Skip to main content

I’m looking for some advice around screens in IFS which hold global data. We’re doing a big security review at the moment so want to make sure that we’ve got data managed such that only users in particular companies can see data they’re granted access to through site / company access.

Some examples of the areas where we’ve had to make considerations are:

  • Customers Cheader level & address / contacts], we’re managing this through CRM (we set groups up for each company basically)
  • IALs, we reviewed all the IALs we’ve built in the system to ensure they only point to data for the relevant company
  • Report Archive, we discovered there’s a permission set which a number of users have which allows them to view all reports printed (we’ve since revoked this)
  • Employment Informaiton / People Finder & Suppliers, we’ve accepted these as being global screens but are happy that there isn’t much sensitive data here so minimal level of concern

I was hoping the community might be able to help us come up with ideas of other screens or pieces of functionality we need to consider. Any thoughts would be incredibly helpful for this.

Hi Andy,

Welcome to the IFS community. 

When considering the security of data and screens, I would like to shed some light from technical aspects. In IFS application it could be divided into 3 aspects as per the security framework.


1. Communication security - Encryption,PKI,SET,Firewall

2. Access security
2.1    System Access - Authentication, Security checkpoint, Auditing
2.2    Application Access - Authorization, Permission Set, Administration, Roles, Auditing

3. Content Security - Data Protection, Methods, Backups, Clustering, Antivirus, Archiving, Auditing
 

Apparently your question addresses to the application access within the Access security arena. As per the F1 documentation, IFS Applications architecture enforces a uniform role-based security model across the entire application. 

The role-based authorization model of IFS Applications ensures that only authorized employees have access. Authorization can be performed by function (what can I do?) and data (what ranges of data may I see?).

 

In my opinion, I would see following as some of the key points to consider.
 

1. Users
We could find several types of users in IFS application such as Foundation1 users, Special users, Pre-defined Foundation1 users, and Special users for IFS Aurena native apps(for Apps 10).

Mostly Foundation1 users are able to logon to IFS applications. Most business logic authorization rules are mapped to the Foundation1 User.


2. Permission sets
Permission Sets is the base for administrating authorities in IFS Applications. A Permission Set is a set of permissions which you can grant to users to give them the authority to perform tasks like view or update certain information. T

here are different types of permissions like access to Database Objects, Activities, Services or System Privileges.

 
3. Presentation Objects
Presentation Objects are divided into groups which are represented by the different types of visual entities.

Each Presentation Object gathers grantable objects such as views, database methods and other presentation objects which it is dependent upon. Since a Presentation Object only contain the grantable objects which actually are used, it makes it impossible to accidentally grant permission that the user should not have access to.

Here, I would like to list down the types of Presentation objects, I hope following visual entities would be helpful in identifying some elements to review the security considerations.   

3.1 Windows Forms
These are the normal forms and dialog boxes you see in IFS Enterprise Explorer.

3.2 Reports
Presentation Object related to reports, these includes operation reports and quick reports.

3.3 Lobby Items
Presentation Object used for IFS Lobby elements.

3.4 Other
Some internal structures which can be granted as Presentation Object. This includes

  • Presentation Objects belonging to the core client framework.
  • Global Presentation Objects to store common grants not specifically attached to any windows form.
  • Scheduled Database Task and Chains.
  • Configuration Items, such as Custom Fields and Custom Pages. 

 

4. System Privileges
System privileges are used to grant a user the necessary rights to use a specific functionality, unrelated to data or method authorization. Foundation1 defines five different system privileges:

  • ADMINISTRATOR - This system privilege lets the logged on user act as Appowner, with the exception of method security. 
  • CONNECT - Any user that wants to access IFS Applications through an IFS Client must have Connect system privilege.
  • IMPERSONATE USER - Allow the authenticated user the possibility to impersonate (run as) some other user.
  • DEFINE SQL - Allows the user to enter SQL statements that should be executed by the application through some system service. 
  • DEBUGGER - This privilege gives ability to get server debug stack trace in the IFS Enterprise Explorer debug console

I reckon that it this would be a good point to check. So I would like to add the link to the system privileges documentation.


Foundation1 / Overview / Security / System Privileges https://docs.ifs.com/techdocs/Foundation1/010_overview/210_security/055_system_privileges/default.htm#Granting_system_privileges_to_users


5. Segregation of duties 
Segregation of Duties is a tool to analyze how well the security is setup separating the duties between users. The analysis shows any inappropriate user access and identifies which users that have access to specific functions in the system.

 

I would like to recommend following documentation of security in F1 documentation which is a really good source.

Reference : Foundation1 / Administration Guide / Security 

https://docs.ifs.com/techdocs/Foundation1/040_administration/210_security/default.htm

Depending on your use of IFS, you might also want to consider:

  • Suppliers.  You noted Customers but Suppliers are very similar in terms of not being controlled by Site/Company in terms of viewing them, even though you can control their use in purchasing by Company (Site?)
  • Part Catalog.  Impact may depend on part type (e.g. Manufactured part vs Supplier part)

Nick

Reply


Terms & ConditionsCookie settings