Chapter 5 Security Introduction.......................................... 5-3 5 Security Overview........................................... 5-3 Human Resources System Security........................... 5-3 Implementing Human Resources System Security................... 5-9 Menu Navigation Table................................... 5-11 Forms.............................................. 5-11 Salary Planner Security Form.................. (NSASPSC)...... 5-12 Installation Rule Form..................... (PTRINST)...... 5-15 User Codes Rule Form..................... (PTRUSER)...... 5-15 Employee Class Security Form................. (PSAECLS)...... 5-15 Organization Security Form................... (PSAORGN)..... 5-16 Employer Security Form.................... (PSAEMPR)...... 5-16 5-1
Table of Contents This page intentionally left blank Human Resources Release 6.1 April 2004 5-2 User Guide Confidential
Introduction Introduction 5 Security This chapter contains information on the Banner Human Resources System's security forms. The following is a list of the sections in this chapter and a brief description of the information you can find in each section. Security The Overview details the security provided with the Human Resources System. The Human Resources System Security section provides detailed information on Human Resources-specific security. Implementation Procedures provides instructions for implementing your security functions. The Forms section provides descriptions of the security administration forms. For information on Banner and Oracle security, refer to Security in Chapter 2, User Access Administration, of the General Technical Reference Manual. Overview Banner Human Resources provides comprehensive security features to control user access to both query and update functions. The table-driven security process enables your institution to develop its own security profiles. Banner Human Resources System Security enables you to establish security by employee class code, organization code, salary range, and employer code. Human Resources System Security In addition to Oracle database and Banner form-level security, Banner Human Resources provides application-specific security at the form level. You can establish security by employee class code, organization code, and/or salary range. If your institution has multiple employers defined on the Employer Rule Form (PTREMPR), you can also establish security by employer code. Employee Class Security Employee class security is turned on and off at the Employee Class Security field on the Installation Rule Form (PTRINST). The User Codes Rule Form (PTRUSER) establishes user IDs for security purposes and enables you to grant access to all employee classes at the Master Employee Class field. For more information on PTRINST and PTRUSER, refer to the Forms and Implementing Human Resources System Security sections of this chapter and to Chapter 4, Rule Forms. April 2004 Human Resources Release 6.1 Confidential User Guide 5-3
Overview To allow access to some but not all employee class codes, do not check the Master Employee Class box on PTRUSER. Then use the Employee Class Security Form (PSAECLS) to set up an access list of the employee class codes the user can see. Refer to the Forms and Implementation Procedures sections for more information on PSAECLS. The following chart indicates how employee class security works: If the form: contains Identification Number in the key block contains Position Number in the key block contains Identification Number and Position Number in the key block a user can access the form only for: people whose PEAEMPL-defined employee class is in the access list established for this user on PSAECLS. positions whose NBAPOSN-defined position's employee class is in the access list established for this user on PSAECLS. people whose PEAEMPL-defined employee class is in the access list established for this user on PSAECLS. Organization Security Organization security is turned on and off at the Organization Security field on the Installation Rule Form (PTRINST). The User Codes Rule Form (PTRUSER) establishes user IDs for security purposes and enables you to grant access to all organizations at the Master Organization field. For more information on PTRINST and PTRUSER, refer to the Forms and Implementation Procedures sections of this chapter and to Chapter 4, Rule Forms. To allow access to some but not all organization codes, do not check the Master Organization box on PTRUSER. Then use the Organization Security Form (PSAORGN) to set up an access list of the range of organization codes the user can see. Refer to the Forms and Implementing Human Resources System Security sections for more information on PSAORGN. In most Banner forms, organization code security is linked to an employee s home organization, that is, the organization on the employee s Employee Form (PEAEMPL). Forms that show sensitive salary and job information, however, look at time sheet organizations. The time sheet organization is defined on the Payroll Default Information window of the Employee Jobs Form (NBAJOBS) and can differ for each of the employee s jobs. Human Resources Release 6.1 April 2004 5-4 User Guide Confidential
Overview The following chart indicates how organization security works: If the form: contains Identification Number in the Key block a user can access the form only for: people whose PEAEMPL-defined employee's home organization is in the user's access list on PSAORGN. If the form: contains Position Number in the key block contains Identification Number and Position Number in the key block contains Organization Code in the key block (e.g., NBAPORG) a user can access the form only for: positions whose currently active position totals for the budget organization in NBAPOSN are in the access range on PSAORGN. positions whose NBAJOBS -defined time sheet organization is in the user's access range on PSAORGN. key-block organization codes in the access range established for this user on PSAORGN. Forms that include time sheet organization security are listed below: Form NBAJOBS NBIJLHS NBIWKSH NOAEPAF PEADADJ PEAESCH PEAFACL PEAFACT PEAJACT PEIELFA PEIFACT PEIJHIS PEIJTOT Description Employee Jobs Form Labor Distribution Change History Form Work Schedule Hours Inquiry Form Electronic Personnel Action Form Deferred Pay Adjustment List Form Employee Status Change Form Faculty Load Form Faculty Action Tracking Form Employee Job Activity Form Employee List by Faculty Action Inquiry Form Faculty Information Inquiry Form Employee Jobs History Form Job Year to Date Totals Form April 2004 Human Resources Release 6.1 Confidential User Guide 5-5
Overview Form PEIPCSN PHAHOUR Description Employee Position Class Seniority Form Online Time Entry Form Checking for time sheet organizations rather than home organizations gives added security by restricting users access to salary data and other job information. For example, Dr. Smith has two jobs, one as a chemistry professor and one as an athletic coach, and Dr. Smith s home organization is the Chemistry Department. The time sheet organizations for Dr. Smith s teaching and coaching positions are the Chemistry Department and the Athletics Department, respectively. If home organization security were used for the above forms, you could see Dr. Smith s salaries in both positions if you only had access to Dr. Smith s home organization. With time sheet organization security, if you only have access to records for the Chemistry Department, you can see Dr. Smith s salary and job information as a chemistry professor but cannot see Dr. Smith s salary as a coach. Similarly, if you only have time sheet access to the records for the Athletics Department, you can see Dr. Smith s salary and job information as a coach but cannot see Dr. Smith s salary as a professor. In forms that use time sheet security, access to job information is controlled as follows: When you enter the position and suffix for a job in the key block of a form (for example, in NBAJOBS) and you do not have organization access for that job, the system does not display the information for the job. Instead, when you attempt to move the cursor to a data block, the system displays an error message indicating that you cannot access the job information. When you query jobs in the detail block of a form (for example, in the Employee Status Change Form, PEAESCH), the system displays information only for the jobs for which you have security access. On this type of form, the system displays an error message when you do not have access to one or more of the jobs. There are three exceptions to the job-access control described above: When faculty members are tracked by employee name, home organization security is used to control access to job information on the Faculty Action Tracking Form (PEAFACT), the Faculty Information Inquiry Form (PEIFACT), or the Employee List by Faculty Action Inquiry Form (PEIELFA). When faculty members are tracked by position/suffix or by organization code, however, time sheet organization security is used to control access to job information on these forms. (The faculty tracking method is specified in the This Installation Will Track Faculty Actions By field on the Faculty Action Rules window of the Installation Rule Form, PTRINST.) Human Resources Release 6.1 April 2004 5-6 User Guide Confidential
Overview When a job record is first created for an employee via the Employee Jobs Form (NBAJOBS), the Employee New Hire Form (PEAHIRE), or the Electronic Personnel Action Form (NOAEPAF) organization security is not used. After the employee is hired, however, time sheet organization security is used to control access to the employee s job information. If you have access to a particular time sheet organization, you can see information for a job that is currently in the organization or that will be in the organization in the future. You cannot see job information for a job that was in the organization in the past. For example, if you only have organization access to the Chemistry Department and today s date is August 28, 1999, your current organization access to job information for past, present, and future employees in that department is shown in the following chart. Today s Date: August 28, 1999 Your Current Time Sheet Org. Access: Chemistry Department only Employee Effective Date of Job Record Time Sheet Org. for Job Do you have org. access to job info.? Bob Brown July 1, 1998 Chemistry Dept. Yes Joe Green July 1, 1995 Chemistry Dept. No July 1, 1999 Biology Dept. Steve Grey July 1, 1998 Chemistry Dept. Yes July 1, 1999 Sept. 1, 1999 Biology Dept. Chemistry Dept. As indicated in the chart: - Bob Brown joined the Chemistry Department on July 1, 1998 and is still in the department. You have organization access to his job record. - Joe Green joined the Chemistry Department on July 1, 1995 and transferred to the Biology Department on July 1, 1999. Because he is no longer in the Chemistry Department, you do not have organization access to his job records. - Steve Grey joined the Chemistry Department on July 1, 1998 and transferred to the Biology Department on July 1, 1999. He will rejoin the Chemistry Department on September 1, 1999. You have organization access to his job records. April 2004 Human Resources Release 6.1 Confidential User Guide 5-7
Overview Salary Level Security Salary level security is turned on and off at the Salary Security box on the Installation Rule Form (PTRINST). The User Codes Rule Form (PTRUSER) establishes user IDs for security purposes and enables you to assign salary access privileges at the Max Salary Level field. For more information on PTRINST and PTRUSER, refer to the Forms and Implementing Human Resources System Security sections of this chapter and to Chapter 4, Rule Forms. The following chart indicates how salary level security works: If the form: contains Identification Number in the Key block a user can access the form only for: people whose primary job's annual salary is less than the salary specified on PTRUSER. Employer Code Security If your institution has multiple employers defined on the Employer Rule Form (PTREMPR), you can implement employer code security. Employer code security is turned on and off at the Employer Security field on the Installation Rule Form (PTRINST). The User Codes Rule Form (PTRUSER) establishes user IDs for security purposes and enables you to grant access to all employer codes at the Master Employer box. For more information on PTRINST and PTRUSER, refer to the Forms and Implementing Human Resources System Security sections of this chapter and to Chapter 4, Rule Forms. To allow access to some but not all employer codes, do not check the Master Employer box on PTRUSER. Then use the Employer Class Security Form (PSAEMPR) to set up an access list of the employer codes the user can see. Refer to the Forms and Implementing Human Resources System Security sections for more information on PSAEMPR. The following chart indicates how employer code security works: If the form: contains Employer Code and Identification Number in the key block (e.g., PEADTOT, PEAJTOT) contains Identification Number in the key block is the Employee Jobs Form (NBAJOBS) a user can access the form only if: the employer code entered in the key block is in the access list established for users on PSAEMPR. the employer code of any of the employee's jobs is in the access list established for this user on PSAEMPR. the employer code of the job entered in the key block is in the access list established for this user on PSAEMPR. Human Resources Release 6.1 April 2004 5-8 User Guide Confidential
Implementing Human Resources System Security Implementing Human Resources System Security This section details implementation procedures for Human Resources-specific security. Be sure that users have been identified on the system at the Oracle level before you begin. To implement Human Resources System security, follow these steps: 1. Review the relevant field (see chart below) on the Installation Rule Form (PTRINST). To turn on security for codes in this category, check the appropriate box. If you do not check the box, codes in this category will not have associated security. Kind of Security Employee Class Organization Employer Salary Level Field on PTRINST Employee Class Security Organization Security Employer Security Salary Security Note: If you check any of the boxes listed above, you must establish access privileges in that category for each user in the system (Step 2 below). If a user does not have security defined for a category whose PTRINST box is checked, that user will be denied access to most of the forms in the Human Resources System. 2. Enter a value in the relevant field or fields (see chart below) on the User Codes Rule Form (PTRUSER). Kind of Security Field on PTRUSER Values Organization Employee Class Master Organization Master Employee Class checked The user can access all organization codes in the system. unchecked The user does not have access privileges for all organization codes in the system. Enter the user access range on PSAORGN. checked The user can access all employee class codes in the system. unchecked The user does not have access privileges for all employee class codes in the system. Enter the user access range on PSAECLS. April 2004 Human Resources Release 6.1 Confidential User Guide 5-9
Implementing Human Resources System Security Kind of Security Field on PTRUSER Values Employer Master Employer checked The user can access all employer codes in the system. unchecked The user does not have access privileges for all employer codes in the system. Enter the user access range on PSAEMPR. Salary Level Max. Salary Level Specify the maximum salary that can be accessed by this user. Note: If you do not check the boxes for Master Employee Class, Master Organization, or Master Employer, you must establish an access list for this user in the corresponding category (Step 3 below). If you do not establish an access list and security is turned on on PTRINST, the user will be denied access to most of the forms in the Human Resources System. For additional information on PTRUSER, refer to the Forms section of this chapter and to Chapter 4, Rule Forms of this manual. 3. Define access lists on the security set-up form(s) corresponding to the boxes you did not check in Step 2. Kind of Security Employee Class Organization Employer Set-Up Form Employee Class Security Form (PSAECLS) Organization Security Form (PSAORGN) Employer Class Security Form (PSAEMPR) For information on PSAECLS, PSAORGN, and PSAEMPR, refer to the Forms section of this chapter. Human Resources Release 6.1 April 2004 5-10 User Guide Confidential
Menu Navigation Table Menu Navigation Table Security Setup Menu (*HRSSECUR)..................................................................... Access this menu from the Main Human Resources System Menu (*HRS). NSASPSC PTRUSER PSAECLS PSAORGN PSAEMPR Salary Planner Security Form Establishes organization security for the Salary Planner module in Employee Self-Service. User Codes Rule Form Establishes user IDs for security purposes. This form enables you to define the maximum salary level that can be viewed by specified users. You can also assign access privileges for all organizations and/or employee classes. Employee Class Security Form Enables you to specify which employee class codes can be viewed by a specified user. You can also copy access privileges from one user to another. Organization Security Form Enables you to specify which organization code ranges can be viewed by a specified user. If Banner Finance is installed at your institution, you can set up different ranges for each Chart of Accounts (COA) code. You can also copy access privileges from one user to another. Employer Security Form Enables you to create and maintain employer security for each user. Forms Human Resources System security forms include the Security Setup Menu (*HRSSECUR) and the following data entry forms: Salary Planner Security Form Installation Rule Form User Codes Rule Form Employee Class Security Form Organization Security Form Employer Security Form (NSASPSC) (PTRINST) (PTRUSER) (PSAECLS) (PSAORGN) (PSAEMPR) April 2004 Human Resources Release 6.1 Confidential User Guide 5-11
Forms The Security Setup Menu was covered in the Menu Navigation Table in the previous page. The following pages contain descriptions of each of the data entry forms. Salary Planner Security Form (NSASPSC) The Salary Planner Security Form enforces organization security for the Salary Planner module in Employee Self-Service. This form should be set up for Salary Planner users who are not given Update access in the Salary Planner Master Organization field on the User Codes Rule Form (PTRUSER). In other words, organization security should be specified on this form for all Salary Planner users who have been given either Query or None access in Salary Planner Master Organization field in PTRUSER. This form allows you to selectively include or exclude organization access for each user. You can also copy the organization security defined for one user to another within a single COA. NSASPSC gives you greater control in determining access to data in the Salary Planner as you can not only specify access to a range of organizations, but now also restrict or include access to specific organizations within or outside the range, respectively. Note: NSASPSC only affects organization security within the Salary Planner enhancement, and does not affect other Banner HR security. Key Block Enter information in the following fields to define the organization security for a new user of the Salary Planner. The Key block also allows you to copy organization security between two users or delete a user s organization security for specific organizations. You can copy the organization security from one user to another provided the organizations belong to the same COA. To copy the organization security from one user to another, specify the information below and then select Copy Record in the Options menu. To delete a user s organization security for specific organizations, specify the key block elements and choose Delete Organization by Group in the Options menu. Human Resources Release 6.1 April 2004 5-12 User Guide Confidential
Forms Fields Current User Descriptions Enter the name of the current user or choose the current user by selecting the Search button. Required field. (button) Search User Codes Rule Form (PTRUSER) New User Enter the name of the new user or choose a new user by selecting the Search button. (button) Search User Codes Rule Form (PTRUSER) Enter this field only if you wish to copy the organization security of the current user to the new user. Then select Copy Record from the Options menu. Optional field. Include Organization To include organizations for a new user, enter an organization code or select using the Search button. (button) Search Organization Code Validation Form - Finance (FTVORGN) when Banner Finance is installed. (button) Search Organization Code Validation Form (PTVORGN) when Banner Finance is not installed. All organization codes will be copied for the new user, if this field is blank. Exclude Organization To exclude organizations for a new user, enter an organization code or select using the Search button. (button) Search Organization Code Validation Form - Finance (FTVORGN) when Banner Finance is installed. (button) Search Organization Code Validation Form (PTVORGN) when Banner Finance is not installed. Note: If this field is blank, it does not imply all organization codes are excluded for the new user. April 2004 Human Resources Release 6.1 Confidential User Guide 5-13
Forms Fields COA Code Descriptions Enter or select a COA code using the Search button. (button) Search Chart of Accounts Validation Form (FTVCOAS) when Banner Finance is installed. Required field. This field is disabled when Banner Finance is not installed. Main Block In the Main block, specify the organization and the type of access provided to each organization. Fields Organization Descriptions Displays a list of organizations that match the include/exclude criteria, if specified in the Key block. Alternatively, you can individually specify the organizations for which access is to be provided by selecting the Search button. (button) Search Organization Code Validation Form - Finance (FTVORGN) when Banner Finance is installed. (button) Search Organization Code Validation Form (PTVORGN) when Banner Finance is not installed. The system displays a short description of each selected organization code. Access Specify the type of access for each organization from the pull-down list. Choices include: Update Query Enables the user to change and save the modified information in the corresponding Web pages of the Salary Planner. Enables the user to only query on the information displayed in the Salary Planner. Human Resources Release 6.1 April 2004 5-14 User Guide Confidential
Forms Installation Rule Form (PTRINST) The Installation Rule Form enables you to identify data that applies throughout your institution and to establish it in the database as installation-wide. The Employer Security, Salary Security, Organization Security, and Employee Class Security fields allow you to specify whether or not the corresponding security is turned on. For detailed instructions on the use of this form, refer to Chapter 4, Rule Forms of this manual. User Codes Rule Form (PTRUSER) The User Codes Rule Form establishes user IDs for security purposes. It enables you to define the maximum salary level that can be viewed by specified users. You can also assign access privileges for all organizations and/or employee classes by checking the Master Organization and Master Employee Class boxes. If the Master Employer box is checked, the user can access all employer codes. Each user ID present in the system should be entered in this form with the appropriate security indicators. If a user ID is not entered and security is turned on on PTRINST, the user will be denied access to most of the forms in the system. Note: When an ID is deleted from the User Codes Rules Form (PTRUSER), the ID is automatically deleted from the Organization Security Form (PSAORGN), the Employee Class Security Form (PSAECLS), and the Employer Security Form (PSAEMPR) as well. For detailed instructions on the use of this form, refer to Chapter 4, Rule Forms, and to the Implementing Human Resources System Security section of this chapter. Employee Class Security Form (PSAECLS) The Employee Class Security Form specifies which employee class codes can be viewed by each user. You can also copy access privileges from one user to another. Security can be copied in its entirety or by excluding or including specified employee classes. This form implements employee class security for a user by setting up the user's access list on the PSRECLS table. For detailed information on employee class security, refer to the Employee Class Security and Implementing Human Resources System Security sections of this chapter. April 2004 Human Resources Release 6.1 Confidential User Guide 5-15
Forms Organization Security Form (PSAORGN) The Organization Security Form specifies which organization code ranges can be viewed by each user. If Banner Finance System is installed at your institution, you can set up different ranges for each Chart of Accounts (COA) code. You can also copy access privileges from one user to another. Security can be copied in its entirety or by excluding or including specified organizations. This form implements organization security for a user by setting up the user's access range on the PSRORGN table. For detailed information on organization security, refer to the Organization Security and Implementing Human Resources System Security sections of this chapter. Employer Security Form (PSAEMPR) The Employer Security Form enables you to create and maintain employer security by users. A user is permitted to access a form if the employer code of any of the user's jobs is present in the Security Block. Employer access codes must be set up only if the Employer Security box is checked in the Installation Rule Form (PTRINST) and the Master Employer box in the User Code Rule Form (PTRUSER) is not checked. If the Master Employer box is checked, the user can access all employer codes. For detailed information on employer code security, refer to the Employer Code Security and Implementing Human Resources System Security sections of this chapter. Human Resources Release 6.1 April 2004 5-16 User Guide Confidential