The foundation of security is access control, which refers to how the system is being accessed and by whom. User security consists of three principal components: authentication, authorization and an audit trail.
Authentication validates the user’s identity, authorization controls the user’s access based on responsibilities assigned, and the audit trail keeps track of the user’s transactions to ensure that the user’s privileges are not being misused.
AuthenticationIdentifying and verifying who is allowed to access the system is the first line of defense. The most common approach is password-based authentication: if the legitimate user is the only one who knows the password, then whoever just entered the correct password is very likely to be the person authorized to use the account.
In a single-sign on environment, a single password allows access to more than one application, so the consequences of it being discovered or divulged are
proportionately much more serious.
AuthorizationOn entering the system, the user should only be granted access to the features and specific data needed to perform his job. Routine access to highly sensitive data should only be given to trusted users who need that level of access.
The Function Security feature allows the System Administrator to manage the access privileges of individual users. By enforcing tighter security policies for more sensitive accounts, Function Security can mitigate the risk of unauthorized users’ access to highly sensitive information
Audit TrailEven the most carefully planned user authentication and authorization policies cannot eliminate the risk of exploitation when the attacker is an authorized user. An audit trail can be used to keep track of a user’s transactions to verify that the user is not misusing his access privileges. Oracle E-Business Suite can record details of every user’s login,
including time stamp, session ID, and information about the Function Security rules applying to that session. Information about the identity of the user is also attached to all transactions. This provides a method for detecting the party responsible for any transaction, or determining which users viewed sensitive data in a given time period.
Network Security
An organization may or may not have physical control over the network infrastructure in use. The Internet is the best example of a network where it will not have control, and where extra steps must be taken to ensure security is not compromised.
A common concern regarding use of a public network such as the Internet is the possibility of someone eavesdropping on password transmissions by using a network sniffer. In such a case, though, the concern should be wider, and reflect the possibility of someone eavesdropping on sensitive information in general. In such cases, HTTPS (secure HTTP) connection to the E-Business Suite is recommended. All current browser-based password login screens send the password as a parameter in the HTTP form submission. Using an HTTPS connection will encrypt this information. The best practice is therefore to use HTTPS for all web-based access. On the other hand, if you have control over your network to the point where you can rule out eavesdropping, then password interception should not be an issue.
The main reason not to run HTTPS by default is performance, since it does introduce some overhead. A more strategic way to address this concern is to integrate the Oracle E-Business Suite with Oracle Application Server 10g Single Sign-On (SSO). Here, the SSO server that is responsible for user authentication is a different Web server from the one used with the E-Business Suite. Hence you can run the SSO server in HTTPS mode, while running the E-Business Suite Web server in the better-performing HTTP mode.
Oracle User Management
Oracle User Management (UMX) is a secure and scalable system that enables organizations to define administrative functions and manage users based on specific requirements such as job role or geographic location.
With Oracle User Management, instead of exclusively relying on a centralized administrator to manage all its users, an organization can, if desired, create functional administrators and grant them sufficient privileges to manage a specific subset of the organization’s users. This provides the organization with a more granular level of security, and the ability to make the most effective use of its administrative capabilities.
For example, a new feature in Release 12 provides a login assistance mechanism that is easily accessed from the E-Business Suite Login Page. A user simply clicks on the “Login Assistance” link located below the Login and Cancel buttons, and can then go to a Forgot Password section or Forgot User Name section to have the necessary action
taken automatically, without the need for an administrator to become involved.
Another new feature in Release 12 allows users with the relevant privileges to enable other users to act on their behalf, as delegates, without having to share the account password. For example, managers may need to grant peers or subordinates limited authority to act on their behalf while they are out of the office. This Proxy User feature allows control over the pages, functions, and data security policies that can be granted, and includes an on-screen display that indicates when a user is acting on behalf of another user.
Role Based Access Control
Oracle User Management implements several different layers of security, requiring organizations to specify:
- The set of users that will be granted access to specific areas of Oracle Applications
- The information these users will require to do their jobs
- The extent to which the users can use this information
Oracle’s function and data security models constitute the base layers of this system, and contain the traditional ystem administrative capabilities.
Organizations can optionally add more layers to the system depending on the degree of flexibility they require. Role Based Access Control (RBAC) enables organizations to create roles based on specific job functions, and to assign these roles the appropriate permissions. With RBAC, administrative privileges and user access are determined by assigning individuals the appropriate roles.
Key features of RBAC include:
- Delegated Administration – Enables system administrators to delegate some of their administrative privileges to individuals that manage a subset of the organization’s users.
- Registration Processes – Enable organizations to provide end-users with a method for requesting various levels of access to the system, based on their eligibility.
- Self-service Requests and Approvals – Enable end users to request initial access or additional access to the system by clicking on links embedded in a Web application.
Data Security
The next layer of access control within Oracle Applications is Data Security. Working in conjunction with Function Security, Data Security provides additional access control on the data a user can see and what actions a user can perform on that data, within Oracle Applications. Using Data Security, for example, you could control access to the set of orders that an order administrator can update within the Order Management application.
User Management (UMX) provide the UIs for modeling data security within Oracle Applications.
Share this:
Security
The foundation of security is access control, which refers to how the system is being accessed and by whom. User security consists of three principal components: authentication, authorization and an audit trail.
Authentication validates the user’s identity, authorization controls the user’s access based on responsibilities assigned, and the audit trail keeps track of the user’s transactions to ensure that the user’s privileges are not being misused.
Authentication
Identifying and verifying who is allowed to access the system is the first line of defense. The most common approach is password-based authentication: if the legitimate user is the only one who knows the password, then whoever just entered the correct password is very likely to be the person authorized to use the account.
In a single-sign on environment, a single password allows access to more than one application, so the consequences of it being discovered or divulged are
proportionately much more serious.
Authorization
On entering the system, the user should only be granted access to the features and specific data needed to perform his job. Routine access to highly sensitive data should only be given to trusted users who need that level of access. The Function Security feature allows the System Administrator to manage the access privileges of individual users. By enforcing tighter security policies for more sensitive accounts, Function Security can mitigate the risk of unauthorized users’ access to highly sensitive information
Audit Trail
Even the most carefully planned user authentication and authorization policies cannot eliminate the risk of exploitation when the attacker is an authorized user. An audit trail can be used to keep track of a user’s transactions to verify that the user is not misusing his access privileges. Oracle E-Business Suite can record details of every user’s login,
including time stamp, session ID, and information about the Function Security rules applying to that session. Information about the identity of the user is also attached to all transactions. This provides a method for detecting the party responsible for any transaction, or determining which users viewed sensitive data in a given time period.
Network Security
An organization may or may not have physical control over the network infrastructure in use. The Internet is the best example of a network where it will not have control, and where extra steps must be taken to ensure security is not compromised.
A common concern regarding use of a public network such as the Internet is the possibility of someone eavesdropping on password transmissions by using a network sniffer. In such a case, though, the concern should be wider, and reflect the possibility of someone eavesdropping on sensitive information in general. In such cases, HTTPS (secure HTTP) connection to the E-Business Suite is recommended. All current browser-based password login screens send the password as a parameter in the HTTP form submission. Using an HTTPS connection will encrypt this information. The best practice is therefore to use HTTPS for all web-based access. On the other hand, if you have control over your network to the point where you can rule out eavesdropping, then password interception should not be an issue.
The main reason not to run HTTPS by default is performance, since it does introduce some overhead. A more strategic way to address this concern is to integrate the Oracle E-Business Suite with Oracle Application Server 10g Single Sign-On (SSO). Here, the SSO server that is responsible for user authentication is a different Web server from the one used with the E-Business Suite. Hence you can run the SSO server in HTTPS mode, while running the E-Business Suite Web server in the better-performing HTTP mode.
Oracle User Management
Oracle User Management (UMX) is a secure and scalable system that enables organizations to define administrative functions and manage users based on specific requirements such as job role or geographic location.
With Oracle User Management, instead of exclusively relying on a centralized administrator to manage all its users, an organization can, if desired, create functional administrators and grant them sufficient privileges to manage a specific subset of the organization’s users. This provides the organization with a more granular level of security, and the ability to make the most effective use of its administrative capabilities.
For example, a new feature in Release 12 provides a login assistance mechanism that is easily accessed from the E-Business Suite Login Page. A user simply clicks on the “Login Assistance” link located below the Login and Cancel buttons, and can then go to a Forgot Password section or Forgot User Name section to have the necessary action
taken automatically, without the need for an administrator to become involved.
Another new feature in Release 12 allows users with the relevant privileges to enable other users to act on their behalf, as delegates, without having to share the account password. For example, managers may need to grant peers or subordinates limited authority to act on their behalf while they are out of the office. This Proxy User feature allows control over the pages, functions, and data security policies that can be granted, and includes an on-screen display that indicates when a user is acting on behalf of another user.
Role Based Access Control
Oracle User Management implements several different layers of security, requiring organizations to specify:
Oracle’s function and data security models constitute the base layers of this system, and contain the traditional ystem administrative capabilities.
Organizations can optionally add more layers to the system depending on the degree of flexibility they require. Role Based Access Control (RBAC) enables organizations to create roles based on specific job functions, and to assign these roles the appropriate permissions. With RBAC, administrative privileges and user access are determined by assigning individuals the appropriate roles.
Key features of RBAC include:
Share this:
OM profiles
In the case of ATP enabled items, the timestamp will always schedule to 23:59:00 as ATP considers all the components and resources available till end of day.
In the case of non-ATPable items, the profile ‘MSC: Retain Time stamp for Non ATPABLE items’ is used.
If this is set to Yes, the timestamp can be saved to the value entered by the user.
The Profile can be set to either Yes or No.
MSC:Retain time for Non-ATPable items set to Yes
————————————————
ATP returns same time stamp as passed to ATP from the Request Date and Time, for all single lines
for non-atpable items or for all sets containing only non-atpable items.
If a set contains mix of atpaple and non atpable items, then ATP continues to return 23:59:00 as
the new timestamp.
MSC:Retain time for Non-ATPable items set to No
———————————————–
If the profile is set to ‘No’, then ATP will also return 23:59:00 as the time stam
2. OM: Add Customer
This profile enables user to allow customer in the create sales order window.
Share this:
Currency Profiles
Share this:
What is Profile Options?
Site level These settings apply to all users at an installation site.
Application level These settings apply to all users of any responsibility associated with the application.
Responsibility level These settings apply to all users currently signed on under the responsibility.
User level These settings apply to an individual user, identified by their application username.
Important Profiles
1.1. HR: Business Group
1.2 HR: Security Option
1.3: HR: User Type (FOR accessing HRMS functions)
1.4 HR: Cross Business Group
2.1. GL: Set of Books(11i)
2.1 GL:%Ledger% (R12)
2.3 GL: Data Access Set. This profile option to control the ledgers that can be used by Oracle General Ledger.
3.1. MO: Operating Unit
3.2. MO: Security Profile (R12)
3.3. MO: Default Operating Unit
4.1 Tax: Allow Override of Tax Code
4.2 Tax: Invoice Freight as Revenue
4.3 Tax: Inventory Item for Freight
5.1 Sequential Numbering
5.2 INV: Intercompany Currency Conversion
6.1 RCV: Processing Mode – Batch, Immediate, Online
6.2 QA: PO Inspection – Oracle Purchasing , Oracle Quality
7.1 Hide Diagnostics menu entry
8.1 OE: Item Flexfield
This profile option indicates the structure of the Item Flexfield (System Items) used by Order Entry. This structure should be the same across all applications in the same database.
This profile option is visible and updatable at the site level.
8.2 OE: Item Validation Organization
This profile option indicates the Oracle Manufacturing organization against which items are validated. You must define all items that can be included in your transactions in this organization.
Set the OE: Item Validation Organization profile at the site level for the inventory organization whose master item number you want to use. This profile option indicates the organization that Receivables uses to validate items.
This profile option is visible and updatable at the site level.
Values set at a higher level cascade as defaults to the lower levels. Values set at a lower level override any default from a higher level. For profile options that need to differ at the operating unit level, including OE: Item Validation Organization, OE: Set of Books, and GL: Set of Books, you must set the values at the responsibility level. Oracle General Ledger windows use the GL Set of Books profile option to determine your current set of books. If you have different sets of books for your operating units, you should set the GL Set of Books profile option for each responsibility that includes Oracle General Ledger windows.
For profile options that need to differ at the set of books level, including Sequential Numbering, set the values at the responsibility level.
Profile options specify default values that affect system processes, system controls, and data entry. In a multiple organization
environment you may want to confine the effect to a specific operating unit. Therefore, you may want to change your profile options to be visible and updatable at the responsibility level.
1. MO: Operating Unit = {the users Operating Unit name}
This points the responsibility to the appropriate Operating Unit.
This the profile which holds the value of operating unit org_id when ever user login into system his org_id is value is transfered to profile value base on this profile we get data and put data from databaseUsed primarily in a multiorg environment.
Set the site level to the desired default operating unit.
If there is more than 1 Operating Unit Defined, this profile option must be set at the responsibility level for each responsibility.
Example: Suppose we define a responsibility Purchasing Super User US . Then MO : Operating Unit at this responsibility level determines which Opertaing unit can this responsibility(or the user assigned to this responsibility) acess.
2. OE: Set of Books and GL: Set of Books
Each Responsibility is identified with a set of books using the profile option GL : Set of Books Name, a responsibility can only see the accounting information for that set of books in orcale GL.
3. HR: Business Group
Business Group that is linked to the security profile for a responsibility. This option is used online to control access to records that are not related to organization, position, or payroll.
This option is seeded at Site level with the start-up Business Group. It is view only. Values are derived from the HR:Security Profile user profile option.
HR:Security Profile Restricts access to the organizations, positions, and payrolls defined in the security profile. This option is seeded at Site level with the view-all security profile created for the Startup Business Group. The business group you define appears in the list of values when you set up the HR: Security Profile profile option.
Security Groups
Security groups are a method of partitioning data. When you use the standard HRMS security model, you do not use security groups. The business group is the only data partition. Responsibilities are linked to business groups. Therefore, to access different business groups, users must change responsibilities.
If you want one responsibility to be enabled for more that one business group, you must use Cross Business Group responsibility security. In this model, security groups are defined to partition data within a business group. Multiple security groups can then be linked to one responsibility, even if they partition different business groups. To use security groups you must set the user profile option Enable Security Groups to Yes and run the Multiple Security Groups process.
HR: Cross Business Group
In the Oracle HRMS model, the business group is at the country level and a top organization encompasses all business groups in a company worldwide. People, projects, jobs, and organizations can be located in different business groups for different countries and all information can be shared throughout the enterprise.
Oracle Projects allows the visibility of all business groups to one another. For example, you can search staff resources on projects across business groups, and charge any project across the enterprise for a resource.
You control access to single or multiple business groups by setting the profile option HR: Cross Business Group:
• Set the profile option to Yes to allow cross business group access.
• Set the profile option to No to allow only single business group access.
Share this: