I created a Role in ttams2100m000 with full access to all Tables for tc package. Within the same role, I also have "Print/Display" rights for ALL sessions of 'tc' (Session Authorizations by Package). In the "Session Authorizations by Sessions", I specifically said, "Print/Display' rights to the tccom4500m000 session (Maintain Business Partners).
So far so good. I access this session from the Main Menu and the tccom4500m000 has READ-ONLY rights.

The problem is this.. The user has access to the Sales Orders session from his DEM. Within the Sales Order session when he zooms to the Business Partner session (tccom4500m000), It ALLOWS him to create a Business Partner. The tccom4500m000 is NOT present in his DEM anywhere.

Why are the subsessions (tccom4500m000) taking the same authorizations as the Parent session (SO session) when being called from DEM ? What can be done to avoid this ?
Dont the "ttams" authorizations take precedence over the "tgbrg" authorizations ?
In the tgbrg5106m000 session, what is the importance of the "Use Activity Authorizations" check box ?
(It has no effect if used either way)

All help is appreciated. Thanks

LittleJohn

Refer to the thread: "Tools authorization" and the "DEM authorization" (http://www.baanboard.com/baanboard/showthread.php?s=&threadid=9195&highlight=dem)

DEM completely overrides the AMS session authorizations except the "no authorization" setting. If you don't model subsession authorizations in the DEM seperately (which is an administration nightmare), the authorization of the activity applies to all subsessions and sub-subsessions that can be reached from there.

The Enterprise server manuals document it differently, and to let an application layer (and the DEM *is* an application layer for 95% of the companies which would like to use it) override authorizations defined in a system layer is against all accepted rules of technology.

However, Infor believes that this odd software behaviour is correct. I've filed an incident once and all I ever got after lots and lots of discussion with the Infor support was a "will not be fixed, works as specified".

File an incident with the Infor support! The more customers do that, the earlier the developers and product owners responsible for that defect will wake up - hopefully.

Uli

Thanks ! Appreciate all inputs.