PeopleSoft Permission List Queries

1. Component Permission List Query:
This query identify the permission lists and its description associated with component.

SELECT   menu.menuname, compdfn.pnlgrpname, auth.classid permission_list,
CLASS.classdefndesc permission_desc
FROM psauthitem auth,
psmenudefn menu,
psmenuitem menuitm,
pspnlgroup comp,
pspnlgrpdefn compdfn,
psclassdefn CLASS
WHERE menu.menuname = menuitm.menuname
AND menuitm.pnlgrpname = comp.pnlgrpname
AND compdfn.pnlgrpname = comp.pnlgrpname
AND compdfn.pnlgrpname LIKE UPPER (:component_name)
AND auth.menuname = menu.menuname
AND auth.barname = menuitm.barname
AND auth.baritemname = menuitm.itemname
AND auth.pnlitemname = comp.itemname
AND auth.classid = CLASS.classid
GROUP BY menu.menuname, compdfn.pnlgrpname, auth.classid, CLASS.classdefndesc
ORDER BY menu.menuname, compdfn.pnlgrpname, permission_list;

2. Content Reference accessed by a permission list:

This query identifies Content references accessed by Permission List.

SELECT   a.portal_label AS PORTAL_LINK_NAME, a.portal_objname, a.portal_name, a.portal_reftype
FROM psprsmdefn a, psprsmperm b, psclassdefn c
WHERE a.portal_reftype = 'C'
AND a.portal_cref_usgt = 'TARG'
AND a.portal_name = b.portal_name
AND a.portal_reftype = b.portal_reftype
AND a.portal_objname = b.portal_objname
AND c.classid = b.portal_permname
AND a.portal_uri_seg1 <> ' '
AND a.portal_uri_seg2 <> ' '
AND a.portal_uri_seg3 <> ' '
AND c.classid = :permissionlist
AND a.portal_name = :portalname
ORDER BY portal_label;

FRMT = Frame Template

HPGC = Pagelet

HPGT = Homepage Tab

HTMT = HTML template

LINK = Content Reference Link

3. Page Access By Permission List:

SELECT b.menuname, b.barname, b.baritemname, b.pnlitemname AS pagename,
       c.pageaccessdescr,
       DECODE (b.displayonly, 0, 'No', 1, 'Yes') AS displayonly
  FROM psclassdefn a, psauthitem b, pspgeaccessdesc c
WHERE a.classid = b.classid
   AND a.classid = :1
   AND b.baritemname > ' '
   AND b.authorizedactions = c.authorizedactions;

4. PeopleTools Accessed By a Permission List:

SELECT DISTINCT b.menuname
FROM psclassdefn a, psauthitem b
WHERE a.classid = b.classid
AND (   b.menuname = 'CLIENTPROCESS'
OR b.menuname = 'DATA_MOVER'
OR b.menuname = 'IMPORT_MANAGER'
OR b.menuname = 'APPLICATION_DESIGNER'
OR b.menuname = 'OBJECT_SECURITY'
OR b.menuname = 'QUERY'
)
AND a.classid = :PermissionList;

5. Roles Assigned to a Permission List:

SELECT b.rolename, b.classid AS permission_list
FROM psclassdefn a, psroleclass b
WHERE a.classid = b.classid AND a.classid = :permissionlist;

6. User IDs assigned to a Permission List:

SELECT   c.roleuser AS USER_IDs
FROM psclassdefn a, psroleclass b, psroleuser c
WHERE a.classid = b.classid
AND b.rolename = c.rolename
AND a.classid = :permissionlist
GROUP BY c.roleuser;

Department Security Tree and Query Security

Always create a department security tree with the name "DEPT_SECURITY" as it is hardcoded in various views and very important in implementing Row level security. If this naming is not followed then departments under newly created tree will not be available while setting up the security on "Security by Dept Tree" page.

Query Security:

 

• PeopleSoft Query uses query access group trees to control the access of the tables in the PeopleSoft database.
• You create and update query access group trees using Query Access Manager.
• You should create query access group trees based on your organization’s needs and on any customizations you’ve made.

 

Relationship between row-level security and Query security record definitions:

 

• PeopleSoft applications implement row-level security by using a SQL view that joins the data table with an authorization table.

 

• To apply row level security:
• Open the record on which you want to apply row-level security. Click the Properties button, and select the Use tab from the Record Properties dialog box.
• Select the security record definition (usually a view) in the Query Security Record list box.

 

• Row-Level (Data Permission) Security Views:

1. Using PeopleSoft row-level security views enables you to restrict users from seeing certain rows of data.
2. You can restrict data by:

1. User, by using the OPRID field.

2. Primary permission list, by using the OPRCLASS field.

3. Row security permission list, by using the ROWSECCLASS field

3.             3.   To implement row-level security through a security view:
1. In Application Designer, insert one of the three row-level security fields(OPRID, OPRCLASS, ROWSECCLASS) into the record definition.
2. Configure the field as a Key, but not a List Box Item.
3. Save the record and build the view.
4. Use the record as the search record or query security record.

• Steps for creating query security record:

          1. Create a view depending on your security need.

 

Example: create a view which has oprid, rowsecclass and the parent key field and in sql editor write the following sql:

 

SELECT DISTINCT opr.oprid,
                opr.rowsecclass,
                dtl.t_cust_id FROM   psoprdefn opr,
       ps_t_sjt_class cls,
       ps_t_sjt_class_dtl dtl WHERE  cls.rowsecclass = dtl.rowsecclass
       AND cls.t_cust_id = dtl.t_cust_id
       AND opr.rowsecclass = cls.rowsecclass 

 

2. Attach the above view to the record in record properties (query security record).

 

3.            3. Grant security to that record to which the query security view is attached.
4.            4. In PIA, traverse to query access manager (Oracle PS Tools ->people tools –> Query  Security -. Query Access Manager). Then CLICK ON CREATE NEW TREE.

 

 

5. 5. If access group is already present, then search for that access group in the prompt. 
6. 6. If you want create a new access group then enter the access group name and PRESS ENTER, it will be redirected to the below page where you can create your own access group.       
   
7. 7. Then insert the child records to the access group.

 

step 7.1

Step 7.2   

Step 7.3

 

8. 8. Go to permission list and traverse to query. (People Tools -> Security -> Permission & Roles -> Permission list (Select the permission list)).

 

9. 9. In access group permissions, assign the tree name and access group.

 

 

10. 10. In query manager, add the record to which the query security view is attached.

 

 

NOTE: You should consider adding record definitions to the query trees in a hierarchy that matches the parent/child relationship of records in your database.

Move and Delete files using PeopleCode

Move and Delete files using PeopleCode

We can use the below java object and code to move or deleting files from some location.
Moving file:

Local JavaObject &source = CreateJavaObject("java.io.File", "/source/file.txt");
Local JavaObject &target = CreateJavaObject("java.io.File", "/target/file.txt");

&source.renameTo(&target); 

Deleting file:

Local JavaObject &DelLoc = CreateJavaObject("java.io.File", "/source/file.txt");

&DelLoc.delete(); 

Alternate code for deleting file:

&tmpfile = GetFile(“c:\temp\file.txt”, “W”, “A”, %FilePath_Absolute);
&tmpfile.Delete();

Accessing Application Package class object using CreateObject method.

Let’s say we have 2 application package.

1. UserID and

2. Notification.

Here Notification application package uses dynamic changing application package say based on setup.

For our example we are using UserID application package as setup driven application package and it has UserID as Class.

Structure of UserID application package.

class UserID
   method GetOpridsByApplicationPack() Returns array of string;
   property array of string oprid_arr;
end-class;

method UserID
  
end-method;

method GetOpridsByApplicationPack
   /+ Returns Array of String +/
   
   %This.oprid_arr = CreateArrayRept("", 0);
   Local string &SupervisorId, &ReportsTo;
    
   %This.oprid_arr.push('PS'); /* Logic to populate data in array. */

   Return %This.oprid_arr;

end-method;

Below is “Notification” application package structure. 

In this application package we are using CreateObject to access “GetOpridsByApplicationPack” method of UserID class of UserID application package . 

We are passing Package name and Class Name while calling so they are variable for us. (In this case its UserID and UserID). 

class NotificationManager
method GetOpridsByApplicationPack(&PkgRoot As string, &Appcls_Path As string) Returns array of string;

end-class;

method NotificationManager

end-method;

method GetOpridsByApplicationPack
   /+ &PkgRoot as String, +/
   /+ &Appcls_Path as String +/
   /+ Returns Array of String +/
   Local array of string &aryOpridTo;
   Local string &Classname;
   Local object &u;
   &aryOpridTo = CreateArrayRept(" ", 0);
   &Classname = &PkgRoot | ":" | &Appcls_Path;
   &u = CreateObject(&Classname);
   ObjectDoMethod(&u, "GetOpridsByApplicationPack");
   &aryOpridTo = &u.oprid_arr;
   Return &aryOpridTo;
end-method;

Object–Based PeopleCode

What is Object – Based PeopleCode:

• Introduced in PeopleTools 8
• Evolution of procedural-based PeopleCode
• Provides for complex object definitions
• Overcomes procedural data scope limitations
• Similar to Visual Basic notation
• Interpreted (like VB)
• Not completely object oriented (like C++), but it’s getting there!
• Does not support polymorphisms
• Does support multiple inheritance
• Backwards compatible

Why do we need Object Based PeopleCode:

• Greater ability to write generic code
• Release 8 Integration
                       1. Component Interface
                       2. Application Messaging
                       3. Business Interlinks
• Ability to define custom classes (Release 8.4)
                       1. Application Classes/Packages
                       2. Replaces FUNCLIB Processing

Advantage of Object and Methods:

• Tight code
• Syntax is validated*
• No or low maintenance required

Object – Based PeopleCode Rule:

• DECLARE the object
• INSTANTIATE the object

Object–Based Code to avoid use of SQLEXEC

Below code can be used to avoid use of SQLExec.

SQLExec Code:

SQLExec to copy a row from ORD_HDR to ORD_HDR_EXT.

&ORD_NO = &NEW_ORD_NO;

SQLExec("select %timeout(order_dt), training_loc, vendor_cd, order_status, status_dt, deliver_method from ps_ord_hdr
where order_nbr = :1", &ORD_NO, &ORD_DT, &TRAIN_LOC,&VEND_CD, &ORD_STAT, &STAT_DT, &SHIP_VIA);

SQLExec("delete from ps_ord_hdr_ext where order_nbr = :1", &ORD_NO);

SQLExec("insert into ps_ord_hdr_ext (order_nbr, order_dt,training_loc, vendor_cd, order_status, status_dt,
deliver_method) values(:1,%datein(:2),:3,:4,:5,:6,:7)",&ORD_NO, &ORD_DT, &TRAIN_LOC, &VEND_CD, &ORD_STAT, &STAT_DT,&SHIP_VIA);

Same logic using Object Based code:

Local Record &REC1, &REC2;
&REC1 = GetRecord(RECORD.ORD_HDR);
&REC2 = CreateRecord(RECORD.ORD_HDR_EXT);
&REC1.ORD_NO = &NEW_ORD_NO;
&REC1.SelectByKey();
&REC1.CopyFieldsTo(&REC2);
&REC2.Delete();
&REC2.Insert();

Hiding Delivered Buttons based on condition

One way to hide PeopleSoft delivered component events buttons (Save, ReturnToList, Add, UpdateDisplay…. etc.) by using JavaScript. Follow the below steps to hide the delivered buttons.

This way can be used if we have Many pages in component and we don’t want delivered buttons on some pages. Here are steps.

Step1: Place HTML area in page and assign derived and work record (Say: HIDE_WRK)and field (Say: HTMLAREA) to it.

Create HTML Definition(Say: HIDE_BT_HTML) and Add following JavaScript.

<input type="hidden" name="USERJSINJECTION" value=""/>
<script type="text/javascript">
function addLoadEvent(func) {
  var oldonload = window.onload;
  if (typeof window.onload != 'function') {
   window.onload = func;
  } else {
   window.onload = function() {
     oldonload();
     func();
   }
  }
}
 
function appsDisablePTControls() { 

var aPTButtons = ['#ICSave', '#ICList', '#ICNextInList', '#ICPrevInList', '#ICSendNotify', '#ICNext', '#ICSpellCheck', '#ICRefresh', '#ICAdd', '#ICUpdateAll', '#ICCorrection', '#ICUpdate']; 

appsDisableTable(aPTButtons,true); 
} 
function appsDisableTable(aPTControls,bButtons) { 

var aControls, oTableNode; 

var bFound = false; 

var i=0; 

while (i < aPTControls.length && !bFound) 

{ 

aControls = document.getElementsByName(aPTControls[i]); 

if (aControls != null && aControls.length > 0) 

{ 

oTableNode = aControls[aControls.length-1].parentNode.parentNode.parentNode.parentNode; 

if (oTableNode != null && oTableNode.id != 'RBTBHEADER' && oTableNode.id != 'RBTBFOOTER') 

{ 

if (bButtons) 

oTableNode = oTableNode.parentNode; 

oTableNode.style.display='none'; 

bFound = true; 

} 

} 

i++; 

} 
} 
addLoadEvent(function() {
  %bind(:1)
});
</script>

Then assign the following code to Page Activated event:

HIDE_WRK.HTMLAREA.Value = GetHTMLText(HTML.HIDE_BT_HTML, "appsDisablePTControls()");

Note: Refer the post for how to use Html Area: http://pawan-mundhra.blogspot.com/2011/05/run-javascript-on-your-peoplesoft-pages.html