The information in this manual is designed to answer the following questions:

Transcription

1 Genesis Security Overview This document is concerned with user access security. Genesis User Access Security is designed to be comprehensive and easy to administer. The goal of User Access Security is to control which users have access to which screens, which functions and what data. This document describes how User Access Security is implemented and administered in Genesis. The information in this manual is designed to answer the following questions: What modules, screens, functions and most importantly data does a user have access to? How does Genesis control access to screens, functions and data? How does a System Administrator configure Genesis user access security features? To answer these questions, you must first have an understanding of the components of Genesis Security. These components are described below in Section A - Basics. You must then understand the process by which you create the User Access Security. That is described in Section B - The Process: How User Security is Setup and Administered. A. Basics 1. User Logins A user is anyone who has access to Genesis. Each user is given a User Login, a name and a password that they use to login to Genesis. Each User Login has certain capabilities and these capabilities are conferred by the Roles the User Login is assigned. There is one built-in user login: the System Administration login admin. Users (that is, user logins) are assigned to one or more Schools. When assigning a Role to a User, the Role can be assigned for all schools in the district or only for one school. A User must have at least one Role and can have many there is no built-in limit. In addition, a User can be linked to one or more specific individuals in the District personnel file. These individuals can be identified as a: Teacher Counselor Vice Principal Nurse 2. Roles Genesis confers access to screens, functions and data through the Roles a User Login ( User ) is assigned. This is done by specifying which Securable Locations each Role has access to. Further, the type of access is controlled by a set of Access Permissions and Timeframes on each Securable Location. Roles answer the question What can this type of user 5/31/2006 DRAFT Page 1 of 6

2 do and what data can they see? Some examples of Roles might be: Teacher Grading_Administrator Mass_Scheduling_Administrator Guidance_Counselor 3. Securable Locations A Securable Location is a screen or a set of screens in Genesis. Each one of these Securable Locations represents a function or set of functions that a user has permission to use. But access is more finely controlled than just giving or denying access to a screen or set of screens: Each Securable Location has a set of Access Permissions assigned to it, and each Access Permission can be separately controlled for each of four different Timeframes. Some examples of Securable Locations are: studentdata.studentlist The Student Data Student List screen gradebook.class_rosters The Gradebook Class Rosters screen studentdata.modifystudent Access to all parts of student records all screens underneath the Student Data Modify location. registration.newstudent - The Registration New Student wizard and screens. 4. Access Permissions and Timeframes There are five different Access Permissions Add, Delete, Change, Inquire and Print and four different Time Frames Historical data, Last Year s data, the Current Year s data and Next Year s data. When a Securable Location is set up (by the Genesis development staff), it is defined to have one or more of the Access Permissions. The Genesis System Administrator you then decides, when creating a Role, which of those Access Permissions the Role will have for each of the four different Timeframes. For example, the studentdata.modifystudent.demographics.addresses Securable Location is assigned all five Access Permissions: Add, Delete, Change, Inquire and Print. When setting up this Securable Location for a Role, you must decide which of those Access Permissions this Role can have and for which of each of the four Timeframes. This is all illustrated in Figure 1 below. 5/31/2006 DRAFT Page 2 of 6

3 Securable Locations, Access Permissions and Timeframes Illustrated Setup Security Roles New Role Each item in this list is a Securable Location The header identifies the four Timeframes, and below those, each of the five access Permissions for each Timeframe Timeframes Access Permissions Each Securable Location can but need not have an entry for each Access Permission in each Timeframe. Some Securable Locations only take View and Print permissions. Fig 1 The Setup Security Roles New Role screen illustrating the Genesis Securable Locations, Access Permissions and Timeframes Note that the studendata.modifystudent.demographics.addresses location is identified. 5. Schools Access for a User can be limited to one or several schools. In addition, a User may have access to all schools in the District, but have Roles that are specific to only one school. Access to one or more schools is set up when the User Login is created or modified. 6. District Personnel: Teachers, Counselors, Vice Principals, Nurses and Parents Genesis tracks individuals who have distinct responsibilities in a school. These individuals include: Teachers Individuals who are scheduled to teach classes. Counselors Guidance counselors who meet and work directly with students Vice Principals Individuals that have responsibilities directly related to students, such as discipline. 5/31/2006 DRAFT Page 3 of 6

4 Nurses Individuals who have access to student s medical records and can administer medications, do health screenings and other health related tasks. Parents and Guardians Individuals who have the right to view student s information. Genesis contains information about these individuals in its database. There is a mechanism to link User Logins to the information in the database, so that a User can have access to, for example, a specific Teacher s classes and homeroom. This is described in detail below in Section VIII: Linking Users and Teachers. 7. B. Access vs. Permission Genesis Security prevents users from even seeing tabs that they do not have access to. The tabs are simply missing. Adding a Securable Location to a Role provides access to the screens controlled by that Securable Location: it makes the screens visible to any user assigned the Role. What the user can do on the now visible screen is controlled by the permissions granted to the Securable Location in the Role. As has been explained above, there are 5 types of permission Add, Delete, Change, Inquire and Print and 4 Timeframes in which they can be granted: Historic (2 years ago and earlier), Last School Year, Current School Year and Next School Year. The combination of permission types and Timeframes specifies what the user can do on the screens controlled by a Securable Location. This is explained in detail below. Access = visibility Permissions = capability C. The Process: How User Access Security is Setup and Administered This section covers what you, the System Administrator, need to do to set up User Access Security. First, you must do basic setup of Genesis. Then you must create the security Roles and finally the User logins that are assigned those Roles. However, before you can set up the Roles, you must decide exactly which screens and functions you want each category of user to have access to. Creating the Roles and User Logins ( Users ) is purely technical. Deciding what screens, functions and data you want each user to have access to is the hard part. The technical process of configuring user access security in Genesis has the following steps: 5/31/2006 DRAFT Page 4 of 6

5 1. Install and do the initial setup of Genesis this creates the System Administration login which is used for the following steps of the process. 2. Configure the basic elements of the School District: a. Master District Parameters (Setup Districts Master District Parameters) (See the Genesis Administration: Configuring Your District document) b. Schools and School Parameters (Setup Schools, Setup Schools School Parameters) (See the Genesis Administration: Configuring Schools document) 3. Create a series of Genesis Roles. Each Role confers a set of permissions to view, update and print certain screens, or, more precisely, Securable Locations (See below, Section II). 4. Create User Logins (or, simply, Users), each of which is assigned one or more of the Roles (See below, Section III). Steps 3 and 4 in the above list are covered in this document. To link users to Teacher functions, such as Homeroom (i.e. Daily) Attendance, Class Attendance and Teacher Gradebook, you must also do the following: 5. Add teachers to the District Teachers File (See the Genesis Administration: Teachers document) 6. Link Genesis Users to the configured Teachers via the Setup Security Teacher Assignments screen (See below, Section IV). D. Securable Locations, Access Permissions and Timeframes There are five types of access permissions that can be granted or denied by Securable Location. These permissions are: 1. Add Add access permission for the Securable Location. E.g. the ability to add some item, such as 2. Delete Delete or remove access permission for the Securable Location. 3. Change Change or modify access permission for the Securable Location. 4. Inquire Inquire or View access permission for the Securable Location. 5. Print Print permission for reports related to the Securable Location These five access permissions do not stand alone: in addition, each permission can be granted or denied separately for each of four possible timeframes. The timeframes each identify one or more school years. They are always relative to the current school year. The timeframes are: Historical All School Years Earlier than the Last School Year (e.g., , , ) Prior School Year Last School Year (e.g ) Current School Year Current School Year (e.g ) Next School Year Next School Year (e.g ) 5/31/2006 DRAFT Page 5 of 6

6 E. Roles As described above, Roles are the mechanism Genesis uses to give Users access to screens, functions and data. Roles are clusters of access permissions to Securable Locations. The reason for the Roles mechanism is to avoid having to laboriously set the same set of permissions for many users: A Role is shorthand for a fixed set of permissions. For example, you can create a Teacher Role and assign that to any user to has do to the things teachers do: take attendance, grade courses, use the Gradebook. 1. The Built-In genesis Role The genesis Role is automatically assigned to each User. This Role confers only the ability to login to Genesis. It does not confer access to any screen or function. Additional Roles must be assigned to a User is that User is going to be able to do anything. 5/31/2006 DRAFT Page 6 of 6