<?xml version="1.0" encoding="utf-8"?>
<ManualTopic ID="/baanerp/tt/onlinemanual/usr_user_authorizations" xml:lang="en">
	<Header>
		<Title xmlns:HTML="http://www.w3.org/TR/REC-html40"> ERP LN user authorizations</Title>
		<Keyword ContextSensitive="No"><Level1>User management</Level1>
			<Level2>authorizations</Level2>
		</Keyword>
		<Keyword ContextSensitive="No"><Level1>Authorizations</Level1>
		</Keyword>
	</Header>
	<AimSection></AimSection>
	<GeneralSection><Paragraph class="Default">Initially, normal users cannot use ERP LN at all. Therefore, you must define some authorizations for the various ERP LN software components. The authorizations of an employee in a company are related to the employee’s functionality or role in that organization, some employees have more authorizations than others. Likewise, ERP LN ’s Authorization Management System (AMS) also uses a role concept to define the authorizations of ERP LN users.</Paragraph>
		<Paragraph class="Default">In addition to these role-dependent authorizations, you can define some additional dependent authorizations that are not defined by the employee’s role: for example, the development parameters, device preferences, and so on. These non-role-dependent authorizations are defined in templates, which you can then connect to the user profile.</Paragraph>
		<Figure space-and-orientation="indented-estimated"><FigIntro>The following figure shows a schematic overview of how the user authorizations are split up into role-related authorizations and non-role-dependent authorizations:</FigIntro>
			<HTML:IMG height="235" width="689" SRC="../images/tr_graph_usr_user_authorizations.gif" path="/enterpriseserver/tools/tt/onlinemanual" btb-count="1" btb-count2="1" btb-image-name="tr_graph_usr_user_authorizations.gif" btb-source-path="C:\SVN\docnl\Technology\EnterpriseServer~8.5\EnterpriseServer" btb-image-path="/enterpriseserver/tools/tt/images/tr_graph_usr_user_authorizations.gif" ID="IDA2HYBC" alt="[...]" xmlns:HTML="http://www.w3.org/TR/REC-html40"/><FigCaption>Schematic overview of the authorization concept in ERP LN
                              </FigCaption>
		</Figure>
		<Note><SectionTitle>
                                 Note
                              </SectionTitle>
			<Paragraph class="Default">At minimum, users must have some sort of session authorization, table authorization, and library authorization to use ERP LN. During the installation of ERP LN, some default roles are automatically created. The default roles ensure that the normal users can use the WorkTop browser and the browser’s associated functions and commands.</Paragraph>
		</Note>
		<GeneralSection><SectionTitle>Session Authorization (DEM and AMS)</SectionTitle>
			<Keyword type="section" order="IDADOW1B"><Level1>User management</Level1>
				<Level2>Session Authorization (DEM and AMS)</Level2>
			</Keyword>
			<List><ListIntro>You can use two different methods for defining employee roles. First you can define roles in the Dynamic Enterprise Modeler (DEM). Second you can define roles in the Authorization Management System (AMS).</ListIntro>
				<ListItemHead>DEM</ListItemHead>
				<ListItem><Paragraph class="Default">In DEM you can model Business Processes. Business Processes contain activities to be executed. Those activities can be ERP LN sessions.</Paragraph>
					<Paragraph class="Default">Roles are linked to Business Processes, activities and employees. This way the access to the ERP LN sessions is controlled.</Paragraph>
					<Paragraph class="Default">On runtime the employee has a specific DEM menu, the Process browser in WebTop or WorkTop. When an employee executes ERP LN sessions from the Process browser, then the modeled DEM authorizations are used for those sessions. The DEM authorizations are deduced from the modeling information and are not stored into static authorization tables.</Paragraph>
					<Paragraph class="Default">Note: If you launch sessions from the Process browser, ERP LN ignores any roles and authorizations defined in AMS. However, the AMS authorizations are applicable if you launch sessions through the <GUIRef href="" role="command">Run Program</GUIRef> command in WebTop or WorkTop.</Paragraph>
				</ListItem>
				<ListItemHead>AMS</ListItemHead>
				<ListItem><Paragraph class="Default">In AMS you can define roles for Session Authorization, Table Authorization and Table Field Authorization. Those roles can be linked to normal users. By default normal users do not have any authorization. Super users have Full authorization for all sessions and all tables.</Paragraph>
					<Paragraph class="Default">You can define different authorization types, for example Full authorization, Read Only authorization, and so on.</Paragraph>
					<Paragraph class="Default">You can launch sessions from the Menu browser in WebTop or WorkTop. The roles that are linked to your ERP LN user account decide what is allowed to execute or not.</Paragraph>
					<Paragraph class="Default">The DEM roles and authorizations are not applicable if you launch sessions from the Menu browser.</Paragraph>
				</ListItem>
			</List>
			<Paragraph class="Default">In connection with the Sarbanes - Oxley Act (officially titled the Public Company Accounting Reform and Investor Protection Act of 2002) customers feel the need to have a clear overview of the authorizations of a certain employee for the ERP LN applications.</Paragraph>
			<List><ListIntro>The following sessions are available to print the session authorizations:</ListIntro>
				<ListItemHead>DEM</ListItemHead>
				<ListItem>Print DEM Session Authorizations (tgbrg8441m000)</ListItem>
				<ListItemHead>AMS</ListItemHead>
				<ListItem>Print Session Authorizations by User (ttams3400m000)</ListItem>
			</List>
		</GeneralSection>
	</GeneralSection>
</ManualTopic>
