Row Level Security in PeopleSoft HRMS

The Default department security is name DEPT_SECURITY and the SetID is the share, although you may choose to create one to operate with a different Setid, depending on your environment.

Root level on this tree represents your company or organization. Below that you are adding departments in a hierarchical manner until you have built on organizational char of your company’s department structure.

When you click the link on one of department levels to either insert a child or a sibling node, you will be allowed to either choose an existing department that has been created or to create a new department on the fly by clicking Add.

Tie date Permission lists to Your Trees

Define Business Rules - > Administer HR systems -> Use -> Maintain Row level Security

1) Select a Permission list – It needs to created in the maintain security menu.
2) Peoplesoft standard is to generally preface them with DP
3) In the Data security profile page, you need to add the Departments that this permission list will have access to.
4) You need to provide SetID for the Department Security Tree you are using and then enter the DeptID for the node you are choosing.
5) Department Security Tree is hierarchical, that by adding an access to a department, you are automatically granting access to all the departments below that node as well.
If you need to exclude the data from a particular ‘Sub-Department’ you will have need to add that department separately to this list, and choose ‘No Access’ as the Acess code instead of the default of ‘Read/Write’.

Change the security Basis for the System

The final step to implement Row level security in HR is to change all the search views controlling which data is accessed on various pages. Luckily you don’t have to change it manually change each one, as Peoplesoft has delivered a process that takes care of it all for you. Please note that you only run this Process when turning on Department security System-Wide, Or when removing it from the system.

Define Business Rules -> Define General options - > Process - > Change Row Security Basis.

You need to choose option for Department security, to turn Department security on, or the Option of ‘None’, to turn Department security off.

Common Query Access Issues

a) User cannot see a table they wish to query from in query manage
User does not have access to the table via one of their Access Group. Double-Click that they have the Proper Access group on one of their Permission lists an ad the table to an Access group if necessary.

b) A user cannot see a public query from search screen in either query manager or query viewer.

Once you have determined that the query does in fact exist, and I s indeed a public query, then the user probably does not have access to all the tables being used in the query. If a user does not have access to all the tables involved in a query, the search screen itself will filter out the query, so that it does not even appear in the list. Double-Check that they have the proper Access group on one of their permission lists and add the table to an Access group if necessary.

HTML Procedures in SQR

Creating HTML output from SQR

To use the HTML procedures listed below, your program must reference the HTML procedures.
Issue the following two commands at the start of your program:

#include html.inc
do html_on

The file html.inc is located in the SAMPLE (or SAMPLEW) directory. Use the command-line flag -I to indicate this location.

There are 6 types of HTML procedure that can be used to easily create HTML o/p files.

General Purpose Procedures
Heading Procedures
Highlighting Procedures
Hypertext Link Procedures
List Procedures
Table Procedures

Eg:-
1) Html_br

Produces the specified number of line breaks in a paragraph using the HTML "BR" tag.
This causes the paragraph to be continued onto the next line.

Syntax: html_br(number count, string attributes)

count = the number of HTML "BR" tags that are inserted.
Attributes = the HTML attributes that are incorporated inside the HTML "BR" tag.

Example: Producing a line break:
Print 'Here is some text' ()
Do html_br (3,'')
Print 'Here is some three lines down' ()

2) Inserts an image using the HTML "IMG" tag. This can also be done using the command PRINT-IMAGE;
However, the procedure html_img provides the ability to specify the full set of available HTML attributes.

Syntax: html_img (string attributes)

Attributes = the HTML attributes that are incorporated inside the HTML "IMG" tag.

Some common attributes:

Src = URL of the image to be inserted (Ex: src=/images/abc.gif)
Height = height of the image in pixels (Ex: height=200)
Width = width of the image in pixels (Ex: width=400)

Example: Producing an image:

Do html_img('src="/images/stop.gif"')

PS Query Permissions/Security in Peoplesoft

In Peoplesoft we cannot give access to any query directly like we provide it for components. user should have access to all the records in the query to access a particulary or use that record to create a query. Permission to the records needs to be provided first.
Private queries are visible to only those users who has created that query. query needs to be created as public for other users to access (given that they have access to all the records used in the query). security/permission to records are provide through query security tree and access groups.
In Query Tab of the Permission list set of query permission are present.
1) Access Group permission
2) Query Profile
Access group permission: This contains the list of the Access groups (nodes) in a particular query tree (it contain records that can be accessed) that a permission list has access.
Provide tree name and query access group here to get access to all records under query access group in this tree.
Tree Name and the Access group name needs to be entered.
Query Profile:
1)PeopleSoft Query
2)PeopleSoft Query Output
3) Advanced SQL Options
properties under each of these sections are set.
This defines what user can basically do with PS query.
PeopleTools > Security > Permission > Roles Permission Lists
Managing the query security tree
Query trees are accessible in Query Access group manager and not under the Tree manager.
PeopleTools > Security > Query Security > Query Access Group Manager.
Different trees for different category. Eg:- HR, BEFEFITS_ADMIN (contains BEFEFIT related records).
Each Leaf in the Tree corresponds to one record in this query tree.
Record is not Visible in PS Query ?
Add this record in the tree under the access group to which your primary permission list has access. (Query access group component)
OR
Add the access to your Tree and access group in which this record is present.

PeopleSoft - Change Access ID Password

To Change the Access ID password, possible methods are listed below:
There are ONLY 3 ways to do this. These options MUST be done in 2 tier and your application servers, Process Schedulers, and Web Servers MUST BE DOWN and ALL users need to be logged off if possible.

METHOD # 1 - (Preferred Method) Log into Data Mover as the Access ID (Bootstrap mode).
Then run this command:CHANGE_ACCESS_PASSWORD sa1 (This is your symbolic ID) cloud123 (This is the new password for the Access ID);And hit the Green traffic light.NOTE - This method does NOT work in PT 8.14 or 8.15, but is now fixed in PT 8.16 (T-JPELAY-AU4QW) so use method 2 or method 3. You MUST also make sure that the password for the Access ID has successfully been changed at the Database level because prior to PT 8.17 this method would not change the database level password. To do this go through your SQL tool (SQL Plus, Query Analyzer) and make the change in the database users table.

METHOD # 2 - (Second best method) You need to change the Access ID Password at database level then log into Data Mover in bootstrap mode and run:update PSACCESSPRFL set ACCESSID = 'what your Access ID is' , ACCESSPSWD = 'your New Access Password' , ENCRYPTED = 0, where SYMBOLICID = 'whatever the SYMBOLICID is';Then runENCRYPT_PASSWORD *;Note: If you have more than 45,000 rows in the PSOPRDEFN table then you may not be able to run the ENCRYPT_PASSWORD *; command in Data Mover. In that case just logon as a valid user in 2 tier and that will encrypt the Access ID in the PSACCESSPRFL table.This will synch up the PSACCESSPRFL table with the same password stored at the database level for your Access ID.

METHOD # 3 - (Last and most discouraged method) Go into Application Designer / Tools / Miscellaneous Objects / Access Profiles.Highlight the Symbolic ID and push the Edit button, enter the old password, new password, and confirm new password.If you change it in Application Designer it does not change at the database level. This is because we do not GRANT to the database in PT 8. You MUST also make sure that the password for the Access ID has successfully been changed at the DB level. To do this go through your SQL tool (SQL Plus, Query Analyzer) and make the change in the database users table.

Tuxedo WSL JSL Ports

Ports allocation for Application Server Domain:

Ports required for WSL and WSHs:
The number of ports required are 1 + [Max Handlers] where [Max Handlers] is the maximum number of workstation handlers configured. The algorithm used to start a WSH is a random port available after the port for WSL. On higher releases, the system automatically sets the range, starting from [WSL_port] + 1. Any port between 1025 and 65536 (both inclusive) is valid for WSL.

Ports required for JSL and JSHs:
The number of ports required are 1 + [Max Handlers] where [Max Handlers] is the maximum number of jolt handlers configured. The algorithm used to start a jolt handler is the first port available after the port for JSL. There's no need to force the range, it's automatic. Any port between 0 and 65535 is valid for JSL.

Grant access for a User to perform object migration

How to grant access for a User to perform object migration..?
To create user who can perform object migration from one environment to another environment, without having write access to the Application Designer objects like record, field, Application Engine, PepleCode etc. Solution:

Login to PIA:

Go to Home > People Tools > Maintain Security > Use > Permission Lists open the permission list the user has. Then go to People Tools tab, tick Application Designer Access. You may set different objects permissions to read only if you click the links for Definition Permissions, Tools Permissions, and Miscellaneous Permissions. You should have "full access" to project.
You can set Build script only or more in Build / Data Admin of Tools permission. Once the user has this permission list, the user should be able to migrate the project and build the project only.