your role rule is based on information in your directory server. With a directory-based rule, you must assign directory groups. The PeopleCode Rule group box appears because directory rules are implemented using the DynRoleMembers PeopleCode program. This program uses the Directory business interlink to retrieve user and group information from the directory. To view the program, open the FUNCLIB_LDAP record in PeopleSoft Application Designer. Click Assign Directory Groups to select a particular directory group that exists in your LDAP server hierarchy. For example, if your directory server is grouped by geographic region, then your rule could assign a new self-service role to all users in the North America group. Use the Directory Group drop-down list box to select the appropriate directory group value. The values are derived from the LDAP data that you import using the Directory Group Import process.

Execute on Server

Select the appropriate PeopleSoft Process Scheduler server to run the rule.

Execute Rule (s)

The Execute Dynamic Role Rules button on this page launches the DYNROLE_PUBL application engine program which executes the rule(s). The application engine program runs through PeopleSoft Process Scheduler.

After the DYNROLE_PUBL application engine program runs the rule, it publishes a message, ROLESYNCHEXT_MSG, that contains a list of users in the role.

Note. The successful completion of the dynamic roles program does not ensure that your roles were updated; the associated message must also be published successfully.

Use the Process Monitor link on the page to view the status of the application engine program. Use the Service Monitor link on the page to view the status of the message publication.

You can also execute dynamic role rules for all roles and users.

See Executing Dynamic Role Rules.

Refresh

After you run a rule, click to repopulate the grid with updated information.

Process Monitor

Click to view the status of the DYNROLE_PUBL application engine program in the Process Scheduler Monitor.

Service Monitor

After the DYNROLE_PUBL application engine program runs, it publishes a message, ROLESYNCHEXT_MSG, that contains a list of users in the role.

Click the link access the Service Operations Monitor and to view the publication status of the ROLESYNCHEXT_MSG message.

Note. To clear all dynamic users from the role, run the delivered NO_USERS query.

Query Rule Example

This section describes the process of creating a PeopleSoft Query rule that assigns dynamic role membership. This example should also help to illustrate similar techniques that you would use for a PeopleCode or LDAP rule.

Note. This example assumes a working knowledge of PeopleSoft Query.

In this example, you need to find all users who currently have job code KC012 (Human Resource Analyst) and add them to the appropriate role.

To create this rule:

  1. Create a view.

  2. Create the query.

  3. Run the dynamic rule.

Note. The Dynamic Role functionality is not designed to resolve bind variables. When you select a query with a bind variable as a dynamic role rule, the system issues an error. Do not use queries with bind variables as a query rule for dynamic roles. Many of the delivered queries are intended to be used with PeopleSoft Workflow, and many of them contain bind variables. These queries are not designed to work as role rules, but you can modify them to do so.

Note. To create a role query based on PSOPRALIAS and avoid issues with row-level security, use PSOPRALIAS_VW instead. You must manually synchronize this view with PSOPRALIAS.

Note. If the query returns duplicate user IDs, dynamic roles will fail on the insert into PSROLEUSER and may have mixed results. You should add a DISTINCT clause to your query role rule to return unique IDs, especially when your query involves thousands of user IDs.

This example shows a possible view definition for the example role rule:

The associated SQL object is:

Note. The OPRID field must not be a key in this view because PeopleTools appends AND OPRID = “<CURRENT_USER_ID>” in PeopleSoft Query Manager. This action occurs if you use the record OPRALIAS directly in the query.

The SQL is:

After you create the view, add it to the appropriate query tree. In this case, you add the new view to the QUERY_ TREE_HR:

After you create the view, you create a query. In this example, the properties assigned to the query enable it to assign a role to users who currently have the job code K03002, Human Resource Analyst. This example shows the query properties:

The query contains the following criteria:

The SQL for the query is:

Because the view does not have OPRID as a key, the resulting SQL does not contain the extra line AND B.OPRID = PS.

Note. When you save a query used for a dynamic role query, you should specify that it is a role query.

With the view and the query created, you then set up the query rule on the Roles - Dynamic Members page. Select Query Rule Enabled and select the query in the Query field.

After enabling the query rule, test the rule to make sure the system assigns the appropriate roles to the appropriate users. To populate the role membership table, click Execute Rule.

Setting User Routing Options

Access the Workflow page (select PeopleTools, Security, Permissions and Roles, Roles and click the Workflow tab).

Allow notification

Select to enable PeopleSoft Workflow notification. Users can notify others of data on a PeopleSoft page through email or worklists.

When components are designed, developers can enable the Notify toolbar on the Component Properties dialog box in PeopleSoft Application Designer. If this option is set for a particular component, then this check box enables security administrators to enable the Notify feature per role.

Allow Recipient Lookup

Select to enable role users to browse the database for the email addresses of other users in the PeopleSoft system, such as vendors, customers, employees, sales leads, and so on. This check box is available only if the Allow notification check box is selected.

Use Query to Route Workflow

Select to determine workflow routings by a workflow query. This value depends on your workflow scheme.

Decentralizing Role Administration

You use the Role Grant page to assign limited security administration capability to specified users. You designate them as remote security administrators by defining roles that they can grant to other users. Because the settings on this page are part of the implementation of distributed user profiles, the page is documented along with the Distributed User Profiles component.

See Implementing Distributed User Profiles.

Displaying Additional Links

Access the Links page (select PeopleTools, Security, Permissions & Roles, Roles and click the Links tab).

Use this page to access links to other pages within your PeopleSoft system. For example, perhaps a PeopleSoft application requires a specific security setting to be associated with a role. If this application-specific setting appears on a page not in PeopleTools Security, add a link to the application page so that anyone updating the role can easily navigate to the page.

Note. The Links page is read-only. You create the inventory of links to pages that exist outside of PeopleTools Security by using the Security Links component.

If you have added any links for roles in the Security Links component, they appear on the Links page.

See Also

Administering Security from Applications

Running Role Queries

Access the Links page (select PeopleTools, Security, Permissions & Roles, Roles and click the Role Queries tab).

Use role queries to provide detailed information about a role, such as the user IDs and permission lists associated with the role. The available queries are documented on the Role Queries page.

To run a role query:

  1. Click the link associated with the query that you want to run.

    This action invokes a new browser window.

  2. View the information the query returns or click a download results link.

    Note. The size of the file appears in parentheses next to the download options.

    The download options are:

    • Microsoft Excel spreadsheet

      Downloads the query results as a Microsoft Excel spreadsheet (.xls) file.

    • CSV text file

      Downloads the query results as a comma-separated values (.csv) file.

Viewing When a Role Was Last Updated

Access the Audit page (select PeopleTools, Security, Permissions & Roles, Roles and click the Audit tab).

View when a role was last updated and by whom. You can also view who has made changes to security tables by using the Database Level Auditing feature.

See Also

Understanding Database Level Auditing

Creating a NEWUSER Role

When a new user enters the system and you have implemented dynamic role rules, the user does not belong to any roles until your role rules execute. When you enter a new user into the system, the user has access only to the public pages you authorize for the NEWUSER role. When the dynamic role rules execute, the new user becomes a member of the roles that apply based on the user's employee position.

Note. The NEWUSER role is not a PeopleSoft-delivered role. You can name the role to suit your requirements.

To implement a NEWUSER role:

  1. Create your NEWUSER role.

  2. Add permission lists to the role so that members of this role have access to the pages that are appropriate for all users within the system, like My Profile and any other areas that are not a threat to your system security.

  3. Apply the appropriate roles.

    If you use dynamic role assignment, then wait until the batch program runs; if you use static role assignment, then you must wait until an administrator manually applies the appropriate roles.

    If the role rules run only one once in a 24-hour period, new employees may not have access to the system until the next day. If the rules run more frequently, they may have access within a couple of hours. If a new user cannot wait until the next run of the dynamic role rule, you can use one of the following options:

  • Add required pages to one of the permission lists used by the NEWUSER role.

  • Reduce the time between the dynamic rule executions.

    Note. Reducing the execution interval of the dynamic rules may affect performance, depending on how the rules are implemented.

  • Add a Signon PeopleCode script that detects that the user needs access to a certain role.

    To do this, run a query against LDAP, the database, or the location where the information resides. Use the User Profile component interface to add the appropriate roles to the user, according to the query results.

Executing Dynamic Role Rules

This section discusses how to:

  • Execute dynamic role rules for a role.

  • Execute dynamic role rules for a user profile.

  • Execute dynamic role rules for all roles and user profiles.

Understanding Executing Dynamic Role Rules

You can execute dynamic role rules in the three modes. You can execute dynamic role rules by:

  • Role.

  • User profile.

  • All roles and user profiles.

Roles rules are executed by the DYNROLE_PUBL application engine program that runs through PeopleSoft Process Scheduler. After the program runs, it publishes a message, ROLESYNCHEXT_MSG, that contains a list of users and roles for the rule. The application engine program does not update any tables; the message (subscription PeopleCode) performs the actual database updates.

Note. The successful completion of the dynamic roles program does not ensure that the roles were updated; the associated message must also be published successfully.

Each page that you can use to execute dynamic role rules features a link to the Process Scheduler Monitor where you can monitor the status of application engine program processing. In addition, each page features a link to the Service Operations Monitor where you can view details of the ROLESYNCHEXT_MSG message publication of users and roles for the rule.

Executing Dynamic Role Rules for a Role

To execute a dynamic role rule for a single role use the Roles–Dynamic Members page (ROLE_DYNMEMBER). To access the Roles–Dynamic Members page, select PeopleTools, Security, Permissions & Roles, Roles and click the Dynamic Members tab.

Click the Execute Rule(s) button on the page to execute the role rule(s). The Execute Rule(s) button on this page launches the DYNROLE_PUBL application engine program which executes the rule(s).

See Displaying Dynamic Role Members.

Executing Dynamic Role Rules for a User Profile

To execute a dynamic role rule for a single user profile use the User Profile – Roles page (USER_ROLES). To access the User Profile – Roles page, select PeopleTools, Security, User Profiles and click the Roles tab.

Click the Execute Rule(s) button on the page to execute the role rule(s). The Execute Rule(s) button on this page launches the DYNROLE_PUBL application engine program which executes the rule(s).

See Setting Roles.

Executing Dynamic Role Rules for All Roles and Users Profiles

To execute a dynamic role rule for all roles and user profiles use the Dynamic Role Rules page (ROLEDYNLAUNCH). To access the page select PeopleTools, Security, Permissions & Roles, Execute Role Rules. The following example shows the page:

The Dynamic Role Rules page features the following page controls:

Server Name

Enter the name of the process scheduler server to run the rule(s).

Execute Dynamic Role Rules

The Execute Dynamic Role Rules button on this page launches the DYNROLE_PUBL application engine program which executes the rule(s). The application engine program runs through PeopleSoft Process Scheduler.

After the DYNROLE_PUBL application engine program runs the rule, it publishes a message, ROLESYNCHEXT_MSG, that contains a list of users in the role.

Note. The successful completion of the dynamic roles program does not ensure that your roles were updated; the associated message must also be published successfully.

Use the Process Monitor link on the page to view the status of the application engine program. Use the Service Monitor link on the page to view the status of the message publication.

Process Monitor

Click to view the status of the DYNROLE_PUBL application engine program in the Process Scheduler Monitor.

Service Monitor

Click the link to check the status of the publication of the ROLESYNCHEXT_MSG message in the Service Operations Monitor.

Using the PeopleSoft Administrator Role

The PeopleSoft Administrator role gives full access to all menus and pages in the PSAUTHITEM table.

The PeopleSoft Administrator role cannot be viewed, edited, modified, or cloned because it is not defined as other roles are defined. The PeopleSoft Administrator role is hard-coded into every application. You will not find this role if you search for it in the roles component.

Note. The PeopleSoft Administrator role does not have access to data. Data security is granted through the Primary and Row level permission lists assigned directly to a user profile.


You can execute dynamic role rules in the three modes. You can execute dynamic role rules by:

  • Role.

  • All roles for a user profile.

  • All roles and user profiles.

Roles rules are executed by the DYNROLE_PUBL application engine program that runs through PeopleSoft Process Scheduler. After the program runs, it publishes a message, ROLESYNCHEXT_MSG, that contains a list of users and roles for the rule. The application engine program does not update any tables; the message (subscription PeopleCode) performs the actual database updates.

Note: The successful completion of the dynamic roles program does not ensure that the roles were updated; the associated message must also be published successfully.

Each page that you can use to execute dynamic role rules features a link to the Process Scheduler Monitor where you can monitor the status of application engine program processing. In addition, each page features a link to the Service Operations Monitor where you can view details of the ROLESYNCHEXT_MSG message publication of users and roles for the rule.

0 Thoughts to “Oim Dynamic Role Assignment Peoplesoft

Leave a comment

L'indirizzo email non verrà pubblicato. I campi obbligatori sono contrassegnati *