Understanding PeopleTools Security

Permission lists are the building blocks of PeopleTools user security authorization. A permission list grants a particular degree of access to specified PeopleSoft elements such as pages, portals, menus, component interfaces, development environments, signon time periods, administrative tools, personalizations, and so on. Permission lists are specific to a specific set of objects that are necessary to support a unique security role. Security roles might have overlapping—but not identical—access requirements. You typically define permission lists before you define security roles and user profiles.

Project Costing delivers preconfigured sample permission lists that grant access to various pages. These permission lists support the sample functional security roles that are delivered with the application.

See PeopleTools: Security Administration, "Setting Up Permission Lists."

This table lists some of the delivered sample permission lists that provide access to Project Costing, and typical security roles that are associated with each permission list:

With row-level support, you can implement security to provide individual users or permission lists with access to a page, but you do not have to provide access to all rows in the table when the page is accessed. This type of security is typically applied to tables that hold sensitive data. For example, you can implement row-level security in Project Costing to restrict access to specific projects.

The PeopleTools security system determines which data permissions to grant to a user by examining the primary permission list and row security permission list. The permission list that the system uses varies by application and data entity, such as employee, customer, or business unit. Project Costing uses the row security permission list value to determine a user's access to projects if you implement permission list-level security.

See Defining Row-Level Security.

Security roles are essentially collections of permission lists, which determine the pages that users can access. You can assign one or more permission lists to a security role. The resulting combination of permissions can apply to all users who share those access requirements. However, the same group of users might also have other access requirements that they don't share with each other. You can assign:

• A permission list to multiple security roles.

  Permission lists define access to specific portals and components based on the user's security role.

• A security role to multiple user profiles.

• Multiple security roles to a user profile.

  User permissions are based on the combined permissions that are assigned to all of the user's security roles.

User profiles define individual PeopleSoft users. Each user is unique. The user profile specifies a number of user attributes, including one or more assigned security roles. After you create security roles, create user profiles and associate them with security roles. The values for a user's page access are inherited from the associated security roles.

To set up security roles and user profiles in PeopleTools:

• Create security roles in the Role Maintenance component (ROLEMAINT).

• Assign permission lists to security roles.

• Create user profiles in the User Profile Maintenance component (USERMAINT).

• Assign security roles to user profiles.

See PeopleTools: Security Administration, "Administering User Profiles."

Project Costing provides sample data that contains several preconfigured security roles based on functional tasks that are typically performed by an employee who is assigned to that security role. Each preconfigured security role comes with access to the set of pages within the application that correspond to the functional tasks of that security role. For example, a project manager can access pages that are used for every project management business process task, but a time and expense administrator can only access pages to make resource adjustments, perform expenses integration, perform time and labor integration, and create summary and variance reports.

This table lists three of the sample security roles that are delivered with the PeopleSoft system: