![Meet Us at the Oracle Consulting Lounge! Relax, Rest Your Feet, and Have a Snack! Contact us: Denise Goin – [email_address] You are invited to the Oracle Consulting Lounge within the Oracle Exhibit Booth: Meet the Oracle Consulting Experts I will be there Monday 4:30-6:30 and Tuesday 2-4 Sign up for our Upgrade Workshop Relax and have a snack For a copy of this presentation contact us at: [email_address] Please complete the survey at: http://www.heug.org/p/su/rd/sid=283](https://image.slidesharecdn.com/26012managingauditingsecurityduringimplementationandbeyond03172009-12714298889257-phpapp02/85/26012-Managing-amp-Auditing-Security-During-Implementation-And-Beyond-03172009-65-320.jpg)
26012 Managing & Auditing Security During Implementation And Beyond 03172009
- 2. Managing & Auditing Security During Implementation and Beyond Denise Goin Senior Consultant
- 3. Introductions Denise Goin 3 years of experience with Oracle Public Sector/Higher Ed 12 years of experience with the PeopleSoft software in Higher Ed, City Government, K-12 and Public/Private Commercial sector.
- 4. The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle. Safe Harbor
- 5. Overview Today we are going to go over what comes delivered and what you can do to help yourself manage your PeopleSoft Security <Insert Picture Here> Anyone who has ever had to write a term paper can remember the feeling of sitting at the desk, pen in hand and a blank piece of paper (or should I say a blank word document ) in front of you. The look on you face then would have resembled the looks I see on faces of people that are in charge of security during an implementation.
- 6. Agenda What is delivered? How to map and manage pages and other permissions to roles and users. What are the core security tables? HR row level security Campus row level What's new in 9.1? Creating custom (gasp!) audit records Audit reports <Insert Picture Here>
- 7. <Insert Picture Here> What is delivered that can help me?
- 8. Delivered Tools for Security- Queries Where are they? Main Menu > PeopleTools > Security > Common Queries These are great starting points, not only to run as delivered, but copy them and put in your own criteria and prompts, make them your own! Main Menu > PeopleTools > Security > User Profiles UserID Queries tab Main Menu > PeopleTools > Security > Roles Role Queries tab Main Menu > PeopleTools > Security > Permission Lists Permission List Queries tab
- 9. Delivered Tools for Security- Queries Where are they? Small selection of the more commonly used queries from all of the Security pages in one place.
- 10. Delivered Tools for Security- Queries Where are they?
- 11. Delivered Tools for Security- Queries How can I use the delivered queries, and make them my own? Find the delivered query name They all start with PT_SEC
- 12. Delivered Tools for Security- Queries How can I use the delivered queries, and make them my own? Open the delivered query and save it using your naming conventions. They are delivered as read only, so you should get this pop up message when opening any of them.
- 13. Delivered Tools for Security- Queries How can I use the delivered queries, and make them my own? Modify the queries to limit as you need for your organization Limit results to your custom roles and permission lists Exclude locked UserID’s Pull additional fields, or join additional records to get the data you want.
- 14. Delivered Tools for Security- Queries Records used in the delivered queries- PSACCESSLOG PSROLECLASS PSPRSMDEFN PSPRSMPERM PSCLASSDEFN PSAUTHITEM PSPGEACCESSDESC PSPNLGROUP PSMENUITEM PSSIGNON_VW PSPNLDEFN PSMENUDEFN PSAUTHWS_VW2 PSOPRDEFN PSROLEUSER
- 15. Delivered Tools for Security- Row Level Where are they? Main Menu > Set Up HRMS > Security > Core Row Level Security > Security Tree Audit Report
- 16. Delivered Tools for Security- Row Level Where are they?
- 17. Delivered Tools for Security- Row Level Where are they? Main Menu > Set Up HRMS > Security > Core Row Level Security > Security Data Inquiry
- 18. <Insert Picture Here> How to map and manage pages and other permissions to roles and users.
- 19. <Insert Picture Here> What are the core security tables?
- 20. PSOPRDEFN (OPRID info, including row security and primary permission list) PSROLEDEFN PSCLASSDEFN PSROLEUSER (PSROLEUSER_VW) To audit PSROLEUSER you actually apply the audit record to the view PSROLECLASS PSAUTHITEM * To audit PSAUTHITEM takes a few additional steps, and only achievable using the DataBase level auditing Core Security Tables Did you know these are the same record (definitions) in all PeopleSoft products?
- 21. Core Security Tables PSOPRDEFN PSROLEUSER PSROLEDEFN PSROLECLASS PSCLASSDEFN PSAUTHITEM *
- 22. <Insert Picture Here> Basic’s of HR row level security
- 23. HR Row level security Most of HR’s row level security will come from the ROWSECCLASS field from the Userid. This permission list will be pointing to a specific node on the Dept_security tree. PSOPRDEFN (Core) SCRTY_TBL_DEPT
- 24. HR Row level security
- 25. HR Row level security Main Menu > Set Up HRMS > Security > Core Row Level Security > Security by Dept Tree
- 26. HR Row level security In addition to the Basic row level that is widely used in HR, is security sets, and security by permission list. PSOPRDEFN (Core) SJT_CLASS
- 27. HR Row level security Main Menu > Set Up HRMS > Security > Core Row Level Security > Security Sets
- 28. HR Row level security Main Menu > Set Up HRMS > Security > Core Row Level Security > Security Access Type
- 29. HR Row level security Main Menu > Set Up HRMS > Security > Core Row Level Security > Security by Permission List
- 30. <Insert Picture Here> Basic’s of Campus Solutions row level security
- 31. Campus Row Level Security Campus row level security is defined by USERID’s, or in some instances using a permission list, but not one that is applied to the PSOPRDEFN table, such as HR’s ROWSECCLASS does. This allows for a very dynamic security, but it also means a lot of records to contain this information.
- 32. Campus Row Level Security For the majority of the Campus user’s you would leave the ROWSECCLASS blank, as there will be no need to access HR data. For some users, there is a need to access HR data, as well as their campus specific information.
- 33. Campus Row Level Security Academic Structure- Permission List Name of Page Table Module Notes Service Indicator Display SCC_SI_DISP_ROLE AS Where service indicators are restricted to a specific PL Enrollment Security OPRCLASS_DEF_SA AS Contains access by permission list to enrollment security Self-Serv Enrollment Perm List SA_SS_ENRL_PL AS If allowing self service to enrollment for students, this would be used so you can include the permission list in the “base” self-service access Demographic Data Access RUNCNTL_MSK_CFG AS This is a combination of setup data and the runcontrol information for setting up DDA masking. If you audit this table, you can track changes as well as who ran it and when.
- 34. Campus Row Level Security Academic Structure- USERID Name of Page Table Notes Academic Institution Security SCRTY_TBL_INST Basic Institution level access. This is a base to the Career, program and plan/ Institution/Career Security SCRTY_TBL_CAR For each userid, and each institution they are granted access to, set up the careers that userid is allowed to have access to. Academic Program Security SCRTY_TBL_PROG Academic Program is set up for all combinations of Userid with Institution and Career. Academic Plan Security SCRTY_TBL_PLAN Academic Plan is built for each combination of Userid and Institution Academic Org Security SCRTY_TBL_ACAD Each Userid might have multiple Academic Org entries. You can grant level at the highest level of the ACAD Org tree, or down to more specific nodes Admissions Action Security SCRTY_ADM_ACTN This defines what kinds of admissions actions a user can do, not per institution, so whatever they are granted, applies to all institutions they have access to. Program Action Security SCRTY_PROG_ACTION This defines what kinds of Program actions a user can perform, not per institution, so whatever they are granted, applies to all institutions they have access to. Recruiting Center Security SCRTY_RECR_CENTER This defines the recruiting center the user will have access to, this is based on each institution the userid has been set up for. Application Center Security SCRTY_APPL_CENTER This defines the application center the user will have access to, this is based on each institution the userid has been set up for.
- 35. Campus Row Level Security Academic Structure- USERID Name of Page Table Notes Service Indicator Security SCRTY_TBL_SRVC Where service indicator place and release security is still set, as in previous releases Student Group Security SCRTY_TBL_STGP This is part of the new security for 9.0, and is where you assign student groups to a userid, for each of their institution. A user might have access to different student groups at different universities Transcript Type Security SCRTY_TSCRPT Old- this is for universities upgrading, that are not switching to the new 9.0 transcript process Transcript Report Security SSR_SCRTY_TSRPT New- 9.0 this is for the new transcript process. SEVIS School Code Security SEV_SCHLCD_SCTY SEVIS is only by USERID, so this security would be applied to all institutions they are set up for. SEVIS Pgm Sponsor Security SEV_PRG_SP_SCTY SEVIS Program Sponsor is only by USERID, so this security would be applied to all institutions they are set up for. Test ID Security SAD_TEST_SCTY Test ID security is only by USERID, so this security would be applied to all institutions they are set up for. Population Update Security SCCPU_SRTY_TBL Population update security is only by Userid. Every record they are allowed to update, they will be allowed to update at all institutions. Advisement Report Security SAA_SCRTY_AARPT Advisement report security is set up by the combination of Userid and Institution, so they can be granted different reports for each institution if that is needed.
- 36. Campus Row Level Security Student Financials- USERID Name of Page Table Notes Business Unit SEC_UNITSF_OPR Both of these records are part of the Business Record security by userid. SEC_UNITSF_OPR is the parent record. Business Unit SEC_CSHOFF_OPR Company SEC_COMPANY_OPR Grant a user ID access to the transactions for particular companies Credit Card and Bank Account SEC_CC_OPR This security should be granted to only a few people in the institution. User IDs and permission lists to which you do not grant credit card security access can view only the last four digits of the credit card number. Institution Set SEC_ISET_OPR If you select no security for institution sets on the Security Options page, you do not need to complete the pages listed in this section, because all user IDs and permission lists have access to all institution sets. Item Type SEC_ITEM_SU_OPR Both of these records are used to assign security for Item Types. If you select no security for item types on the Security Options page, you do not need to complete this security Item Type SEC_ITEM_OPDATA
- 37. Campus Row Level Security Student Financials- USERID Table Name of Page Notes Origin IDs SEC_ORIGIN_OPR If you select no security for origin IDs on the Security Options page, you do not need to complete the pages listed in this section because all user IDs and permission lists have access to all origin IDs SetID SEC_SETID_OPR If you select no security for setIDs on the Security Options page, do not complete the pages listed in this section, because all user IDs and permission lists have access to all setIDs. Student Institution Set (Self Service Institution Set Override) ISET_OPR The User Profiles Management feature assigns institution sets to user IDs. You use the Self Service Institution Set Override page to change the institution set assigned by the User Profiles Management feature. By overriding the institution set on this page, instead of on the User Defaults 2 page, you can view a history of the changes. You must first set up institution sets and then assign a user ID to an institution set. A user ID must be assigned an institution set by the User Profiles Management Application Engine process (USERPROFILE) to have an institution set appear in the Calculated Value field on the Self Service Institution Set Override page.
- 38. Campus Row Level Security Student Financials- Permission List Name of Page Table Notes Business Unit SEC_UNITSF_CLS Both of these records are part of the Business Record security by Permission List. SEC_UNITSF_OPR is the parent record. SEC_CSHOFF_OPR Company SEC_COMPANY_CLS Set up a Permission List to use to grant access to the transactions for particular companies Credit Card and Bank Account SEC_CC_CLS This security should be granted to only a few people in the institution. User IDs and permission lists to which you do not grant credit card security access can view only the last four digits of the credit card number. Institution Set SEC_ISET_CLS If you select no security for institution sets on the Security Options page, you do not need to complete the pages listed in this section, because all user IDs and permission lists have access to all institution sets.
- 39. Campus Row Level Security Student Financials- Permission List Name of Page Table Notes Item Type SEC_ITEM_SU_CLS Both of these records are used to assign security for Item Types. If you select no security for item types on the Security Options page, you do not need to complete this security Item Type SEC_ITEM_CLDATA Origin ID SEC_ORIGIN_CLS If you select no security for origin IDs on the Security Options page, you do not need to complete the pages listed in this section because all user IDs and permission lists have access to all origin IDs SetID SEC_SETID_CLS If you select no security for setIDs on the Security Options page, do not complete the pages listed in this section, because all user IDs and permission lists have access to all setIDs.
- 40. Recent Changes- Have you heard?
- 41. <Insert Picture Here> What's new in Campus Solutions 9.0 Security-
- 42. Campus Solutions Pre Bundle 11 The page we all know and love (?)
- 43. Campus Solutions Pre Bundle 11
- 44. Campus Solutions Bundle 11
- 45. Campus Solutions Bundle 11 It was asked for, and we are all very happy to have it.
- 46. User Preferences When you enter a user ID in this field, the default values that you set up in the User Default component for the entered user ID are assigned to the user ID, including the enrollment override defaults which assigns the Enrollment Access ID. 3C Group security The user 3C group security default value is no longer assigned to the user ID. When you enter a user ID in this field, the system also sets the values on the User 3C Group Summary page of the User Defaults component. Campus Solutions Bundle 11 In addition to adding the additional SACR types to the copy- these were also added/changed.
- 47. We (security) were given the inch in bundle 11, lets go for the mile. If you have any comments, suggestions for changes, customizations you have had to do to meet your business’s security needs, especially changes that many of you are making, please feel free to pass them on to me, and I will pass them onto the appropriate development teams.
- 48. <Insert Picture Here> Auditing Security
- 49. <Insert Picture Here> Delivered Audit\Security Management Tools?
- 50. Delivered? Student Financials- Userid
- 51. Delivered? Student Financials- Permission List
- 52. <Insert Picture Here> Other Options?
- 53. Other Options? Create a clone of a delivered record Must start with AUDIT_ Do Not copy PeopleCode (It will ask, say No) Take off all Keys, Search Key and List Box Items off Insert three audit fields AUDIT_OPRID AUDIT_STAMP AUDIT_ACTN Save and Build (If this table will see a lot of insertions, especially in a short period of time, ask DBA about which tablespace to have it in)
- 54. Create the Audit Subrecord If you don’t have this already created
- 55. Create the Audit Subrecord Make sure that the System Maintained is checked on the record field properties
- 56. Create the Audit Record
- 57. Traditional Method Open the record being audited, attach the audit record in the record properties
- 58. Something new Not new in 9.0, but still a newer method
- 59. Other Options? Something New
- 60. Other Options? Something New
- 61. <Insert Picture Here> Reports?
- 62. Reports Audit Reports- Captures before and after.
- 63. Reports Security report- By Oprid
- 64. Reports Security report- Complete report- more manageable
- 65. Meet Us at the Oracle Consulting Lounge! Relax, Rest Your Feet, and Have a Snack! Contact us: Denise Goin – [email_address] You are invited to the Oracle Consulting Lounge within the Oracle Exhibit Booth: Meet the Oracle Consulting Experts I will be there Monday 4:30-6:30 and Tuesday 2-4 Sign up for our Upgrade Workshop Relax and have a snack For a copy of this presentation contact us at: [email_address] Please complete the survey at: http://www.heug.org/p/su/rd/sid=283
Editor's Notes
- #21: Since these are the same, can have auditing created in once product/environment and migrated between products with no impact. Saves time PSoperdefn- what is included? What does the rowsecclass and primary permission list do in different environments? (Campus, HR) Why the view for the role user? PSAUTHITEM is different from the rest, as it is still a work record, not easily audited.
- #24: Tough integration point here, Campus needs access to the tree manager to set up ACAD_ORG, which also opens up the dept_security tree to be touched. Same tool to edit either tree.
- #25: Here we want to provide data security (row level security) to a group of users to only see employees in these departments.
- #26: By assigning the 2 parent nodes for Benefits and Human resources, we grant access to the nodes that fall beneath them in the department security tree.
- #27: How many of you have used Security Sets already? For what kind of users security?
- #33: If needs HR data, use either a rowsecclass permission list, if the access is contained within a single node, or under a node in the dept_security If the HR data crosses nodes, but does not roll up, for instance employees in a paygroup at different colleges, departments, locations, as long as there is a commonality in the job record (such as paygroup) you can isolate those employees and grant access to a user profile using the rowsecclass field on the oprdefn page.
- #36: Make sure that only the correct page for transcript security is visible in your environments. Don’t leave them both visible, as it may end up causing confusion as to which one to use.
- #37: Depending on the security option that you select for companies on the Security Options page, you grant access to companies using permission lists or user IDs. If you select no security for companies on the Security Options page, you do not need to complete the pages listed in this section because all user IDs and permission lists have access to all companies If you select no security for credit cards on the Security Options page, all users can view the entire credit card number To set up self-service institution set overrides, use the Student Institution Set component (ISET_OPR). The User Profiles Management feature assigns institution sets to user IDs. You use the Self Service Institution Set Override page to change the institution set assigned by the User Profiles Management feature. By overriding the institution set on this page, instead of on the User Defaults 2 page, you can view a history of the changes. Grant permission lists access to business units on the Permission List - Business Unit page, if you are securing item types by permission list. Grant user IDs access to business units on the User ID - Business Unit page, if you are securing item types by user ID. Set up the item type tree in Student Financials.
- #38: Depending on the security option that you select for companies on the Security Options page, you grant access to companies using permission lists or user IDs. If you select no security for companies on the Security Options page, you do not need to complete the pages listed in this section because all user IDs and permission lists have access to all companies If you select no security for credit cards on the Security Options page, all users can view the entire credit card number To set up self-service institution set overrides, use the Student Institution Set component (ISET_OPR). The User Profiles Management feature assigns institution sets to user IDs. You use the Self Service Institution Set Override page to change the institution set assigned by the User Profiles Management feature. By overriding the institution set on this page, instead of on the User Defaults 2 page, you can view a history of the changes. Grant permission lists access to business units on the Permission List - Business Unit page, if you are securing item types by permission list. Grant user IDs access to business units on the User ID - Business Unit page, if you are securing item types by user ID. Set up the item type tree in Student Financials.
- #48: I wish I could take credit for these changes, but although I have certainly griped enough, they don’t really do anything just to please me