You use this program to add and maintain the groups to which operators are assigned and to define program access levels for each group.
You typically use groups to prevent unauthorized operator access to selected SYSPRO programs.
| Field | Description |
|---|---|
| Group | |
| Code | Indicates the operator group code you entered. |
| Description | Indicates the description for the operator group code. |
| Language code | Indicate whether you want to link a group of operators
to a specific language code. This enables you to display text of standard SYSPRO reports in the language linked to that code. None indicates that you do not require this feature. See also Language Translation. |
| Security | |
| System administrator | Indicates that the operators assigned to this group
have unrestricted access to the entire SYSPRO system.
Only the system administrator can add a group type user menu. |
| Allowed to logout users | Indicates whether operators assigned to this group can
log out users from the system (View Users). See also: Notes and warnings. |
You use this pane to assign program access levels for operators assigned to the group. Details of SYSPRO modules and programs are displayed in an editable listview.
This pane is disabled for system administrators (they have unrestricted access to the system) or if the Program access always by role global configuration option is enabled (Roles).
You can assign access to programs individually. Alternatively, you can select multiple programs (using the Ctrl+arrow and Shift+arrow keyboard keys) and then right-click the mouse to display a sub menu to allow/deny access for the highlighted programs.
You can also right-click the mouse to display a sub menu that allows you to set job logging on for all programs or off for all programs.
| Field | Description | ||||
|---|---|---|---|---|---|
| Allow Access to all | Grants operators in the group full access to all programs. | ||||
| Deny Access to all | This denies operators in the group access to all
programs (useful if you want to grant operators access to
only a few of the programs in the list view. Then you can
select the individual programs to which you want to grant
the operators in the group full or browse only
access).
|
||||
| Module | Toggles the display of modules and their related programs in ascending or descending order in the listview. | ||||
| Program | Indicates the program code. | ||||
| Access allowed | Indicates the access level to the corresponding program for operators in the group. Select this to indicate that the operators within the group have full access to the program, including access to the maintenance functions on browse programs.The Job logging required option is automatically enabled (provided that you enabled the Job logging required option (Company Maintenance). If you do not select this option, then operators within the group don't have access to the program and cannot run the program. However, for Browse type programs you can still give operators Browse only access. |
||||
| Browse |
Yes indicates that the program is a browse program. Browse programs typically display information for key fields such as suppliers, customers, ledger codes, banks, currencies, stock codes, etc. From the setup type browse programs, you can also select to maintain the information. No in this column indicates that the program is a non-browse program. Non-browse programs typically enable you to process transactions, set options and perform functions such as paying a supplier, invoicing a customer, performing a stock take, etc. |
||||
| Module | Indicates the module in which the program resides. | ||||
| Description | Indicates the program description. | ||||
| Browse only access |
Indicates whether the operators within the group have access to viewing information in the browse program only. You can enable this option only if Yes is displayed in the Browse column for the program. Access to the maintenance functions (e.g. add, change, delete) is disabled. |
||||
| Job logging required |
Indicates whether job logging is enabled for the group for that program. Job logging can only be enabled if you selected the Job logging required setup option (Company Maintenance) and you selected Allow Access against the program. |
||||
![[Note]](images/note.png)
-
When a new SYSPRO program is released, the default security level is set to denied for a non-browse program and Browse only for a browse program.
-
When adding a group without System administrator rights then (by default) access is denied for all non-browse programs and Browse only access is ticked for all Browse programs.
-
Although security access is defined at group level, groups are available across companies (i.e. Once you have defined access privileges for a group, these settings apply in all companies). For this reason, you must ensure that you define separate groups to accommodate access privileges that vary across companies.
-
Denying a group of operators access to a program that appears in more than one module, effectively denies access to the program in all modules.
-
If an operator is attached to more than one group, then the following logic applies when the operator attempts to access a program:
-
Non-browse programs
Access is first verified against the primary group and then against each subgroup. If access is set to Allowed in any group, then the operator can run the program. If access is set to Denied in all groups, then the operator cannot run the program.
-
Browse programs
Access is first verified against the primary group and then against each subgroup. If access is set to Allowed in any group, then the operator can run the program. If access is set to Browse only in any group (and access is not set to Allowed against the program in any group) then the operator can view the information in the browse program, but cannot maintain it. If access is set to Denied in all groups, then the operator cannot run the program.
-
-
Where browse and maintenance programs are separated into two programs, each has their own security access settings.
You need to consider this when setting the security for the maintenance program, as a situation could arise where the operator does not have access to the Browse program but can run the maintenance program using the Run a Program function (->).
Therefore, to deny access to the maintenance program, you need to set access to the Browse program to Browse only and access to the maintenance program to Denied.
When you allow full access to the browse program, then the Add, Change, Delete and other maintenance functions are enabled. In addition, when the corresponding maintenance program is called, no further security checks are performed (i.e. calling the maintenance program from the browse program enables the Add, Change, Delete and other maintenance functions in the maintenance program without other program security checks).
-
The Allowed to logout users functionality is only available when allowed against the primary group of the operator. The logout hyperlinks are not available to sub groups, as the logout function is only linked to the primary group.
-
The following applies to Group security when upgrading from a previous version of the software:
-
For programs that no longer exist in the new version, the security for those programs is deleted.
-
For new programs which replace legacy programs, the same level of group security that was set against the legacy program is set against the new program.
-
For totally new programs (i.e. not replacements for legacy programs), security access is denied by default.
-
Where a group had access to all programs in a module in the previous software version, access to any totally new programs added in the new version of the software is set to denied by default. This means that the group will no longer have access to the entire module if totally new programs were added in the new software version.
-
-
For any module against which the option to automatically Post GL journals to the General Ledger is enabled (General Ledger Integration) the security settings defined for the GL Integration programs are ignored by the system.
The sub-module journals are automatically posted by the following programs, even if the operator is denied access to these programs: AP Invoice GL Integration, AP Payments GL Integration, AR Invoice GL Integration, AR Payments GL Integration, Cash Book GL Integration, Inventory GL Integration, GRN GL Integration, Asset GL Integration, Trade Promotions GL Integration, WIP Part Billings GL Integration and WIP Labor GL Integration. Operators who are denied access to these programs will, however, not be able to run them manually.
-
Operators assigned to a System administrator group have unrestricted access to the entire SYSPRO system and are therefore not restricted by any program access.
-
You cannot delete a group if operators are still linked to the group or the group is defined as a sub group for an operator (in which case you would need to remove the group from all operator sub groups).
-
When program access is defined by role (Role Program Access Maintenance) then only the Security options are applied from this program. Therefore, when an operator is part of a group that has System Administrator rights, the role settings are not applied to that operator.
-
Changing the group to which an operator belongs does not affect that operator's existing access rights to Fields or Activities (Operators).
-
If the operator activity BOM Access to Structure & Routings (Operators) is set to Denied, then the operator will be unable to access the Structures and Routings program, regardless of your settings against the IMP012 (Structures and Routings) program here.
Inserting Application Help
You would typically follow this procedure to display help for the current program in a customized pane that can be pinned to the program window.
Information includes step-by-step instructions for the various functions available within the program, including a brief overview of what the program does, what setup options are required and how to personalize the program.
-
Open the program for which you want to insert application help into a customized pane.
This functionality is only available for a program that has panes.
-
Right-click any form field.
You can also click the triangle menu icon that appears in the title area of a pane.
-
Select Insert Application Help from the context-sensitive menu.
The application help appears in a pane within your program. You can reposition the pane using the docking stickers or pin it to the program window.
Removing the Application Help pane
If you no longer want to display application help in a pane for your current program, you can simply remove it.
-
Select the Close icon in the right-hand corner of the application help pane.
-
Confirm that you want to delete the pane.