<?xml version="1.0" encoding="utf-8"?>
<ManualTopic ID="/baanerp/tt/onlinemanual/usr_role_dependent_authorizations" xml:lang="en">
	<Header>
		<Title xmlns:HTML="http://www.w3.org/TR/REC-html40">Role-dependent authorizations</Title>
		<Keyword ContextSensitive="No"><Level1>User management</Level1>
			<Level2>authorizations</Level2>
		</Keyword>
		<Keyword ContextSensitive="No"><Level1>Authorizations</Level1>
		</Keyword>
		<Keyword ContextSensitive="No"><Level1>Roles</Level1>
		</Keyword>
	</Header>
	<GeneralSection><Paragraph class="Default">From a user point of view, a <Link href="/baanerp/tt/glossary/glossary#000017" role="glossary">role</Link> represents a functionality in a company. In ERP LN ’s Authorization Management System (AMS), a role represents a set of authorizations for a functionality in a company. User authorizations that are defined by role instead of by user significantly reduce the redundant data. The authorizations for normal users are, therefore, defined in roles to which the authorizations can be linked. The role concept provides you with a user-friendly method to quickly add new users or to update user authorizations.</Paragraph>
		<Paragraph class="Default">Because an employee can have more than one functionality in a company, you can assign the user to more than one role. A role can also contain more than one sub-role, which itself can also have sub-roles. All these roles and sub-roles form a role tree, which you can view with the role browser. The role browser shows the role tree in a graphical user interface.</Paragraph>
		<Paragraph class="Default">Ultimately, the employee’s role is a combination of all the authorizations defined in the user’s roles and sub roles. Recursive role structures are not allowed. For example, a junior software engineer cannot have the authorizations of a senior software engineer in a sub role.</Paragraph>
		<Figure space-and-orientation="indented-estimated"><FigIntro>The following figure shows an example of the combined authorizations of two different roles:</FigIntro>
			<HTML:IMG height="491" width="686" SRC="../images/tr_graph_usr_role_dependent_authorizations.gif" path="/enterpriseserver/tools/tt/onlinemanual" btb-count="1" btb-count2="1" btb-image-name="tr_graph_usr_role_dependent_authorizations.gif" btb-source-path="C:\SVN\docnl\Technology\EnterpriseServer~8.5\EnterpriseServer" btb-image-path="/enterpriseserver/tools/tt/images/tr_graph_usr_role_dependent_authorizations.gif" ID="IDALHYBC" alt="[...]" xmlns:HTML="http://www.w3.org/TR/REC-html40"/><FigCaption>Example of combined authorizations for more than one role</FigCaption>
		</Figure>
		<List><ListIntro>For example, a department manager has more responsibilities than the employees in the department and therefore has more database authorizations. Consequently, the manager has two roles:</ListIntro>
			<ListItem>The role of the employee with the appropriate restricted authorizations</ListItem>
			<ListItem>The manager’s role with additional authorizations, which are only relevant for the manager</ListItem>
		</List>
		<Paragraph class="Default">The restrictions on the table authorizations of the two roles are combined for the department manager. However, if the table authorizations are restricted for one role but not for the other role, the department manager will ultimately have permission to carry out the database actions.</Paragraph>
	</GeneralSection>
	<GeneralSection><SectionTitle>Role-dependent authorization types in ERP LN
                           </SectionTitle>
		<List><ListIntro>You can define the role-dependent authorizations at the following component levels in ERP LN:</ListIntro>
			<ListItem><Link href="#session_authorizations" role="internal">Session authorizations</Link>
			</ListItem>
			<ListItem><Link href="#table_authorizations" role="internal">Table authorizations</Link>
			</ListItem>
			<ListItem><Link href="#library_authorizations" role="internal">Library authorizations</Link>
			</ListItem>
		</List>
		<Paragraph class="Default">If the role-dependent authorizations change, conversion indicators are automatically set. Changes to the session authorizations, table authorizations, and the library authorizations are only converted to the run-time data dictionary when the conversion indicator is set to avoid unnecessary conversion of the authorization data to the run-time data dictionary.</Paragraph>
	</GeneralSection>
	<GeneralSection ID="session_authorizations"><SectionTitle>Session authorizations</SectionTitle>
		<Paragraph class="Default">The session authorizations define which sessions the users can start and what the users can do with these sessions in ERP LN. You can specify the session authorizations and on several levels for either a specific company or for all companies. For example, you can give the users authorizations for only specified sessions in a module or only the sessions in a specified package.</Paragraph>
		<Paragraph class="Default">The session authorization priorities in the following table show that the session authorization with the highest priority (1) is stated at the most specific level and the lowest priority (8) is stated at the most global level. The session authorizations that you define for a specific company have a higher priority than those defined for all companies:</Paragraph>
		<TABLE border="1" borderstyle="default" space-and-orientation="indented-estimated"><THEAD><TR><TD rowspan="1" colspan="1"></TD>
					<TD rowspan="1" colspan="1">One company</TD>
					<TD rowspan="1" colspan="1">All companies</TD>
				</TR>
			</THEAD>
			<TBODY><TR><TD rowspan="1" colspan="1">Session authorizations per session</TD>
					<TD rowspan="1" colspan="1">1</TD>
					<TD rowspan="1" colspan="1">2</TD>
				</TR>
				<TR><TD rowspan="1" colspan="1">Session authorizations per module</TD>
					<TD rowspan="1" colspan="1">3</TD>
					<TD rowspan="1" colspan="1">4</TD>
				</TR>
				<TR><TD rowspan="1" colspan="1">Session authorizations per package</TD>
					<TD rowspan="1" colspan="1">5</TD>
					<TD rowspan="1" colspan="1">6</TD>
				</TR>
				<TR><TD rowspan="1" colspan="1">Session authorizations per company</TD>
					<TD rowspan="1" colspan="1">7</TD>
					<TD rowspan="1" colspan="1">8</TD>
				</TR>
			</TBODY>
		</TABLE>
		<List><ListIntro>You can define the session authorizations with the following sessions in ERP LN ’s AMS:</ListIntro>
			<ListItem><Link href="/baanerp/tt/ams/ttams3133m000" role="session">Session Authorizations by Company (ttams3133m000)</Link>, which defines the session authorizations at company level</ListItem>
			<ListItem><Link href="/baanerp/tt/ams/ttams3130m000" role="session">Session Authorizations by Package (ttams3130m000)</Link>, which defines the session authorizations at package level</ListItem>
			<ListItem><Link href="/baanerp/tt/ams/ttams3131m000" role="session">Session Authorizations by Module (ttams3131m000)</Link>, which defines the session authorizations at module level</ListItem>
			<ListItem><Link href="/baanerp/tt/ams/ttams3132m000" role="session">Session Authorizations by Session (ttams3132m000)</Link>, which defines the session authorizations at session level</ListItem>
		</List>
		<Paragraph class="Default"></Paragraph>
	</GeneralSection>
	<GeneralSection ID="table_authorizations"><SectionTitle>Table authorizations</SectionTitle>
		<Paragraph class="Default">The table authorizations define the actions the users can perform on specified database tables and the associated fields in the database table. You can specify the table authorizations for a specific company, or for all companies, and on several levels. For example, you can give the users authorizations for specified tables in a module or only some table fields in a database table and so on.</Paragraph>
		<Paragraph class="Default">The table authorizations that you define in ERP LN ’s AMS are applicable to the databases for which the user is authorized. You can define the databases for which the user must be authorized in the RDBMS Administration module. For more information about the ERP LN ’s table authorization, refer to the “RDBMS administration” section.</Paragraph>
		<Paragraph class="Default">The table authorization priorities in the following table show that the table authorization with the highest priority (1) is stated at the most specific level and the lowest priority (14) are stated at the most global level.</Paragraph>
		<Paragraph class="Default">The table authorizations that you define for a specific company have a higher priority than those defined for all companies.</Paragraph>
		<TABLE border="1" borderstyle="default" space-and-orientation="indented-estimated"><THEAD><TR><TD rowspan="1" colspan="1"></TD>
					<TD rowspan="1" colspan="1">One company</TD>
					<TD rowspan="1" colspan="1">All companies</TD>
				</TR>
			</THEAD>
			<TBODY><TR><TD rowspan="1" colspan="1">Database table field data authorization</TD>
					<TD rowspan="1" colspan="1">1</TD>
					<TD rowspan="1" colspan="1">2</TD>
				</TR>
				<TR><TD rowspan="1" colspan="1">Database table field authorization</TD>
					<TD rowspan="1" colspan="1">3</TD>
					<TD rowspan="1" colspan="1">4</TD>
				</TR>
				<TR><TD height="35" rowspan="1" colspan="1">Database table authorization per table data</TD>
					<TD height="35" rowspan="1" colspan="1">5</TD>
					<TD height="35" rowspan="1" colspan="1">6</TD>
				</TR>
				<TR><TD rowspan="1" colspan="1">Database table authorization per table</TD>
					<TD rowspan="1" colspan="1">7</TD>
					<TD rowspan="1" colspan="1">8</TD>
				</TR>
				<TR><TD rowspan="1" colspan="1">Database table authorization per module</TD>
					<TD rowspan="1" colspan="1">9</TD>
					<TD rowspan="1" colspan="1">10</TD>
				</TR>
				<TR><TD rowspan="1" colspan="1">Database table authorization per package</TD>
					<TD rowspan="1" colspan="1">11</TD>
					<TD rowspan="1" colspan="1">12</TD>
				</TR>
				<TR><TD rowspan="1" colspan="1">Database table authorization per company</TD>
					<TD rowspan="1" colspan="1">13</TD>
					<TD rowspan="1" colspan="1">14</TD>
				</TR>
			</TBODY>
		</TABLE>
		<List><ListIntro>You can define the database-table authorizations and the database-table-field authorizations with the following sessions in ERP LN ’s AMS:</ListIntro>
			<ListItem><Link href="/baanerp/tt/ams/ttams3144m000" role="session">Table Authorizations by Company (ttams3144m000)</Link>
			</ListItem>
			<ListItem><Link href="/baanerp/tt/ams/ttams3140m000" role="session">Table Authorizations by Package (ttams3140m000)</Link>
			</ListItem>
			<ListItem><Link href="/baanerp/tt/ams/ttams3141m000" role="session">Table Authorizations by Module (ttams3141m000)</Link>
			</ListItem>
			<ListItem><Link href="/baanerp/tt/ams/ttams3142m000" role="session">Table Authorizations by Table (ttams3142m000)</Link>
			</ListItem>
			<ListItem><Link href="/baanerp/tt/ams/ttams3145m000" role="session">Table Data Authorizations (ttams3145m000)</Link>
			</ListItem>
			<ListItem><Link href="/baanerp/tt/ams/ttams3143m000" role="session">Table Field Authorizations (ttams3143m000)</Link>
			</ListItem>
			<ListItem><Link href="/baanerp/tt/ams/ttams3146m000" role="session">Table Field Data Authorizations (ttams3146m000)</Link>
			</ListItem>
		</List>
		<Important><SectionTitle>
                                 Important!
                              </SectionTitle>
			<Paragraph class="Default">Table field authorizations and Table Field Data Authorizations have no effect on reports. If a user has no authorization at all for a table field, the field is still printed.</Paragraph>
		</Important>
	</GeneralSection>
	<GeneralSection ID="library_authorizations"><SectionTitle>Library authorizations</SectionTitle>
		<Paragraph class="Default">
                              ERP LN uses the <Link href="/baanerp/tt/glossary/glossary#100260" role="glossary">Business Object Layer</Link> (BOL) integration technology, and OLE, DDE, OCX, and ORB interfaces to integrate programs with the ERP LN environment. These programs communicate with ERP LN through the Dynamic Link Libraries (DLLs). The Library authorizations define whether the users who are linked to the role can access the functions that are defined in DLLs.</Paragraph>
		<Note><SectionTitle>
                                 Note
                              </SectionTitle>
			<Paragraph class="Default">For details on the Business Object Layer (BOL), refer to <Link href="/baanerp/tt/onlinemanual/100107" role="manual">To Model a Business Object</Link> in the Infor Enterprise Server Web Help</Paragraph>
		</Note>
		<Paragraph class="Default">You can specify the library authorizations at several levels. For example, you can give the users authorizations only for specified libraries in a module or only the libraries in a specific package and so on.</Paragraph>
		<Paragraph class="Default">The library authorization priorities in the following table show that the library authorization with the highest priority (1) is stated at the most specific level, and the lowest priority (3) is stated at the most global level:</Paragraph>
		<TABLE border="1" borderstyle="default" space-and-orientation="indented-estimated"><TBODY><TR><TD rowspan="1" colspan="1">Library per library</TD>
					<TD rowspan="1" colspan="1">1</TD>
				</TR>
				<TR><TD rowspan="1" colspan="1">Library per module</TD>
					<TD rowspan="1" colspan="1">2</TD>
				</TR>
				<TR><TD rowspan="1" colspan="1">Library per package</TD>
					<TD rowspan="1" colspan="1">3</TD>
				</TR>
			</TBODY>
		</TABLE>
		<List><ListIntro>You can define the library authorizations at the various levels with the following sessions:</ListIntro>
			<ListItem><Link href="/baanerp/tt/ams/ttams3150m000" role="session">Library Authorizations by Package (ttams3150m000)</Link>
			</ListItem>
			<ListItem><Link href="/baanerp/tt/ams/ttams3151m000" role="session">Library Authorizations by Module (ttams3151m000)</Link>
			</ListItem>
			<ListItem><Link href="/baanerp/tt/ams/ttams3152m000" role="session">Library Authorizations by Library (ttams3152m000)</Link>
			</ListItem>
		</List>
	</GeneralSection>
</ManualTopic>
