Prev
Next
Forums Infor / Lawson Platforms S3 Security

LSA Allow users access to other's batch jobs by group

 4 Replies
 1 Subscribed to this topic
 15 Subscribed to this forum
Sort:
Author
Messages
haddixst
Basic Member
Posts: 8
Basic Member
11/17/2016 3:11 PM

    Hello, we are implementing LSA as part of our V10 upgrade.  We are having issues trying to allow users access to other user's batch jobs.  What we would like to do is to have for example a member of the payroll department have access to their own jobs, plus access to jobs of other members of the payroll department.  I'm guessing this would maybe be implemented using groups??  Any advice is appreciated.  Thanks

    mikefortuna
    Basic Member
    Posts: 14
    Basic Member
    11/17/2016 7:07 PM
      Check out the Resources and Security Administration Guide LSRDAG_10.0.9.0_UWA.pdf from Infor, pages 210-211

      Example rule for Unix and IBM i
      In this example:
      •
      A user who is a member of HRGROUP can access all jobs and reports of HRGROUP members.
      •
      HRGROUP is a Group that you have created (or will create)
      •
      "getHostServiceID" and "isMemberOf" are functions available with Expression Builder
      UserName==user.getHostServiceID()||isMemberOf('HRGROUP',UserName)&&user.isMemberOf('HRGROUP')'ALL_ACCESS,'else'NO_ACCESS,'


      Example rule for Windows
      In this example:
      •
      A user who is a member of HRGROUP can access all jobs and reports of HRGROUP members.
      •
      HRGROUP is a Group that you have created (or will create)
      •
      "getHostServiceID" and "isMemberOf" are functions available with Expression Builder
      •
      HRGROUP is a Group that you have created (or will create)
      •
      "getHostServiceID" and "isMemberOf" are functions available with Expression Builder
      UserName==user.getHostServiceID()||isMemberOf('HRGROUP',getRMIdForEnvOSId(UserName)) &&user.isMemberOf('HRGROUP')'ALL_ACCESS,'else'NO_ACCESS,'

      K. Hopkins
      Basic Member
      Posts: 6
      Basic Member
      11/17/2016 7:24 PM
        We are just finishing up LAUA to LS9 migration. This is what I did. We add the group to users that have the need.

        Profile=GEN
        SecClass=AllGENAccess
        Elements= UserName
        Rule=
        If (user.getUserName()==UserName) then ALL_ACCESS
        ElseIf user.isMemberOf('LBIViewOtherUsersJobs') then ALL_ACCESS
        Else NO_ACCESS
        Karen Sheridan
        Veteran Member
        Posts: 142
        Veteran Member
        11/17/2016 7:39 PM
          We have been on LSA v10 for 2 years now and were on LSA v9 before that. We still do it the old fashioned way with usergrpdef from the command line.
          haddixst
          Basic Member
          Posts: 8
          Basic Member
          11/25/2016 4:27 PM
            Thanks for the suggestions everybody.... very much appreciated!