Re: Record level security

[MacWheel99@xxxxxxx]

We have another related scenario in which there is a work around that no one 
wants to use.

We have people at various facilities who are authorized to access the items 
that are at their facilities for purposes of doing various transactions.  
They are also authorized to look at the story on other facilities for 
purposes of seeing what excess material could be transferred to their 
facility.  They are not supposed to be doing transactions in the other 
facilities.  Sometimes by accident, folks in facility-G will consume 
inventory that is in facility-E because they posted labor transactions 
against a wrong shop order #, or they keyed in a wrong warehouse number.

The work-around is to give users sign-ons that give them sign-ons that give 
them wide latitude in what they can do in their facility, but access is 
allowed ONLY in their facility or company, then to have a second sign on that 
is permitted to inquiry ONLY into any facility or company, but not do any 
transactions.

>  From:    mozanne@midori-no-ryu.demon.co.uk (Michael Ozanne)
>  
>  MacWheel99@aol.com writes
>  >For internal users (employees) we can restrict people 
>  > to a particular set of 
>  >applications, facility, company, or transaction set. 
>  
>  Not sufficient
>  
>  > For external users (customers or vendors) 
>  >perhaps we want to add customer # or vendor # to the 
>  >fields being used as controls on what they may access.
>  
>  The requirement is to prevent internal users from seeing customers,
>  items and commercial data related to product franchises run by a sister
>  company; when both companies share physical resources that cannot be
>  partitioned.

This is going to have to be a modification, if you cannot separate the data 
using the security filter fields that BPCS supplies, and potentially a lot of 
programs would be impacted, and it sounds to me like a major collection.

Perhaps you can find fields in the relevant files that you are not using at 
present, that are currently accessed by all relevant programs, that perhaps 
are within the collection of remembered keys filters, then change the literal 
use to distinguish whether the access rights are for a particular franchise, 
or for the entire enterprise.

Remembered Key filters can be set to say people can ONLY look at certain 
controls, but if the shared resources are in the same warehouses, or some 
filter directly relevant to the inquiry program, which is different for 
different applications, then this is not the solution.

I think some programs like INV300 are easier to modify to this purpose, while 
ORD programs are monsters, so you might consider disabling access to the 
vanilla programs & only allowing user access to the clones, in which for 
example INV3AB can only access items whose product franchise is AB & you have 
one each of these for each franchise, with AB going into one of those 
available IIM fields not presently in use.

Sorry I have not been able to be more helpful.

Al Macintyre  ©¿©
http://www.cen-elec.com MIS Manager Programmer & Computer Janitor
+---
| This is the BPCS Users Mailing List!
| To submit a new message, send your mail to BPCS-L@midrange.com.
| To subscribe to this list send email to BPCS-L-SUB@midrange.com.
| To unsubscribe from this list send email to BPCS-L-UNSUB@midrange.com.
| Questions should be directed to the list owner: dasmussen@aol.com
+---