LX SECURITY AND USER MANAGEMENT BEYOND IBM I. Session 318 Mark Larson LX Software Architect

Transcription

1 LX SECURITY AND USER MANAGEMENT BEYOND IBM I Session 318 Mark Larson LX Software Architect

2 FULL DISCLAIMER This presentation reflects the direction Infor may take with regard to the products or services described herein, all of which is subject to change without notice. This presentation is not a commitment to you in any way and you should not rely on any content herein in making any decision. Infor is not committing to develop or deliver any specified enhancement, upgrade, product, service or functionality, even if such is described herein. Many factors can affect Infor s product development plans and the nature, content and timing of future product releases, all of which remain in the sole discretion of Infor. This presentation, in whole or in part, may not be incorporated into any agreement. Infor expressly disclaims any liability with respect to this presentation.

3 AGENDA Traditional LX Security LX and the Infor Xi Tech Stack IDF Security Model vs. LX Security Ming.le Security SiW, IFS and Single Sign-On ION and LX Security

4 TRADITIONAL LX SECURITY

5 TRADITIONAL LX SECURITY Product, Program Security Company, Facility, Warehouse Security Actions and Function Keys Authorizations CEA and PUR Security Role Based Security LX esignature Webtop Metadata for Customizations

6 PRODUCT AND PROGRAM SECURITY User authority to products and programs is controlled by SYS600D - User Authorization Maintenance program.

7 COMPANY, FACILITY AND WAREHOUSE SECURITY User authority to company, facility, and warehouse also controlled by SYS600D

8 ACTIONS AND FUNCTION KEYS SECURITY User authority to execute program actions and function keys controlled by the SYS603D1/D3 - Group Security Maintenance

9 CEA AND PUR SECURITY CEA Book Access Security (BPCS ) Account Access Security (BPCS ) Added access type Post and Limited Inquiry (BPCS ) PUR PUR500 check Company Security (LX 8.3.3) Purchase Order Print security (LX 8.3.4)

10 ROLE-BASED SECURITY Business Role Definition Set of functions, processes, and/or responsibilities assigned to a person or group Benefits Easier user maintenance Better organization of Security Cleaner audits Temporary user assignment Define authorities based on a Role Attention Key, Products, Programs, Transaction Effects Assign user to multiple Roles Allow User Exceptions

11 LX ESIGNATURE Replaces handwritten signature to indicate that an authorized person has approved a particular process, or transaction. Examples: QMS: Quality Specification approval, Lot Dispositioning, Test Results Entry MFG: BOMs/SO Operations/Routings/Production Receipts/Lot Status Changes

12 CPYWEBADP - COPY WEBTOP METADATA Used for LX Customizations - will move program metadata into production library CPYWEBADP adopts authority Eliminates the need for re-weblication in production environment, or manual copying of metadata with CPY_WEB

13 LX AND INFOR XI TECH STACK

14 LX AND THE INFOR XI PLATFORM Activity Deck d/epm Product Lifecycle Management (PLM) - Optiva Infor Reporting ecommerce Business Vault Business Analytics CRM Core LX Supplier Exchange Road Warrior Supply Chain Execution Enterprise Asset Management (EAM) Warehouse Mobility

15 XI PLATFORM Key Components. Infor Ming.le Infor Intelligent Open Network (ION) Infor Federation Services (IFS) Infor Document Management (IDM) Additional products extend and leverage Xi Platform Infor ION Business Vault (BV) and Business Vault Base Data Store (BV-BDS) Infor Business Intelligence (BI) and BI Application Studio Infor Reporting and Infor Reporting Models for the Base Data Store

16 LX AND XI LX today is much more than the original green screen product Besides green screen, LX now uses WebTop and IDF as its 2 web-based user interfaces LX uses System i Workspace (SiW) to combine WebTop and IDF menu options, plus: Define SiW Favorites, to allow user to create custom menus Show SiW Recent Tasks and Task Search and Quick Launch, to allow quicker access to options Use SiW iviewer for viewing user's IBMi jobs, messages and spool files Additionally SiW allows Collaboration by sharing posts and following social objects Receiving alerts and workflow task notifications Viewing additional information with Contextual Applications and Home Page Widgets Drill Backs to LX With ION, LX now sends/receives information to/from other products via BODs Each of these areas introduce additional security and user management aspects

17 IDF SECURITY

18 IDF SECURITY Cross Application Support (CAS) Security Auto Content Security Deployment Profiles

19 CAS SECURITY

20 CAS SECURITY Security Officer controls authorizations Add Users Create Groups Add Users to Group Secure Objects, Transactions, Jobs, Reports Field Level Security

21 CAS SECURITY SECURE IDF OBJECT, TRANSACTIONS, JOBS, REPORTS Select Area and Task authorizations Select Application to secure

22 CAS SECURITY SECURE VENDOR TASKS Vendor application locked Authorize users

23 IDF FIELD LEVEL SECURITY Provided on Enterprise Item API attributes QMS attributes Controlled in CAS security Unlock security classes Allows all users access Lock security classes Authorize User or Group of users to maintain data

24 ENTERPRISE ITEM FIELD LEVEL SECURITY Maintain API and QMS attributes

25 ENTERPRISE ITEM FIELD LEVEL SECURITY Controlled maintenance of QMS attributes

26 IDF AUTO CONTENT SECURITY

27 IDF AUTO CONTENT SECURITY User access authorization to data using security classes LX Company LX Facility LX Warehouse

28 AUTO CONTENT SECURITY USER PROFILE SETUP Restrict users access to Company, Warehouse or Facility

29 AUTO CONTENT SECURITY EXAMPLE - CUSTOMER Users access restricted to view only Customers in Company 10

30 COPY LX SECURITY TO IDF

31 CPYSECIDF Copies LX security data to IDF for single user or *ALL Rerun as needed Includes: Company, Facility, & Warehouse to Auto-Content Security CEA Ledger, Book, & Year to Auto-Content Security Product & Program Authority to Deployment Profiles (Optional) Future Include copy of LX Roles to IDF Groups Once CAS replaces Deployment Profiles in LX 8.4, it will be added here (role to group, user to profile, etc.) CEA Ledger, Book, & Year to EGLI Auto-Content Security

32 MING.LE SECURITY AND IFS

33 LX SECURITY IN MING.LE Requirements to get an LX user fully deployed in Ming.le Setup user in IDF security (per previous slides) SiW upload LX and IDF security into Ming.le IFS Ming.le users setup Optional: Single Sign-On User Provisioning in Ming.le

34 PORT LX USER SECURITY TO SIW SYS075 - SiW Configuration Export Export LX menu called programs Export LX menus Export LX users and their authorized menus

35 SIW APPLICATION MANAGER CONFIGURATION AMCONFIG.HTML SiW webpage to validate imported data and to complete migration

36 ADDING IDF LX SECURITY TO MING.LE IDF NetLink menus can be added to LX Ming.le menus Setup users authorities to Business Objects Export IDF menus to SIW See Integration Guides

37 MING.LE USER SETUP Infor Federated Services (IFS) Create users Grant user authorities to apps and roles Includes access to LX environment in Ming.le

38 SINGLE SIGN-ON SETUP Benefits Eliminates the need to sign in to multiple applications Ming.le, SiW, LX/Webtop, IDF Reduced IT assistance around users/passwords maintenance Improved SOX compliance with individual user setup Complements integrated access to multiple applications in one place/space Ties Infor Federated Services (IFS), SiW, and LX users into a single login

39 SINGLE SIGN-ON SETUP KEY ASPECTS Infor Federation Services (IFS) Infor Workspace and Social Space user security setup Passes credentials to System i Workspace On Prem: Pass Windows user id to SiW Cloud: Pass SAML token and IBMi User Profile to SiW System i Workspace (SiW) Map Ming.le users to IBM i users On Prem: Enterprise Identity Mapping (EIM) Cloud: Generate IBMi tokens Webtop and IDF Net-Link Leverages SIW SSO setup

40 USER MANAGEMENT UPCOMING FEATURES Automate update of IDF and SiW when SYS600 changes user Single location to make security changes to users User Provisioning - Automatic creation of LX user from Ming.le/IFS Create user in Ming.le IFS is System of Record for SecurityUserMaster data (BOD) LX is System of Record for SecurityRoleMaster data (BOD) Assign Ming.le user to IFS Roles (both access to LX environment and LX Roles) Auto-create user profile on IBM i Auto-setup of user in SYS600 with default settings Assign user to LX Role(s) Initial Data Load of users from LX to Ming.le (needs address, first, last, user profile)

41 ION AND LX SECURITY

42 LX AND INFOR TECHNOLOGY STACK ION ION Desk ION Connections Setup Infor Business Context (IBC) messages, Drill-backs and Contextual Apps BOD Security Relies on IFS and LX security controls User Provisioning - Automatic creation of LX user from Ming.le/IFS - future ION Workflow and authorizations from it example: PO approval

43 QUESTIONS?