Company: Link Technologies
Case No: L12147. Project: 12.30: LinkSOFT Version 12.30
Logged By: Sanjay (Link Technologies) on 21 Jan 2021 05:02PM
Priority: High
Product: Framework
Group: Enhancement
Time Taken: 22.50 (Weight: 22.50)
Version: 12.30
Assigned To: Sanjay (Link Technologies)
Circulation: Alvis, Rashna, Sanjay
Resolve By: Friday, 05 February 2021 11:59 PM [1192 days since logged date]
Status: Closed
Subject: Add "user access list" security so one user cannot view all other users without permission
Summary:    

A. Objective:

1. Some users should not be able to allocate a task to any other user. E.g customer using portal should be able to raise a request and create a task without seeing any other user in the system.

2. A user in helpdesk may want to assign a case to another user within their organisation.

3. A company administrator should be able to see all users in the company so support staff can work on any organisation.

4. The system administrator should be able to approve/disapprove any user in the system

 

based on the current design, the following rules should be applied. Using Link-HELPDESK as an example:

5. Alvis & Sanjay should have access to all users in the system because they have access to all 4 companies

6. Sanjeet should be able to see all users with access to company "LBS". No access to Philip and Sitla. Sanjeet can see Alvis because Alvis has access to company LBS.

7. A customer in company LBS should be able to view all users in their organisation

 

B. Design:

Add security below to achieve the above objectives.

1. Can view users in my organisation

2. Can view users that have access to my company

3. Can view all users in the system

Audit Notes:Edited by sanjay on 05/02/21 17:15. Edited by sanjay on 05/02/21 15:15. Edited by alvis on 22/01/21 08:55. 
02 Feb 202105:41PM Comment 1 by Sanjay (Link Technologies) Assigned To: Rashna (Edge Business Solutions) Followup Date: 02-02-2021 09:38 PM Time Taken: 16.00

PART A - Development work for this case has been completed.

1. The change will be available in version:12030.0201

2. The following changes were made(Include Database object names, Program classes and any other relevant information):

  1. Added/Ammended the following new security options:
    1. Can view/manage all users in the system. To manage users assign access to Add/Edit/Delete.
    2. Can view/manage users in my Organisation. To manage users assign access to Add/Edit/Delete. Organisation is assigned in the "User Maintenance" form.
    3. Can view/manage users in my Primary company. To manage users assign access to Add/Edit/Delete. "Primary Company" is assigned in the "User Maintenance" form.
    4. Can view/manage users who have access to my "Logged In" company. To manage users assign access to Add/Edit/Delete.
  2. The security options are self explanatory

3. Affected Areas:

  1. User Access across the application especially Helpdesk

4. The issue was caused by:

  1. Improve Security

5. Notes
6. Next Step
: UAT

----------------------

PART B - Development Reference:

1. Changes implemented was according to the approved design (Y/N):

2. Variations to the approved design:


03 Feb 202104:07PM Comment 2 by Rashna (Edge Business Solutions) Assigned To: Sanjay (Link Technologies) Followup Date: 03-02-2021 07:21 PM Time Taken: 1.00
QA Results
Tests carried out according to requirements specified on the case header

Test Results Summary

Table 1 - Summarised list of issues
NoTest DescriptionPass/Fail
1
Enable the access for the rule "FR619 Can view/manage users in my Primary company. To manage users assign access to Add/Edit/Delete."
  1. Log in as admin, the primary company for the user is 1001.
  2. Admin should only use see users with the primary company as 1001.
  3. Admin should not be able to see user TPA or assign tasks has as the primary company is1003 for the user

Pass
2

Enable the access for the rule "FR618 Can view/manage all users in the system. To manage users assign access to Add/Edit/Delete."

  1. The admin should be able to see all 135 users and assign tasks to the users.
Pass
3
Enable the access for the rule  "FR617 Can view/manage users who have access to my "Logged In" company".
  1. For the user, E074 enable company access for company 1005.
  2. Log in as the administrator into company 1001.
  3. The administrator should not be able to view the user details or assign tasks to user E074
  4. For user, A017 enable company access for company 1001 and 1005.
  5. Log in as the administrator in company 1001.
  6. The administrator should be able to view the user details or assign tasks to user A017


Pass
4

Create a new Organisation "EBS" and assign EBS to user E013 and E019

Enable the access "FR616 Can view/manage users in my Organisation. To manage users assign access to Add/Edit/Delete" only.

  1. Log in as admin, the organization for admin is 1001.
  2. We should not be able to see the user details for E013 and E019 as their organization is EBS
  3. But the admin should see the other users eg A006 as the organization for A006 and admin is 1001.

Fails.

When the admin logins we can only see the user details of the admin


Environment Details

  1. OS version: Windows Server 2012
  2. Application version: 12.30.0201BETA
  3. Setup: Demo
  4. Server : 10.0.0.14
  5. Database: LINKSOFT-DEMO-123

Next Step

  1. For Review

    04 Feb 202111:28AM Comment 3 by Sanjay (Link Technologies) Assigned To: Rashna (Edge Business Solutions) Followup Date: 04-02-2021 02:56 PM Time Taken: 2.00

    PART A - Development work for this case has been completed.

    1. The change will be available in version:12.30.0204

    2. The following changes were made(Include Database object names, Program classes and any other relevant information):

    1. Changed the user list to show all users in the same organisation when the user has view access to organisations.

    3. Affected Areas:

    1. User List

    4. The issue was caused by:


    5. Notes: Refer to the scenario below: Alvis has access to view users in my organisation.

    user: Alvis
    organisation: Link Technologies in company INFO
    Organisation: Edge in company EBS

    user: Sanjay
    organisation: Link Technologies in company INFO
    Organisation: Link Technologies in company EBS

    user: Rashna
    organisation: Edge in company INFO
    Organisation: Edge in company EBS

    1. When Alvis logs into company INFO, he will see users: Alvis, Sanjay in menu "user maintenance"
    2. When Alvis logs into company EBS, he will see users: Alvis, Rashna menu "user maintenance"


    6. Next Step

    ----------------------

    PART B - Development Reference:

    1. Changes implemented was according to the approved design (Y/N):

    2. Variations to the approved design:


    05 Feb 202103:12PM Comment 4 by Rashna (Edge Business Solutions) Assigned To: Alvis (Link Technologies) Followup Date: 05-02-2021 07:00 PM Time Taken: 1.50
    QA Results
    Tests carried out according to requirements specified on the case header

    Test Results Summary

    Table 1 - Summarised list of issues
    NoTest DescriptionPass/Fail
    1
    user: Alvis
    organisation: Link Technologies in company INFO
    Organisation: Edge in company EBS

    user: Sanjay
    organisation: Link Technologies in company INFO
    Organisation: Link Technologies in company EBS
    1. When Alvis logs into company INFO, he will see users: Alvis, Sanjay in the menu "user maintenance"

    Fails when I log in as Alvis in company InFO -  I can only see the user details for Alvis.

    Steps

    1. Created a user as AlvisC. Password 1234
    2. Role - Employee Self Serve.
    3. Enabled rule "FR616" for the role.
    4. Did the user setup as per the "Test Description". 
       

    Environment Details

    1. OS version: Windows Server 2012
    2. Application version: 12.30.0204BETA
    3. Setup: Demo
    4. Server : 10.0.0.14
    5. Database: LINKSOFT-DEMO-123

    Next Step

    1. For Review

      05 Feb 202103:46PM Comment 5 by Sanjay (Link Technologies) Assigned To: Rashna (Edge Business Solutions) Followup Date: 05-02-2021 07:15 PM Time Taken: 1.00 Notes: ETC extended from: 28/01/2021 to 05/02/2021

      PART A - Development work for this case has been completed.

      1. The change will be available in version:12.30.0205

      2. The following changes were made(Include Database object names, Program classes and any other relevant information):

      1. The changes were not included in build 12.30.0204.

      3. Affected Areas:


      4. The issue was caused by:


      5. Notes
      6. Next Step
      : UAT

      ----------------------

      PART B - Development Reference:

      1. Changes implemented was according to the approved design (Y/N):

      2. Variations to the approved design:


      05 Feb 202105:15PM Comment 6 by Sanjay (Link Technologies) ETC was changed from 05/02/2021 to 05/02/2021
      08 Feb 202104:06PM Comment 7 by Rashna (Edge Business Solutions) Assigned To: Sanjay (Link Technologies) Followup Date: 08-02-2021 07:11 PM Time Taken: 1.00
      QA Results
      Tests carried out according to requirements specified on the case header

      Test Results Summary

      Table 1 - Summarised list of issues
      NoTest DescriptionPass/Fail
      1
      user: Alvis
      organisation: Link Technologies in company INFO
      Organisation: Edge in company EBS

      user: Sanjay
      organisation: Link Technologies in company INFO
      Organisation: Link Technologies in company EBS
      1. When Alvis logs into company INFO, he will see users: Alvis, Sanjay in the menu "user maintenance"

      Pass

      2
      user: Alvis
      organisation: Link Technologies in company INFO
      Organisation: Edge in company EBS
      user: Rashna
      organisation: Edge in company INFO
      Organisation: Edge in company EBS
      1. When Alvis logs into company EBS, he will see users: Alvis, Rashna menu "user maintenance"

      Pass

      Environment Details

      1. OS version: Windows Server 2012
      2. Application version: 12.30.0204BETA
      3. Setup: Demo
      4. Server : 10.0.0.14
      5. Database: LINKSOFT-DEMO-123

      Next Step

      1. For Review

      12 Feb 202101:24PM Comment 8 by Sanjay (Link Technologies) Assigned To: Sanjay (Link Technologies) Followup Date: 12-02-2021 05:24 PM
      Thanks Rashna

      If you have any queries regarding this support incident, please email admin@linktechnologies.com.au and include the Case No: L12147 in the subject line of all emails regarding this issue.

      Document size: 32.2 KB
      For call complaints, please contact the Managing Director of the company using this form