Defining Security

This chapter provides an overview of security and discusses:

Click to jump to parent topicUnderstanding Security

Security refers to the ability to restrict users from viewing or updating certain data or payees.

In Global Payroll, there are two levels of security:

Note. Global Payroll can also use the group security feature in PeopleSoft Enterprise Time and Labor.

Click to jump to top of pageClick to jump to parent topicElement Usage Security

You set up profiles for your users that give them access to country-specific element information. For example, if your organization operates only in France, users do not need element information that is specific to the United Kingdom. Element-usage security limits the number of elements that appear in prompt tables and on search pages to those that are relevant to the user.

Click to jump to top of pageClick to jump to parent topicOwner Security

Owner security refers to who owns and maintains an element—PeopleSoft or the customer. Certain elements can be modified only by PeopleSoft, while others can be modified by the customer.

The Owner field on the Element Name page identifies an element's owner.

See Also

Defining Element Names

Click to jump to top of pageClick to jump to parent topicOverride Levels

Override levels for an element vary, depending on the element type. Typical override levels include Pay Entity, Pay Group, Payee, Calendar, Via Elements, Element Definition, and Positive Input. You select these on the Element Name page by using check boxes. These check boxes indicate whether the element can be updated through overrides or by another element.

The update Via Element security feature controls which elements can be updated by another element. You can update an element by means of another element in four places in the application:

The system checks the User Rules Profile and element-usage security to ensure that only elements that are available for access can be updated by another element.

See Also

Defining Element Names

Click to jump to parent topicCommon Terms Used in This Chapter

Prompt edits

Records or views that you use as an online prompt on a specified field.

Query security records

Records or views that you use in PeopleSoft Query.

Search records and search views

Records and views that you use to access a component.

Click to jump to parent topicRestricting User Access

You can control whether a user can access elements that are defined for all countries or for a specific country and whether a user can take control of PeopleSoft-delivered and maintained elements.

This section provides an overview of restricting access to country-specific elements and discusses how to define elements for user access.

Click to jump to top of pageClick to jump to parent topicUnderstanding How to Restrict Access to Country-Specific Elements

When you create an element, you designate (in the Used By field of the Element Name page) whether it can be used by all countries or by a specific country. An element cannot use an element that is defined at a lower level. For instance, a duration element that is defined for All Countries cannot use a variable defined for only one country—France, for example. It can only use elements defined for All Countries. However, a duration that is defined for France can use variables defined for France as well as variables defined for All Countries.

The User Rules Profile page defines the default values that users see in the Used By and Country fields when adding an element.

This table shows how the settings on the User Rules Profile page affect the Used By and Country fields on the Element Name page:

User Rules Profile page

Element Name page

Used By = All Countries

Used By = All Countries is the default.

Country field defaults to value ALL.

Used By = Specific Country

Used By = Specific Country and can't be changed.

Country field defaults to Country and can't be changed.

Warning! Carefully consider the consequences of changing the Used By field after you save an element that is defined for All Countries. Problems can result if the element has been used in payroll processing.

Note. The User Rule Profile in Global Payroll is in addition to the User Rules Profile in Human Resources.

Click to jump to top of pageClick to jump to parent topicPage Used to Restrict User Access

Page Name

Definition Name

Navigation

Usage

User Rules Profile

GP_OPR_RULE_PRF

Set Up HRMS, Security, User Maintenance, Global Payroll User Profile, User Rules Profile

Control whether a user has access to elements defined for all countries or a specific country. Also define if users can take control of PeopleSoft Delivered/Maintained elements.

Create a user ID in PeopleTools before using this page.

Click to jump to top of pageClick to jump to parent topicDefining Elements for User Access

Access the User Rules Profile page (Set Up HRMS, Security, User Maintenance, Global Payroll User Profile, User Rules Profile).

All search views refer to the information that you enter here to determine which elements to display.

Session Default

Used By

Specify which elements the users with this User ID can access. Values are:

All Countries: Elements defined for All Countries.

Specific Country: Elements defined only for the country you select in the Country field.

Note. You associate a rule with a country when you define an element on the Element Name page.

Allow PS Element Change (allow PeopleSoft element change)

Select to enable users to take control of PS Delivered/Maintained elements. Taking control of an element means that a user can edit the element's definition and change the element owner to PS Delivered-Customer Modified. Once a user takes control of an element, it cannot be changed back to PS Delivered/Maintained.

See Also

Defining Element Names

Enterprise PeopleTools PeopleBook: Security Administration

Click to jump to parent topicElement Security

This section discusses the security that governs element selection for a component.

The following tables describe element-level security by menus and components. Following is an example of the Search page that is referred to in the tables:

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Elements - All Element Definition Components

Security on the Search Page

Security Governing Element Selection From Within the Component

Add Mode - When you add a new element, the system has no information about the element, so there is no security.

Applicable to Non-Add mode.

If User Rules Profile = All Countries, then Used By = All Countries

Or

Used By = Specific Country.

If User Rules Profile = Specific Country, then Used By = All Countries

Or

Used By = Specific Country. Country must match the Country on the User Rules Profile page.

Element-usage security:

If Used By = All Countries, then the elements it can use must also be Used By = All Countries.

If Used By = Specific Country, then the elements it can use must either be Used By = All Countries

Or

Used By = Specific Country, and the value in the Country field must equal the country that the element is being used by.

Update by element security:

For the following elements, you can update element security with the Via Element override check box on the Element Name page:

- Formula definitions/Assigned To field.

- Date definitions/Date Extract fields.

- Bracket definitions/Return Columns field.

- Array definitions/Retrieved fields.

Note. If User Rules = Specific Country, you cannot change the Used By field on such an element.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Framework, Organizational, Eligibility Groups

Security on the Search Page

Security Governing Element Selection From Within the Component

Security is handled inside the component.

Element usage (which element groups appear in the prompt list):

If User Rules Profile = All Countries, then No security.

If User Rules Profile = Specific Country, then Used By = All Countries

Or

Used By = Specific Country. Country on the Element Name page must match the Country on the User Rules Profile page.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Framework, Organizational, Pay Entities

Security on the Search Page

Security Governing Element Selection From Within the Component

Add Mode - When you add a new Pay Entity, the system has no information about the Pay Entity, so there is no security.

Applicable to Non-Add mode.

If User Rules Profile = All Countries, then No security.

If User Rules Profile = Specific Country, then Pay Entity Country must = User Country.

Supporting Element Overrides - element usage is based on Pay Entity Country:

You must enter Pay Entity Country before entering any Supporting Element Overrides.

Used By = All Countries

Or

Used By = Specific Country, and Country on the Element Name page matches Country on the Pay Entity page.

Pay Entity Override is selected on the Element Name page.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Framework, Organizational, Pay Groups

Security on the Search Page

Security Governing Element Selection From Within the Component

Add Mode - When you add a new Pay Group, the system has no information about the Pay Group, so there is no security.

Mode does not equal Add.

If User Rules = All Countries, then No security. If User Rules Profile = Specific Country, then Pay Entity Country = User Country.

Rounding/Proration elements - element usage is based on Pay Entity Country:

Used By = All Countries

Or

Used By = Specific Country, and Country matches Pay Entity Country.

Supporting Element Overrides - element usage is based on Pay Entity Country:

Used By = All Countries

Or

Used By = Specific Country, and Country matches Pay Entity Country.

Pay Group Override is selected on the Element Name page.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Framework, Processing - Run Types

Security on the Search Page

Security Governing Element Selection From Within the Component

Security is handled inside the component.

Element usage (which process list appears on the prompt list):

If User Rules Profile = All Countries, then No security.

If User Rules Profile = Specific Country, then Used By = All Countries

Or

Used By = Specific Country, and Country matches User Country.

The Run Types page includes a group box to enable the entry of earnings for variable compensation awards. For this group box, element selection is governed by the country of the process list. Elements shown are either where Used By = All Countries or where Country is the same as the Country of the process list element.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Framework, Calendars, Calendars

Security in the Search Page

Security Governing Element Selection From Within the Component

Applicable to all modes (in relation to the Pay Group field).

If User Rules Profile = All Countries, then No security.

If User Rules Profile = Specific Country, then Pay Entity Country that is associated with the pay group must match User Country.

Supporting Element Overrides and Elements to Exclude - element usage is based on Pay Entity Country:

Used By = All Countries

Or

Used By = Specific Country, and Country matches Pay Entity Country.

Calendar override check box must be selected.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Framework, Calendars, Calendar Group

Security in the Search Page

Security Governing Data Selection From Within the Component

Add Mode - When you add a new calendar group, the system has no information about the calendar group, so there is no security.

Applicable to Non-Add mode.

If User Rules Profile = All Countries, then

No security.

If User Rules Profile = Specific Country, then

Calendar Run ID Country must match User Country.

Country - Valid countries are based on User Rules Profile Country:

If User Rules Profile = All Countries, then No security

If User Rules Profile = Specific Country, then Calendar Run ID Country appears as the default in User Country and cannot be changed.

Pay Group/Calendar ID is based on Calendar Run ID Country:

You must enter Calendar Run ID Country before entering Pay Groups, or Calendar IDs.

Pay Group Country (Country of the Pay Entity that is associated with the Pay Group) must match Calendar Run ID Country.

Calendar Country (of the Pay Entity Country that is associated with Pay Group for Calendar) must match Calendar Run ID Country.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Triggers, Retro Process Definitions

Security on the Search Page

Security Governing Element Selection From Within the Component

For all modes.

If User Rules Profile = All Countries, then

No security.

If User Rules Profile = Specific Country, then

Country = User Country.

Security is handled by the search page security.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Triggers, Retro Process Overrides

Security on the Search Page

Security Governing Element Selection From Within the Component

For all modes.

If User Rules Profile = All Countries, then

No security.

If User Rules Profile = Specific Country, then

Country = User Country.

Formula Element, Element, and Forward to Element - element usage is based on Retro Process Definition Country:

Used By = All Countries

Or

Used By = Specific Country, and Country matches Retro Process Definition Country.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Triggers, Retro Event Definitions (retroactive event definitions)

Security on the Search Page

Security Governing Element Selection From Within the Component

Country Security (which countries appear on prompt list):

If User Rules Profile = All Countries, then

User is allowed to work on any country in Global Payroll.

If User Rules Profile = Specific Country, then

The only valid value is the Country that matches User Country. This value is defaulted in and the field is disabled.

Retro Process Definition (for Event Process Definition) Security (which retro process definitions appear in prompt list): The Country on the Retro Process Definition must match the selected Country.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Triggers, Segmentation Event Definition

Security on the Search Page

Security Governing Element Selection From Within the Component

Country Security (which countries appear in prompt list):

If User Rules Profile = All Countries, then

User can work on any country in Global Payroll.

If User Rules Profile = Specific Country, then

The only valid value is the Country that matches User Country. This value is defaulted in and the field is disabled.

Element usage is based on Country of Event:

Used By = All Countries

Or

Used By = Specific Country, and Country matches Event Country.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Triggers, Trigger Definition

Security on the Search Page

Security Governing Element Selection From Within the Component

Country Security (which countries appear in prompt list):

If User Rules Profile = All Countries, then

User can work on any country in Global Payroll.

If User Rules Profile = Specific Country, then

The only valid value is the Country that matches User Country. This value is defaulted in and the field is disabled.

In the Trigger Event ID field, the system shows only trigger event IDs that are valid for the country selected. In addition, for the trigger type of Segmentation and record = GP_PYE_OVRD, the user must select elements on the Trigger Definitions – Field Values page. Available elements are those with Used By = All Countries or Used By = the country of the trigger definition.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Integration, ChartFields

Security on the Search Page

Security Governing Element Selection From Within the Component

In All Modes.

If User Rules Profile = All Countries, then

No security.

If User Rules Profile = Specific Country, then

Pay Entity Country = User Country.

ChartFields - element usage is based on Pay Entity Country:

Used By = All Countries

Or

Used By = Specific Country, and Country matches Pay Entity Country.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Elements, View Element Names, Element Name

Security for the View Element Names component is based on the User Rules Profile. If a user has access to All Countries, the user can see elements for all countries. If the user has access to a specific country only, the user can see elements for that country only or elements defined for All Countries.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Elements, Supporting Elements, View System Elements by Source, System Elements by Source

The View System Elements by Source component shows only system elements. Because these elements are always defined for All Countries, any user can view them.

Click to jump to parent topicPayee Security

This section discusses payee security by HR and group.

Payee payroll data is sensitive information because it often contains pay-related information. Global Payroll provides payee-level security that restricts the payees that a user can view.

Click to jump to top of pageClick to jump to parent topicHR Security

Global Payroll delivers the standard Human Resources security. Payee-level security affects all Global Payroll reports as well as every component, search record or view, and prompt record and view that contains the EMPLID field. All components that are entered with an employee ID contain payee-level security.

A security tree is used to limit the payees that a user can view or report on.

The following tables indicate payee-level security by menus and components.

Global Payroll & Absence Mgmt, Payee Data, Assign Earnings and Deductions, Element Assignment By Payee

Security on the Search Page

Security Governing Element Selection From Within the Component

Payee-level security applies.

Element usage is based on Country of the Payee, which is based on the Pay Entity that is associated with the Pay Group:

To determine Payee Country, the system retrieves the payee's pay group from the JOB record. Then it retrieves the Pay Entity for the Pay Group and looks at the Country. If a JOB row cannot be found, the country used is the one associated with the user that has logged in. This is the country from the User Rules Profile data for that user.

Used By = All Countries

Or

Used By = Specific Country, and Country matches Payee Country.

The Element Assignment By Payee component enables you enter a category first to narrow the list of elements to those matching the specified category. Categories shown are those that are valid for the country of the payee.

In addition, Payee Override must be selected on the Element Name page for an element to appear.

Supporting Element Overrides - element usage is based on Payee Country:

If Element Country = All Countries, then

Used By = All Countries.

If Element Country = Specific Country, then

Used By = Specific Country, and Country matches Payee Country.

Global Payroll & Absence Mgmt, Payee Data, Create Overrides, Supporting Elements

Security on the Search Page

Security Governing Element Selection From Within the Component

Payee-level security applies.

Element Usage (based on Country of Payee which is based on Pay Entity associated with Pay Group)

To determine Payee Country, the system first retrieves the Pay Group for the Payee from the JOB record. Then the system retrieves the Pay Entity that is associated with this Pay Group and looks at the Country. If a JOB row cannot be found, the country associated with the user that has logged in is used. This is the country in the User Rules Profile data for that user.

Used By = All Countries

Or

Used By = Specific Country, and Country matches Payee Country Payee Override also needs to be selected on the Element Name page.

Global Payroll & Absence Mgmt, Absence and Payroll Processing, Prepare Payroll, Manage Positive Input

Security on the Search Page

Security Governing Element Selection From Within the Component

Payee-level security applies.

Element Usage (based on Country of Pay Entity associated with Pay Group)

Used By = All Countries

Or

Used By = Specific Country, and Country matches Pay Entity Country.

Positive Input Override also needs to be selected on the Element Name page.

Supporting Element Overrides - element usage is based on Country of Pay Entity:

If Element Country = All Countries, then

Used By = All Countries.

If Element Country = Specific Country, then

Used By = All Countries

Or

Used By = Specific Country, and Country matches Country of Pay Entity.

Positive Input Override also needs to be selected on the Element Name page.

Click to jump to top of pageClick to jump to parent topicGroup Security

Group security is a Time and Labor security feature that can be used by Global Payroll if the two applications are integrated. Group security enables you to restrict access to employee records and the Global Payroll reports.

See Also

Establishing Static and Dynamic Groups

Enterprise PeopleTools PeopleBook: Security Administration