• Search Forums
    Advanced Search Topics Posts
Prev
Next
Forums Infor / Lawson Platforms S3 Security

Progam versus Token Security

 1 Replies
 0 Subscribed to this topic
 16 Subscribed to this forum
Sort:
Author
Messages
John Costa
Veteran Member Send Private Message
Posts: 154
Veteran Member
7/9/2009 8:41 PM
We are in the process of defining our LSF9 security structure and I have waht I hope is a simple question.

When defining security classes for an online object, what is the difference between granting access to a program versus granting access to a token, and why would I use one versus the other?

In other words, why would I grant access to program AC10 versus granting access to token AC10.1?  Do I need to grant access to the AC10 program in order to also grant access to token AC10.1?  Is granting access to token AC10.1 without granting access to program AC10 and acceptable procedure?

Thanks in advance.
_________________ John - Wichita, KS
Maris Fisler
Basic Member Send Private Message
Posts: 8
Basic Member
7/10/2009 8:14 PM
The three things you need to grant access to for every screen that a person needs to access are 1. The Category or CAT (this is the system code AP, GL PO, etc), 2. The Program or PGM (this is the screen name AC10, PO10, etc) and 3. The Token or TKN (this is the actual screen itself, AC10.1, PO10.1 etc) you can write your rules on the PGM or Token and depending on the scenario you may need differing rules for either of these.

Of course there is a fourth and fifth access that is needed and the is the Files access, and the Data Source access without that nothing will work.

Hope that helps and good luck with the implementation. It can be a lot of work but be sure to plan it out in advance and consider the long term maintenance when you build your classes and roles. Take into account how hard it will be if you need to add more screens to a role or class later if the class is shared in too many roles. I recommend not trying to "reuse" security classes within other roles except for the classes that have full access to every screen or file. I would rather have lots of security classes and as minimal amount of Roles as is needed.