<?xml version="1.0" encoding="utf-8"?>
<ManualTopic ID="/baanerp/tt/onlinemanual/usr_create_roles_and_authorizations_details" xml:lang="en">
	<Header>
		<Title xmlns:HTML="http://www.w3.org/TR/REC-html40">To create roles and authorizations - details</Title>
		<Keyword ContextSensitive="No"><Level1>User management</Level1>
			<Level2>create roles and authorizations - details</Level2>
		</Keyword>
		<Keyword ContextSensitive="No"><Level1>Authorizations</Level1>
		</Keyword>
		<Keyword ContextSensitive="No"><Level1>Authorization Management System</Level1>
		</Keyword>
		<Keyword ContextSensitive="No"><Level1>AMS</Level1>
		</Keyword>
		<Keyword ContextSensitive="No"><Level1>Roles</Level1>
		</Keyword>
	</Header>
	<ProcedureSection><ProcIntro><Paragraph class="Default">To create the standard role that contains the basic user authorizations, use the following procedure.</Paragraph>
			<Paragraph class="Default">Note: the procedure details described in this section are based on the case study in the <Link href="/baanerp/tt/onlinemanual/usr_create_roles_and_authorizations" role="manual">To create roles and authorizations</Link> section.</Paragraph>
		</ProcIntro>
		<Steps><Step><StepTitle>Add a new role</StepTitle>
				<ProcedureList><ListItem>Start the <Link href="/baanerp/tt/ams/ttams2100m000" role="session">Role Data (ttams2100m000)</Link> session.</ListItem>
					<ListItem>On the toolbar, click <GUIRef href="" role="manual">New</GUIRef> to create the standard role.</ListItem>
					<ListItem>Enter an identifier in the <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams200.crol" role="manual">Role</GUIRef> column, and enter a descriptive name for the role in the <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams200.desc" role="manual">Description</GUIRef> column. For this case study, enter Standard as the role identifier and Basic Employee Authorizations as the role’s description.</ListItem>
					<ListItem>Click <GUIRef href="" role="manual">Save</GUIRef> to save the role in ERP LN ’s data dictionary.</ListItem>
				</ProcedureList>
			</Step>
			<Step><StepTitle>Define session authorizations at company level</StepTitle>
				<Paragraph class="Default">Users must be able to view and print the data in the Global Enterprises’ general data dictionary. The users must also have full, round-the-clock authorizations for the data in the Holland Company and the USA Company.</Paragraph>
				<ProcedureList><ListIntro>To define these authorizations at company level, complete the following steps:</ListIntro>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams2100m000" role="session">Role Data (ttams2100m000)</GUIRef> session, select the Standard role in the grid.</ListItem>
					<ListItem>On the <GUIRef href="" role="menu">Specific</GUIRef> menu, point to <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams0330m000" role="command">Session Authorizations</GUIRef> and click <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams3133m000" role="command">Session Authorizations by Company</GUIRef>. The <Link href="/baanerp/tt/ams/ttams3133m000" role="session">Session Authorizations by Company (ttams3133m000)</Link> session starts.</ListItem>
					<ListItem>On the toolbar, click <GUIRef href="" role="manual">New</GUIRef>.</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3133m000#ttams333.comp" role="manual">Company</GUIRef> field, zoom to the <GUIRef href="/baanerp/tt/aad/ttaad1100m000" role="session">Companies (ttaad1100m000)</GUIRef> session and select Data Dictionary_General (000) company.</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3133m000#ttams333.autg" role="manual">Authorization Groups</GUIRef> box, select Print/Display.</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3133m000#ttams333.sttm" role="manual">Start Time</GUIRef> and <GUIRef href="/baanerp/tt/ams/ttams3133m000#ttams333.edtm" role="manual">End Time</GUIRef> fields, define the time interval 00:00 and 24:00, respectively.</ListItem>
					<ListItem>Repeat Steps 3 and 4 for the Holland Company and the USA Company and click <GUIRef href="" role="manual">Save</GUIRef>.</ListItem>
					<ListItem>Exit the <GUIRef href="/baanerp/tt/ams/ttams3133m000" role="session">Session Authorizations by Company (ttams3133m000)</GUIRef> session to return to the <GUIRef href="/baanerp/tt/ams/ttams2100m000" role="session">Role Data (ttams2100m000)</GUIRef> session.</ListItem>
				</ProcedureList>
			</Step>
			<Step><StepTitle>Define session authorizations at module level</StepTitle>
				<Paragraph class="Default">Full authorization is required to ensure that users can use ERP LN ’s Chart Manager for the sessions in the Chart Manager module. The session authorizations at module level are an addition to the print/display authorization of the Global Enterprise’s general data dictionary (000).</Paragraph>
				<Paragraph class="Default">Because the Chart Manager module is part of ERP LN Tools (tt), you must add the session authorization for the chart manager module to the standard role.</Paragraph>
				<ProcedureList><ListIntro>To add this session authorization, you must add ERP LN Tools to the general data dictionary in the standard role, and then add full authorization for the Chart Manager to the standard role. To define the session authorizations at module level, take the following steps:</ListIntro>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams2100m000" role="session">Role Data (ttams2100m000)</GUIRef> session, select the Standard role in the grid.</ListItem>
					<ListItem>On the <GUIRef href="" role="menu">Specific</GUIRef> menu, point to <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams0330m000" role="command">Session Authorizations</GUIRef> and click <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams3131m000" role="command">Session Authorizations by Module</GUIRef>. The <Link href="/baanerp/tt/ams/ttams3131m000" role="session">Session Authorizations by Module (ttams3131m000)</Link> session starts.</ListItem>
					<ListItem>On the toolbar, click <GUIRef href="" role="manual">New Group</GUIRef>.</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3131m000#ttams331.comp" role="manual">Company</GUIRef> field, zoom to the <GUIRef href="/baanerp/tt/aad/ttaad1100m000" role="session">Companies (ttaad1100m000)</GUIRef> session and click Data Dictionary_General (000).</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3131m000#ttams331.cpac" role="manual">Package</GUIRef> field, zoom to the <GUIRef href="/baanerp/tt/adv/ttadv1100m000" role="session">Packages (ttadv1100m000)</GUIRef> session and click tt (Tools).</ListItem>
					<ListItem>On the toolbar, click <GUIRef href="" role="manual">New</GUIRef>, and in the <GUIRef href="/baanerp/tt/ams/ttams3131m000#ttams331.cmod" role="manual">Module</GUIRef> field, zoom to the <GUIRef href="/baanerp/tt/adv/ttadv1101m000" role="session">Modules (ttadv1101m000)</GUIRef> session and select the Chart Manager (CHM) module.</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3131m000#ttams331.autg" role="manual">Authorization Groups</GUIRef> box, select Full Authorization.</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3131m000#ttams331.sttm" role="manual">Start Time</GUIRef> and <GUIRef href="/baanerp/tt/ams/ttams3131m000#ttams331.edtm" role="manual">Closing Time</GUIRef> fields, define the time interval 00:00 and 24:00, respectively, and click <GUIRef href="" role="manual">Save</GUIRef>.</ListItem>
					<ListItem>Exit the session to return to the <GUIRef href="/baanerp/tt/ams/ttams2100m000" role="session">Role Data (ttams2100m000)</GUIRef> session.</ListItem>
				</ProcedureList>
			</Step>
			<Step><StepTitle>Define session authorizations at session level</StepTitle>
				<Paragraph class="Default">To ensure that all necessary functionalities in Global Enterprises’ general data dictionary function properly, some authorizations at the session level must be restricted or added to ERP LN Tools. For example, the authorization for the <GUIRef href="/baanerp/tt/aad/ttaad4100" role="session">General Table Maintenance (ttaad4100 )</GUIRef> session must be restricted to no authorization. You must also extend the authorization for the <GUIRef href="/baanerp/tt/stp/ttstpsplopen" role="session">Select Device (ttstpsplopen )</GUIRef> session to full authorization.</Paragraph>
				<Paragraph class="Default">To extend this authorization, you must add ERP LN Tools to the general data dictionary in the standard role, and add the session authorizations at session level. For example, restrict the authorizations for the <GUIRef href="/baanerp/tt/aad/ttaad4100" role="session">General Table Maintenance (ttaad4100 )</GUIRef> session to no authorizations.</Paragraph>
				<ProcedureList><ListIntro>To add the session authorizations at session level, take the following steps:</ListIntro>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams2100m000" role="session">Role Data (ttams2100m000)</GUIRef> session, select the Standard role in the grid.</ListItem>
					<ListItem>On the <GUIRef href="" role="menu">Specific</GUIRef> menu, point to <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams0330m000" role="command">Session Authorizations</GUIRef>, and click <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams3132m000" role="command">Session Authorizations by Session</GUIRef>. The <Link href="/baanerp/tt/ams/ttams3132m000" role="session">Session Authorizations by Session (ttams3132m000)</Link> session starts.</ListItem>
					<ListItem>On the toolbar, click <GUIRef href="" role="manual">New Group</GUIRef>.</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3132m000#ttams332.comp" role="manual">Company</GUIRef> field, zoom to the <GUIRef href="/baanerp/tt/aad/ttaad1100m000" role="session">Companies (ttaad1100m000)</GUIRef> session and select Data Dictionary_General (000).</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3132m000#ttams332.cpac" role="manual">Package</GUIRef> field, zoom to the <GUIRef href="/baanerp/tt/adv/ttadv1100m000" role="session">Packages (ttadv1100m000)</GUIRef> session and select tt (Tools).</ListItem>
					<ListItem>On the toolbar, click <GUIRef href="" role="manual">New</GUIRef>, and in the <GUIRef href="/baanerp/tt/ams/ttams3132m000#ttams332.cmod" role="manual">Session</GUIRef> field, zoom to the <GUIRef href="/baanerp/tt/adv/ttadv2506s000" role="session">Sessions (ttadv2506s000)</GUIRef> session and select <GUIRef href="/baanerp/tt/aad/ttaad4100" role="session">General Table Maintenance (ttaad4100 )</GUIRef> session.</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3132m000#ttams332.autg" role="manual">Authorization Groups</GUIRef> field, select No Authorization.</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3132m000#ttams332.sttm" role="manual">Start Time</GUIRef> and <GUIRef href="/baanerp/tt/ams/ttams3132m000#ttams332.edtm" role="manual">End Time</GUIRef> fields, define the time interval 00:00 and 24:00, respectively, and then click <GUIRef href="" role="manual">Save</GUIRef>.</ListItem>
					<ListItem>Exit the session to return to the <GUIRef href="/baanerp/tt/ams/ttams2100m000" role="session">Role Data (ttams2100m000)</GUIRef> session.</ListItem>
				</ProcedureList>
			</Step>
			<Step><StepTitle>Define table authorizations at company level</StepTitle>
				<Paragraph class="Default">You must assign the table authorizations at company level to the standard role. These authorizations are required to ensure that the employees can perform all the necessary database transactions in Global Enterprises’ general data dictionary, the Holland Company, and the USA Company.</Paragraph>
				<ProcedureList><ListIntro>To define the table authorizations for the standard role, take the following steps:</ListIntro>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams2100m000" role="session">Role Data (ttams2100m000)</GUIRef> session, select the Standard role in the grid.</ListItem>
					<ListItem>On the <GUIRef href="" role="menu">Specific</GUIRef> menu, point to <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams1340m000" role="command">Table Authorizations</GUIRef>, and click <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams3144m000" role="command">Table Authorizations by Company</GUIRef>. The <GUIRef href="/baanerp/tt/ams/ttams3144m000" role="session">Table Authorizations by Company (ttams3144m000)</GUIRef> session starts.</ListItem>
					<ListItem>On the toolbar, click <GUIRef href="" role="manual">New</GUIRef>. In the <GUIRef href="/baanerp/tt/ams/ttams3144m000#ttams344.comp" role="manual">Company</GUIRef> field, zoom to the <GUIRef href="/baanerp/tt/aad/ttaad1100m000" role="session">Companies (ttaad1100m000)</GUIRef> session and select the Data Dictionary_General (000) company.</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3144m000#ttams344.perm" role="manual">Authorization Indicator</GUIRef> field, select Delete/Insert/Modify/Read.</ListItem>
					<ListItem>Repeat Steps 2 through 4 for the Holland Company and the USA Company, and then click <GUIRef href="" role="manual">Save</GUIRef>.</ListItem>
					<ListItem>Exit the session to return to the <GUIRef href="/baanerp/tt/ams/ttams2100m000" role="session">Role Data (ttams2100m000)</GUIRef> session.</ListItem>
				</ProcedureList>
			</Step>
			<Step><StepTitle>Define table field authorizations</StepTitle>
				<Paragraph class="Default">To make sure that the users cannot change their own user name, user type, and system logon, the employee’s authorizations for these table fields in the User Data (ttaad200) table must be restricted to read only.</Paragraph>
				<ProcedureList><ListIntro>To define the table authorizations for the standard role at table field level, take the following steps:</ListIntro>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams2100m000" role="session">Role Data (ttams2100m000)</GUIRef> session, select the Standard role in the grid.</ListItem>
					<ListItem>On the <GUIRef href="" role="menu">Specific</GUIRef> menu, point to <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams1340m000" role="command">Table Authorizations</GUIRef>, and click <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams2340m000" role="command">Table Field Authorizations</GUIRef>. The <Link href="/baanerp/tt/ams/ttams3143m000" role="session">Table Field Authorizations (ttams3143m000)</Link> session starts.</ListItem>
					<ListItem>On the toolbar, click <GUIRef href="" role="manual">New Group</GUIRef>.</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3143m000#ttams343.comp" role="manual">Company</GUIRef> field, zoom to the <GUIRef href="/baanerp/tt/aad/ttaad1100m000" role="session">Companies (ttaad1100m000)</GUIRef> session and select Data Dictionary_General (000).</ListItem>
					<ListItem>On the toolbar, click <GUIRef href="" role="manual">New</GUIRef>. In the <GUIRef href="/baanerp/tt/ams/ttams3143m000#ttams343.fldn" role="manual">Field Name</GUIRef> field, zoom to the <GUIRef href="/baanerp/tt/adv/ttadv4529m000" role="session">Table Fields (ttadv4529m000)</GUIRef> session and select the name (ttaad200.name) field in the User Data (ttaad200) table.</ListItem>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams3143m000#ttams343.perm" role="manual">Authorization</GUIRef> field, select Read.</ListItem>
					<ListItem>Repeat Steps 4 and 5 for the User Type table field and the System Logon table field, and then click <GUIRef href="" role="manual">Save</GUIRef>.</ListItem>
					<ListItem>Exit the session to return to the <GUIRef href="/baanerp/tt/ams/ttams2100m000" role="session">Role Data (ttams2100m000)</GUIRef> session.</ListItem>
				</ProcedureList>
			</Step>
			<Step><StepTitle>Convert the role to the run-time data dictionary.</StepTitle>
				<ProcedureList><ListIntro>You must now convert the standard role to the run-time data dictionary. This step completes the procedure to create the standard role.</ListIntro>
					<ListItem>In the <GUIRef href="/baanerp/tt/ams/ttams2100m000" role="session">Role Data (ttams2100m000)</GUIRef> session, on the <GUIRef href="" role="menu">Specific</GUIRef> menu, click <GUIRef href="/baanerp/tt/ams/ttams2100m000#ttams2200m000" role="command">Convert Changes to Runtime DD</GUIRef>. The <Link href="/baanerp/tt/ams/ttams2200m000" role="session">Convert Changes to Runtime DD (ttams2200m000)</Link> session starts.</ListItem>
					<ListItem>Under <GUIRef href="/baanerp/tt/ams/ttams2200m000#ttams200.crls" role="groupbox">Roles</GUIRef>, click <GUIRef href="/baanerp/tt/ams/ttams2200m000#exp.db" role="manual">Database Authorizations</GUIRef> and <GUIRef href="/baanerp/tt/ams/ttams2200m000#exp.sess" role="manual">Session / Library Authorizations</GUIRef>.</ListItem>
					<ListItem>Click <GUIRef href="/baanerp/tt/ams/ttams2200m000#exec.cont.process" role="command">Convert</GUIRef> to convert the standard role to ERP LN ’s run-time data dictionary.</ListItem>
					<ListItem>Restart ERP LN: to apply the new settings, the relevant users must log off and log on again.</ListItem>
				</ProcedureList>
				<Paragraph class="Default">The employees’ basic authorizations are now defined in the standard role. This concludes the case study. At this point, you can create additional roles and sub-roles for specific tasks. You must use the <GUIRef href="/baanerp/tt/ams/ttams1100s000" role="session">User Data (ttams1100s000)</GUIRef> session to link the roles to the individual ERP LN users. For more information, refer to “To create ERP LN users,” in the <Link href="/baanerp/tt/onlinemanual/usr_user_related_procedures" role="manual">User-related procedures</Link> section.</Paragraph>
			</Step>
		</Steps>
	</ProcedureSection>
</ManualTopic>
