Prev
Next
Forums Infor / Lawson Platforms S3 Security

Process Level Security and ESS Pay

 11 Replies
 1 Subscribed to this topic
 15 Subscribed to this forum
Sort:
Author
Messages
KerriR
Advanced Member
Posts: 34
Advanced Member
12/3/2010 6:53 PM
    We have LS set up to restrict user's access (those who have access to more than just EMSS) based on Process Level using the element group PROCLEVEL.  The problem arises when an employee, who used to be in process level ABC, transfers to a new job and is now in process level DEF.  With this transfer, her access also changes and she is now restricted to process level DEF.  When she goes into ESS to look at her pay checks, her old pay checks are not visible because at the time they were issued, she was in process level ABC.  Does anyone know how to get around this?  I can't give her access to ABC as well as DEF because she has access to HR11 and some other screens where I need to restrict her access to process level DEF (she has access to more process levels, not just the one she is in but I kept it to one for simplicity sake on the example).
    Jimmy Chiu
    Veteran Member
    Posts: 641
    Veteran Member
    12/3/2010 7:21 PM
      Maybe you can do this.

      PROCLEVEL security class - for general use, restrict access based on PROCLEVEL
      ESS security class - for ESS, restrict access based on COMPANY & EMPLOYEE

      Your switched employee would have DEF as PROCLEVEL access. However, in your ESS class, since the company/employee identity matches, he/she should be able to see the paycheck regardless of what processlevel the records are under.
      KerriR
      Advanced Member
      Posts: 34
      Advanced Member
      12/3/2010 7:45 PM
        Actually, that is how we have it set up. PROCLEVEL security on one security class and the ESS security class has COMPEMP element group assigned to it. It appears to me that the PROCLEVEL security overrides the COMPEMP security.
        Jimmy Chiu
        Veteran Member
        Posts: 641
        Veteran Member
        12/6/2010 5:16 PM
          You're right. It would work however if you do this. In your PROCLEVEL secClass.

          Add a second IF statement after the process level check to check against login's EMPLOYEE identity, if it matches the EMPLOYEE identity, grant the appropriate access rights. That would give your switched employee access to the pay info from your PROCLEVEL secClass.

          IE:

          if(isElementGroupAccessible('PROCLEVEL'.....)
              'ALL_ACCESS,'
          elseif(form.EMP_EMPLOYEE==user.getEmployeeId())
              'ALL_ACCESS,'
          else
              'NO_ACCESS,'

          KerriR
          Advanced Member
          Posts: 34
          Advanced Member
          12/6/2010 6:50 PM
            I don't have any form. fields available. I created the element groups at the security class level and I'm assuming programmtic security is kicking in on the forms/tables where I don't explicity apply these element groups. I tried adding your example (well something very similar to it) to the PAYMASTR table but that didn't correct the issue. Do you have any idea if I need to apply it to other tables or what form I need to apply it to? Since it is accessed through ESS, I don't know how to determine what form I need to be working with.
            Jimmy Chiu
            Veteran Member
            Posts: 641
            Veteran Member
            12/6/2010 8:26 PM
              this pdf should help you enable what is needed for the secClass.
              Attachments
              Jimmy Chiu
              Veteran Member
              Posts: 641
              Veteran Member
              12/7/2010 3:06 PM
                If you want, dump your secClasses (the PROCLEVEL and EMSS) and send it to me. I can make the modifications and send it back to you.
                KerriR
                Advanced Member
                Posts: 34
                Advanced Member
                12/8/2010 2:12 PM
                  Thanks for the offer Jimmy. I will be e-mailing the documents shortly.
                  KerriR
                  Advanced Member
                  Posts: 34
                  Advanced Member
                  12/8/2010 2:13 PM
                    I guess I'll need your e-mail address. It doesn't look like we can send attachments thru LawsonGuru
                    Jimmy Chiu
                    Veteran Member
                    Posts: 641
                    Veteran Member
                    12/8/2010 7:21 PM
                      jpchiu@hotmail.com
                      KerriR
                      Advanced Member
                      Posts: 34
                      Advanced Member
                      12/8/2010 8:03 PM
                        The documents are on their way.
                        KerriR
                        Advanced Member
                        Posts: 34
                        Advanced Member
                        2/23/2011 9:17 PM
                          Jimmy, just wondering if you ever had the chance to review the documents I sent you.