Employee Self Service Security

unknown

We are rolling out some features of Employee Self Service.  One of them, Work Contacts, requires access to the HR11 form.  Another, Phone Book, requires Inquire access on the EMPLOYEE table.  Having both HR11 and Inquire access on the EMPLOYEE table allows users to drill on the Employee Field in HR11 and see other employee's information.  We tried hiding the EMPLOYEE field on the form but to our amazement, you can still drill on the field even though it is hidden!  ???  Infor says this is working as designed, but may consider changing it. 

I was wondering how other people are security this?  If we secure EMPLOYEE to the employee's company and employee number, they can only retrieve their own information in the Phone Book.  If we take away the HR11 form, they get a security violation in Work Contacts. 

Not all of our Employee Self Service users are "only" self service users, so taking away the search box is not an option.

Thanks,

Carla

plancor

We have a Self Service security Role that

1) Denies Access to table fields that are not used in ESS (ie allow access to the EMPLOYEE phone book fields, but deny access to all others). This takes care of the drill around problem, and

2) Provides Conditional access to HR11 only if the Company and Employee are the same as the user's.



For users that require greater access to HR11 or table data, other security Roles/Classes provide that access. It is layered security model.



We also have different Portal Roles so that ESS only employees do not have a search box.