26012 managing & auditing security during implementation and beyond 03172009

<Insert Picture Here>

Managing & Auditing Security During Implementation and Beyond

Denise GoinSenior Consultant

Introductions

• Denise Goin– 3 years of experience with Oracle Public Sector/Higher Ed• 12 years of experience with the PeopleSoft software in

Higher Ed, City Government, K-12 and Public/Private Commercial sector.

The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions.The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.

Safe Harbor


Overview

Today we are going to go over what comes delivered and what you can do to help yourself manage your PeopleSoft Security

Anyone who has ever had to write a term paper can remember the feeling of sitting at the desk, pen in hand and a blank piece of paper (or should I say a blank word document ) in front of you. The look on you face then would have resembled the looks I see on faces of people that are in charge of security during an implementation.


Agenda

• What is delivered?• How to map and manage pages and other

permissions to roles and users.• What are the core security tables?• HR row level security• Campus row level• What's new in 9.1?• Creating custom (gasp!) audit records• Audit reports


What is delivered that can help me?

Delivered Tools for Security- Queries Where are they?

• Main Menu > PeopleTools > Security > Common Queries– These are great starting points, not only to run as delivered, but

copy them and put in your own criteria and prompts, make them your own!

–Main Menu > PeopleTools > Security > User Profiles– UserID Queries tab

–Main Menu > PeopleTools > Security > Roles– Role Queries tab

–Main Menu > PeopleTools > Security > Permission Lists– Permission List Queries tab


Small selection of the more commonly used queries from all of the Security pages in one place.

• Find the delivered query name• They all start with PT_SEC

Delivered Tools for Security- Queries How can I use the delivered queries, and make them my own?

• Open the delivered query and save it using your naming conventions. They are delivered as read only, so you should get this pop up message when opening any of them.


• Modify the queries to limit as you need for your organization• Limit results to your custom roles and permission lists• Exclude locked UserID’s• Pull additional fields, or join additional records to get the

data you want.


Delivered Tools for Security- Queries Records used in the delivered queries-

PSACCESSLOG

PSROLECLASS

PSPRSMDEFN

PSPRSMPERM

PSCLASSDEFN

PSAUTHITEM

PSPGEACCESSDESC

PSPNLGROUP

PSMENUITEM

PSSIGNON_VW

PSPNLDEFN

PSMENUDEFN

PSAUTHWS_VW2

PSOPRDEFNPSROLEUSER

Delivered Tools for Security- Row Level Where are they?

• Main Menu > Set Up HRMS > Security > Core Row Level Security > Security Tree Audit Report


• Main Menu > Set Up HRMS > Security > Core Row Level Security > Security Data Inquiry


How to map and manage pages and other permissions to roles and users.


What are the core security tables?

• PSOPRDEFN (OPRID info, including row security and primary permission list)

• PSROLEDEFN• PSCLASSDEFN• PSROLEUSER (PSROLEUSER_VW)

– To audit PSROLEUSER you actually apply the audit record to the view

• PSROLECLASS• PSAUTHITEM*

– To audit PSAUTHITEM takes a few additional steps, and only achievable using the DataBase level auditing

Core Security TablesDid you know these are the same record (definitions) in all PeopleSoft products?

Core Security Tables

PSOPRDEFN

PSROLEUSER

PSROLEDEFN

PSROLECLASS

PSCLASSDEFN

PSAUTHITEM *


Basic’s of HR row level security

HR Row level security

• Most of HR’s row level security will come from the ROWSECCLASS field from the Userid. This permission list will be pointing to a specific node on the Dept_security tree.

– PSOPRDEFN (Core)– SCRTY_TBL_DEPT


Main Menu > Set Up HRMS > Security > Core Row Level Security > Security by Dept Tree


• In addition to the Basic row level that is widely used in HR, is security sets, and security by permission list.

– PSOPRDEFN (Core)• SJT_CLASS


Main Menu > Set Up HRMS > Security > Core Row Level Security > Security Sets


Main Menu > Set Up HRMS > Security > Core Row Level Security > Security Access Type


Main Menu > Set Up HRMS > Security > Core Row Level Security > Security by Permission List


Basic’s of Campus Solutions row level

security

Campus Row Level Security

• Campus row level security is defined by USERID’s, or in some instances using a permission list, but not one that is applied to the PSOPRDEFN table, such as HR’s ROWSECCLASS does. This allows for a very dynamic security, but it also means a lot of records to contain this information.

Campus Row Level Security

• For the majority of the Campus user’s you would leave the ROWSECCLASS blank, as there will be no need to access HR data.

• For some users, there is a need to access HR data, as well as their campus specific information.

Campus Row Level Security Academic Structure- Permission List

Name of Page Table Module Notes

Service Indicator Display SCC_SI_DISP_ROLE ASWhere service indicators are restricted to a specific PL

Enrollment Security OPRCLASS_DEF_SA ASContains access by permission list to enrollment security

Self-Serv Enrollment Perm List SA_SS_ENRL_PL AS

If allowing self service to enrollment for students, this would be used so you can include the permission list in the “base” self-service access

Demographic Data Access RUNCNTL_MSK_CFG AS

This is a combination of setup data and the runcontrol information for setting up DDA masking. If you audit this table, you can track changes as well as who ran it and when.

Campus Row Level Security Academic Structure- USERID

Name of Page Table Notes

Academic Institution Security SCRTY_TBL_INSTBasic Institution level access. This is a base to the Career, program and plan/

Institution/Career Security SCRTY_TBL_CAR

For each userid, and each institution they are granted access to, set up the careers that userid is allowed to have access to.

Academic Program Security SCRTY_TBL_PROGAcademic Program is set up for all combinations of Userid with Institution and Career.

Academic Plan Security SCRTY_TBL_PLANAcademic Plan is built for each combination of Userid and Institution

Academic Org Security SCRTY_TBL_ACAD

Each Userid might have multiple Academic Org entries. You can grant level at the highest level of the ACAD Org tree, or down to more specific nodes

Admissions Action Security SCRTY_ADM_ACTN

This defines what kinds of admissions actions a user can do, not per institution, so whatever they are granted, applies to all institutions they have access to.

Program Action Security SCRTY_PROG_ACTION

This defines what kinds of Program actions a user can perform, not per institution, so whatever they are granted, applies to all institutions they have access to.

Recruiting Center Security SCRTY_RECR_CENTER

This defines the recruiting center the user will have access to, this is based on each institution the userid has been set up for.

Application Center Security SCRTY_APPL_CENTER

This defines the application center the user will have access to, this is based on each institution the userid has been set up for.

Campus Row Level Security Academic Structure- USERID


Service Indicator Security SCRTY_TBL_SRVCWhere service indicator place and release security is still set, as in previous releases

Student Group Security SCRTY_TBL_STGP

This is part of the new security for 9.0, and is where you assign student groups to a userid, for each of their institution. A user might have access to different student groups at different universities

Transcript Type Security SCRTY_TSCRPTOld- this is for universities upgrading, that are not switching to the new 9.0 transcript process

Transcript Report Security SSR_SCRTY_TSRPT New- 9.0 this is for the new transcript process.

SEVIS School Code Security SEV_SCHLCD_SCTYSEVIS is only by USERID, so this security would be applied to all institutions they are set up for.

SEVIS Pgm Sponsor Security SEV_PRG_SP_SCTY

SEVIS Program Sponsor is only by USERID, so this security would be applied to all institutions they are set up for.

Test ID Security SAD_TEST_SCTYTest ID security is only by USERID, so this security would be applied to all institutions they are set up for.

Population Update Security SCCPU_SRTY_TBL

Population update security is only by Userid. Every record they are allowed to update, they will be allowed to update at all institutions.

Advisement Report Security SAA_SCRTY_AARPT

Advisement report security is set up by the combination of Userid and Institution, so they can be granted different reports for each institution if that is needed.

Campus Row Level Security Student Financials- USERID

Name of Page Table NotesBusiness Unit SEC_UNITSF_OPR

Both of these records are part of the Business Record security by userid. SEC_UNITSF_OPR is the parent record.Business Unit SEC_CSHOFF_OPR

Company SEC_COMPANY_OPRGrant a user ID access to the transactions for particular companies

Credit Card and Bank Account SEC_CC_OPR

This security should be granted to only a few people in the institution. User IDs and permission lists to which you do not grant credit card security access can view only the last four digits of the credit card number.

Institution Set SEC_ISET_OPR

If you select no security for institution sets on the Security Options page, you do not need to complete the pages listed in this section, because all user IDs and permission lists have access to all institution sets.

Item TypeSEC_ITEM_SU_OPR Both of these records are used to assign security for Item

Types. If you select no security for item types on the Security Options page, you do not need to complete this security

Item Type SEC_ITEM_OPDATA

Campus Row Level Security Student Financials- USERID

Table Name of Page Notes

Origin IDs SEC_ORIGIN_OPR

If you select no security for origin IDs on the Security Options page, you do not need to complete the pages listed in this section because all user IDs and permission lists have access to all origin IDs

SetID SEC_SETID_OPR

If you select no security for setIDs on the Security Options page, do not complete the pages listed in this section, because all user IDs and permission lists have access to all setIDs.

Student Institution Set (Self Service Institution Set Override) ISET_OPR

The User Profiles Management feature assigns institution sets to user IDs. You use the Self Service Institution Set Override page to change the institution set assigned by the User Profiles Management feature. By overriding the institution set on this page, instead of on the User Defaults 2 page, you can view a history of the changes.

You must first set up institution sets and then assign a user ID to an institution set. A user ID must be assigned an institution set by the User Profiles Management Application Engine process (USERPROFILE) to have an institution set appear in the Calculated Value field on the Self Service Institution Set Override page.

Campus Row Level Security Student Financials- Permission List


Business Unit SEC_UNITSF_CLS Both of these records are part of the Business Record security by Permission List. SEC_UNITSF_OPR is the parent record.

SEC_CSHOFF_OPR

Company SEC_COMPANY_CLSSet up a Permission List to use to grant access to the transactions for particular companies

Credit Card and Bank Account SEC_CC_CLS

This security should be granted to only a few people in the institution. User IDs and permission lists to which you do not grant credit card security access can view only the last four digits of the credit card number.

Institution Set SEC_ISET_CLS

If you select no security for institution sets on the Security Options page, you do not need to complete the pages listed in this section, because all user IDs and permission lists have access to all institution sets.

Campus Row Level Security Student Financials- Permission List


Item Type SEC_ITEM_SU_CLS Both of these records are used to assign security for Item Types. If you select no security for item types on the Security Options page, you do not need to complete this securityItem Type SEC_ITEM_CLDATA

Origin ID SEC_ORIGIN_CLS

If you select no security for origin IDs on the Security Options page, you do not need to complete the pages listed in this section because all user IDs and permission lists have access to all origin IDs

SetID SEC_SETID_CLS

If you select no security for setIDs on the Security Options page, do not complete the pages listed in this section, because all user IDs and permission lists have access to all setIDs.

Recent Changes- Have you heard?


What's new in Campus Solutions 9.0 Security-

Campus Solutions Pre Bundle 11The page we all know and love (?)

Campus Solutions Pre Bundle 11

Campus Solutions Bundle 11

Campus Solutions Bundle 11It was asked for, and we are all very happy to have it.

• User Preferences– When you enter a user ID in this field, the default values that

you set up in the User Default component for the entered user ID are assigned to the user ID, including the enrollment override defaults which assigns the Enrollment Access ID.

• 3C Group security– The user 3C group security default value is no longer

assigned to the user ID. – When you enter a user ID in this field, the system also sets

the values on the User 3C Group Summary page of the User Defaults component.

Campus Solutions Bundle 11In addition to adding the additional SACR types to the copy- these were also added/changed.

We (security) were given the inch in bundle 11, lets go for the mile.

If you have any comments, suggestions for changes, customizations you have had to do to meet your business’s security needs, especially changes that many of you are making, please feel free to pass them on to me, and I will pass them onto the appropriate development teams.


Auditing Security


Delivered Audit\Security Management Tools?

Delivered? Student Financials- Userid

Delivered? Student Financials- Permission List


Other Options?

Other Options?

• Create a clone of a delivered record– Must start with AUDIT_– Do Not copy PeopleCode (It will ask, say No)– Take off all Keys, Search Key and List Box Items off

• Insert three audit fields– AUDIT_OPRID– AUDIT_STAMP– AUDIT_ACTN

• Save and Build (If this table will see a lot of insertions, especially in a short period of time, ask DBA about which tablespace to have it in)

Create the Audit Subrecord If you don’t have this already created

Create the Audit Subrecord

Make sure that the System

Maintained is checked

on the record field properties

Create the Audit Record

Traditional MethodOpen the record being audited, attach the audit record in the record properties

Something newNot new in 9.0, but still a newer method

Other Options? Something New


Reports?

Reports Audit Reports- Captures before and after.

Reports Security report- By Oprid

Reports Security report- Complete report- more manageable

Meet Us at the Oracle Consulting Lounge!Relax, Rest Your Feet, and Have a Snack!

Contact us:• Denise Goin – [email protected]

You are invited to the Oracle Consulting Lounge within the Oracle Exhibit Booth:

– Meet the Oracle Consulting Experts• I will be there Monday 4:30-6:30 and Tuesday 2-4

– Sign up for our Upgrade Workshop– Relax and have a snack

• For a copy of this presentation contact us at: [email protected]

• Please complete the survey at: http://www.heug.org/p/su/rd/sid=283

26012 managing & auditing security during implementation and beyond 03172009

Documents