LS9 ESS/MSS Security Quandary - LawsonGuru.com

Name	Points
Greg Moeller	4184
David Williams	3349
JonA	3291
Kat V	2984
Woozy	1973
Jimmy Chiu	1883
Kwane McNeal	1437
Ragu Raghavan	1372
Roger French	1315
mark.cook	1244

Fernando Labrada

Basic Member

Posts: 14

2/5/2009 3:04 PM

<!--[if gte mso 10]> Keeping in mind that one of the ultimate goals of LS9 is to have a single set of login credentials, securing the EMPLOYEE table so that only the right records are accessible is of paramount importance. This is critical for people who are application users and will have a search box in portal and thus will be able to access HR11 (required by Self Service).

The EMPLOYEE table can be secured for the ESS role to only allow access if COMPANY/EMPLOYEE in the table = COMPANY/EMPLOYEE in the employee’s identity. The EMPLOYEE table can be secured for the MSS role by using the IsSupervisorOf function which gives access to only the direct reports of a manager. So, when both are in force, the less restrictive MSS role wins out and all is good.

Enter the Org Chart link. The Org Chart allows one to navigate thru the organization’s structure (via HS10) and see who reports to whom. At any time you can click on a person’s name and get a profile of that person. And where does that profile come from? The EMPLOYEE table! So, if I click on the CEO’s name, since I am neither the CEO nor he/she is my direct report, the applet just spins and returns nothing. Sleuthing into the lase logs shows that “NO_ACCESS” was returned as a result of the EMPLOYEE table’s security rule from the MSS role (as it should!). Unfortunately the applet just spins, it doesn’t return any kind of “Security Violation” message or anything like that.

So, is the answer to get Org Chart to work to open up access to EMPLOYEE in the ESS/MSS roles? I don’t think so since an application user would then have access to the full employee table from HR11 drill/selects.

This is my quandary.

Any ideas?

KerriR

Advanced Member

Posts: 34

8/20/2009 1:22 PM

Any solution for this problem? We have the same issue here.

Tim Cochrane

Veteran Member

Posts: 154

8/20/2009 2:38 PM

See my comments in the "Employee Self Service under Lawson Security" thread, but bascially we've built a custom view (using sql) of the EMPLOYEE table and call the custom table in Org Chart. It's more custom coding, but once done it'll get us around the same issue you are currently having

Jonnie

Posts: 3

8/25/2009 8:17 PM

Our solution here was to create 4 seperate classes (1 for housing the files for each ESS and MSS, and 1 for housing the forms for ESS and MSS and attached the appropriate class to either the ESS or MSS role. We also used www.kinsey.com and fiddler app - this allows to see where the break in security maybe with x user or forms/tokens being accessed by x user if security needs to be tightened
In doing this it made it a lot easier on wrting the necessary rules...especially if HR11 field are to be tighented for those users who have the search box

For the supv - ensure the HR07 table is set correctly...the direct reports pulls form setup of there

Jonnie - BMH

Elizabeth Ardito

Advanced Member

Posts: 34

9/16/2009 11:52 AM

We had reported the spinning issue on the Org Chart to Lawson who had created a PT to resolve as the system should return some reasonable notification of what is happening whether it is security violation or something else.

I was recently informed that the PT was completed and the change was made in the latest version of EMSS - 9.0.1. Lawson also stated that with EMSS version 9.0.1, the version does not have to match application version.

Unfortunately we are in the midst of getting ready for Open Enrollment on version 9.0.0 (app 9.0.0) and I haven't had a chance to upgrade EMSS to see if it has actually been resolved.

Elizabeth Ardito