Understanding access in Kuali Part II: Roles. Catherine Maddaford Kuali Access Manager Office of the Comptroller

Transcription

1 Understanding access in Kuali Part II: Roles Catherine Maddaford Kuali Access Manager Office of the Comptroller

2 Which Roles? Choosing the correct role is crucial to having access to the processes in Kuali or other related systems. Each role is unique to the process to which it applies. To understand the roles, you need to first understand the process and the workflow related to the process. 2

3 Namespace The Namespace in Kuali is the grouping of roles that work together for a specific system or as part of a component of the system. Each role has a name and other components, and it belongs to a Namespace to help segregate it from other roles in Kuali. Namespace codes can be seen when you view the role membership in the KIM person record. 3

4 Namespace Codes Some example Namespace Codes KFS FP: Financial processing KFS GL: General ledger KFS PURAP: Purchasing/Accounts Payable KFS SEC: Kuali account and org code security KFS SYS: Financial System KC SYS: Kuali Coeus System (TARA) KR KEW: USC KEW Workflow 4

5 Group by Namespace If you view your KIM record (the person record) you can see the namespace code as it appears next to the role number assigned to you. If you view your assigned roles as they relate to the namespace codes it will help you identify what that specific role allows you to do and what are the constraints on those permissions. 5

6 Example Namespace KFS PURAP includes the emarket processes. In the above example, the roles shown are for emarket. Note the small e in front of each role name. 6

7 Security and Roles The KFS SEC namespace code appears next to the roles that work together with other assigned roles to further define how that role works. Note this role is a security definition that works with emarket. The PURAP in front of the Name of the role identifies it as a security definition for one or more Purchasing/Accounts payable processes. You need to understand the role itself to understand the security definition for that role. The security defined in the KFS SEC role can work with more than one role or more than one process. 7

8 Security Definitions The role names for KFS SEC coincide with the security definitions that are being identified in this role. These roles work as Role Qualifiers, telling you the limits and constraints on your permissions as they relate to one or more roles with which they are paired. Security definitions will contain key words, such as Requisitioner or Invoice Exception or Default that will help in identifying with which roles they are being paired. 8

9 ETL Default Def. The ETL Default definition was the first security definition added when account security became a feature of Kuali at USC. ETL came from the process originally used to copy and load the accounts from EFS account security (WEBBA, WebFS) into Kuali account security. When Kuali account security as it now stands was developed and adopted at USC, the old ETL process was eliminated. Adding and deleting accounts now must be requested through the user access request edoc. The default security is by account only, and it applies to the Kuali balance inquiries and most of the account search lookups related to financial processes. It also applies to the GL reports in Business Intelligence (Cognos.) It does NOT apply to all processes in Kuali, since each process can either bypass the default security or it can have its own set of security definitions (such as emarket.) 9

10 Security by Org Code The ETL Default definition is currently designed for accounts only. That means you must define/list each account by the 10 digit account number, or by the 4 or 6 digit account mask. You must be careful that the account masks do not spill over into other org codes. Security identified by organization code is currently available in emarket and in many of the other processes in Kuali. Security by org code means the system allows access to all accounts in that org code for the specified role. Using account masks or org codes in the account security avoids the necessity of updating the security definition when new accounts are added or old accounts are deleted of they fall in that mask or org code. 10

11 What has org security? Processes that use org code security as outlined in a specific security definition. emarket uses org codes for assignment of the user to a department, to view transactions, and for several different types of approvals. CAMS can use either the default definition or org codes for security. Account delegates for DV/DVQE can be by org or by account. Organization review for DV/DVQE. Processes that use org codes as a role qualifier not defined in KFS Security. Pcard reallocation. Pcard estatement business office review. KC award roles. FAA Reviewer. SBO Reviewer (MRD approvals for pcard estatements.) VP approval for DV/DVQE. 11

12 Other Role Qualifiers KFS Security definitions can serve as role qualifiers and will have a separate role number as shown in the KIM record. There are also direct role qualifiers that are part of the actual assigned role. Role qualifiers that are not part of KFS SEC will appear on the KIM record as another row or column, but they will not have a separate role number. Some role qualifiers may be assigned through security definitions but are changed through a process that converts them to another role in KFS SYS. Organization reviewer for DV/DVQE comes from the same definition as the special approver for emarket, but a process assigns it a separate role with the name of Accounting Reviewer, namespace KFS SYS. 12

13 Role Qualifier: Ex. The pcard reallocation process selects the edocs by organization code. The organization code comes from the default account assigned to the pcard. Below is an example of the role qualifier for the pcard reallocation process. Note the one role number and the term Role Qualifier on the second row. 13

14 Roles with no security Some roles have neither a security definition nor a role qualifier. JV initiators and approvers do not have any account or org code security and can create accounting lines for any account. JV accounting lines may need to cross into other areas. The financial and central approvals of the JV provide necessary checks and balances. Some edoc initiator roles allow the user to initiate any edoc without any security because there is another person with a different role that provides the approval. DV initiator. emarket Requisitioner without self approval. 14

15 Types of Approvers There are many types of approvers in the Kuali workflow. A financial approver is approving a transaction that will post to the general ledger, so account or org code security is necessary. emarket financial approvers, various definitions. Fiscal officers or account delegates for DV s and DVQE s. Pcard reallocators and reallocator approvers. A special approver is approving the content of the transaction for various reasons, but is approving in addition to a financial approver. Organization (Accounting) reviewer for DV/DVQE. Special approver for emarket. Business Office Reviewer for pcard. A supervisor approver is approving a transaction for their subordinate, but is approving in addition to a financial approver. DVQE reimbursements are approved by the reimbursee s supervisor. Pcard estatements are approved by the card holder s supervisor. 15

16 Delegating Roles Not all roles can be delegated in Kuali. Fiscal officer delegates to account delegates for DV and DVQE financial approval. Primary account delegate and fiscal officer are paired for approvals, and the secondary delegate is an additional backup for either. There can be only one fiscal officer and one primary delegate per account, but there can be multiple secondary delegates per account, and the delegates can be assigned by account or by org codes. emarket has its own delegation process. Supervisor roles cannot be delegated and only one person can be the supervisor. The default supervisor loads to Kuali from payroll. Changes to the default supervisor can be processed in payroll and will load to Kuali. Changes to a supervisor to be someone other than the default supervisor must be made through a user access request edoc each time. Various approval roles can have multiple members for a specific org/group in order to supply backup for the role. 16

17 Which role applied? Why did you receive the edoc in your action list? Open the route log from your action list using the route log icon. Or view the route log from the route log tab in the edoc. Select show to open and expand the route log. View the Pending Action Requests tab and select Show to expand the tab for more information. The annotation will explain the role and the role qualifier that was used to route the edoc to you. 17

18 Wrong role? If you don t think you should have received the edoc, check your KIM record for any roles that seem to match the annotation. If you have the role and shouldn t, submit a user access request to delete the role and the security or qualifier with it. Be sure to select the right tab and information on the request. If you share the role with someone else, discuss with that person who should take action on the edoc. In most cases only one person needs to take action to move the edoc in workflow. 18

19 Understand the role When you receive an edoc for action, you need to understand the role you are taking as well as the edoc itself. What process is being used and what does it do? If there is a payment or disbursement of funds, who is the recipient of those funds? Is your role some kind of financial approval? If so, verify the account and object codes and amount, and verify that the charge is appropriate for that account. Is your role supervisory? If so, verify that the charge is appropriate for that person. View attachments and receipts, where appropriate to further verify information. Take action in a timely manner. 19

20 More about roles For more information about specific roles and how they work, or how workflow routes to these roles, go to the user guides on the website. Search for the process, such as emarket or DVQE, and then find the user guide and other supplemental information. Call the help desk for further assistance if the user guides do not answer your questions. Attend any required training or view online training where needed. Some training is optional and may help if you have more questions. 20