+1Hi,
Is there a way to allow a permission set to view the History Log (Ctrl+F9) without granting the Administrator privilege? I've already granted access to the HistoryLog tables and methods, but without the Administrator privilege, the page loads but no data is displayed. This is for IFS Apps 10
Thanks!
Best answer by NickPorter
I don’t believe it is possible within IFS, but even if you could it would be risky from a data access perspective because the contents would not be controlled by user account. What that means is that the person accessing the logs would see ALL of the history logs, which could potentially include data that they should not see such as HR, financial or other restricted items.
You could potentially create an IAL or use some other reporting layer on top of the underlying IFS table/view, and add controls at that level outside of IFS, but that will come with additional headaches.
+18I don’t believe it is possible within IFS, but even if you could it would be risky from a data access perspective because the contents would not be controlled by user account. What that means is that the person accessing the logs would see ALL of the history logs, which could potentially include data that they should not see such as HR, financial or other restricted items.
You could potentially create an IAL or use some other reporting layer on top of the underlying IFS table/view, and add controls at that level outside of IFS, but that will come with additional headaches.
+1I don’t believe it is possible within IFS, but even if you could it would be risky from a data access perspective because the contents would not be controlled by user account. What that means is that the person accessing the logs would see ALL of the history logs, which could potentially include data that they should not see such as HR, financial or other restricted items.
You could potentially create an IAL or use some other reporting layer on top of the underlying IFS table/view, and add controls at that level outside of IFS, but that will come with additional headaches.
Hi Nick,
Thanks for your reply, that makes sense. I checked the HISTORY_LOG view definition and it confirms it:
WHERE lu_name IN (SELECT History_Log_API.Is_View_Available_(lu_name) FROM dual)
AND (Security_SYS.Has_System_Privilege('ADMINISTRATOR') = 'TRUE' OR
username = nvl(rtrim(substr(userenv('CLIENT_INFO'),1,30)),user))
The restriction is built into the view as row-level security. Unless the user has the ADMINISTRATOR system privilege, they only see the log records they created themselves.
Thanks again for the insight!
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
