Hello,

I am in the process of developing a custom Insights Dashboard for the expenses module for my agency. I am trying to work through security testing now. I am trying to determine the best way to assign BU level security for the results in the dashboards. Currently, we have the search definition we are using for the dashboard configured to source-level security, with the query security record SP_BUEX_VW assigned to the ex_sheet_hdr record on the BU. (ex_sheet_hdr is a primary record for the query associated with the search definition we are using) My team thinks that this will work in theory, however, me being newer to security, am unsure. The only reason that I am unsure is because, to the best of my understanding, the query is not executed for each different user every time they access the dashboard. This makes me think that a query security record may not be the best option. My understanding of search framework security is that source-level security within the search framework grants users with the appropriate role assignments complete access to all results derived from a specific search definition; it's an all-or-nothing approach that doesn't filter results further. Am I correct on this or am I misunderstanding? If my understanding is on the right path, then I don't believe source-level security will work for us, but maybe I'm wrong?

I explored how the PS delivered expense search definitions were configured from a security standpoint to compare and give myself a better understanding, and they all appeared to have the same structure. The PS delivered security query EX_SRCH_SECURITY_SES_KIB appears to focus on sheet_id and the oprid of the approver of the sheet_id. Essentially, this security query just finds the sheet id and a corresponding approver that can approve the sheet_id, and if you order the query by the oprid of the approver, you can see a list of all sheet_ids that any one oprid can approve. With this understanding.. I don't know if this solution is what my team needs either. We want executives to be able to view high-level TE data for BUs that they have access too.

We need BU level security, not approver oprid security.. if that makes sense. I created a query in a lower environment, let's call it, te_bu_sec_query that selects the oprid, bu, and descr from the SP_BUEX_OPRVW record and joined on the psoprdefn record to get the oprid's emplid and name. Then I went to the connected query and mapped on this te_bu_sec_query on the BU field. Would this approach better solve my needs? I was thinking that this was the approach my business needs, however, am not 100% certain. Like I stated above, the goal of this dashboard is to allow executives access to high-level TE data/insights for BUs that they have access to, and nothing more. We tried the approach in paragraph 1, but am not 100% that will work. Could anyone provide any other guidance or expertise to help me determine best next steps? Like I said, I'm a little new to peoplesoft security so I want to be cognizant of best practices.

Our Releases:

PT: 8.60.13

OpenSearch v 2.3.