Security and access FAQ
Find questions about users, permission sets, authentication, and access failures. Separate the ability to sign in from permission to run an action or see particular data when investigating a report.
Related learning:
Release note: These answers include IFS Cloud and older IFS Applications topics. Confirm the product and release mentioned in each answer. They are written explanations, not procedures verified in an IFS environment.
Explore other FAQ topics (23)
296 questions · page 1 of 8
A non-administrative user creating new users gets prompted for a database-level password, even though the environment uses single sign-on.
How do we set up automatic user provisioning from an identity provider (SCIM or similar)?
How do we restrict who can post a specific high-risk transaction, like a manual accounting voucher?
Should integrations or reports ever be given direct database-level access instead of going through the API?
How do we assign one specific functional permission to a permission set, rather than a broad predefined role?
During database hardening, we noticed the core application's own Oracle user has read access to an internal Oracle system table it doesn't seem to need.
Can the username/password fields on the Aurena login screen be disabled so users are forced through SSO?
Where do we find guidance on Segregation of Duties (SoD) best practices and what IFS Cloud provides in this area?
How do predefined parameters work when building an Access Control List (ACL) rule that should apply to the current user, rather than a fixed named user?
Outbound network calls to an external analytics domain (like fullstory.com) are observed coming from IFS Cloud pages, with no custom code responsible.
Can access to individual pages within a projection be granted or revoked separately, so a permission set only exposes one specific page rather than everything the projection covers?
A newly added custom action on an existing projection doesn't show up yet in "Manage Grants by Command" to be permission-set-controlled.
Does IFS Cloud log the full request/response payload content for incoming REST API calls, for troubleshooting purposes?
Where is permission-set (method object) grant data actually stored at the database level, if we need to query it directly?
How is the built-in application-owner (IFSAPP) account's password reset if it's forgotten or needs rotating?
Is there a reliable way to see when a user last logged in, beyond what's visible inside the IFS client itself?
Where can a list of which users actually connected to the system over a recent period be found?
What database-level access is actually available on a Managed Cloud install, since the full application-owner account isn't given out?
Is there a way to see failed login attempts in IFS Cloud, not just successful ones?
Can a third-party application authenticate end users with Microsoft SSO directly and then use that token to call IFS Cloud's projection REST APIs while preserving the end user's own permissions?
A permission set needs read-only access to a form overall, but full-control access to just one specific element inside it (like a Communication Method section) that doesn't have its own standalone projection.
A user needs read access to Application Messages (to see failed integration messages) but there's no matching Activity to grant in the Permission Set.
A read-only database account for querying IFS Cloud (like IFSDBREADONLY) can query some views successfully but returns nothing for others, such as a main transactional view versus a related detail view.
Is there a way to find exactly which Permission Set has a specific projection/entity/action combination granted, when going through the Permission Set screens one by one hasn't turned up the source?
Users with certain email domains get an AADSTS50105 error ("application... configured to block users unless specifically granted access") when trying to log in via SSO, while other domains work fine.
Can the default session-idle timeout (the point of inactivity after which a user's session expires) be changed, since the default of 30 minutes feels too short?
A user's Permission Set grants full access to every relevant projection and entity action, yet a specific button (like adding a standard operation to a shop order) still fails with SE_UNAUTHORIZED / "Insufficient privileges."
All of the projections for Aurena B2B appear to be granted in a permission set, yet clicking a specific action (like Configure on a configurable part) still throws a permission error in the B2B portal.
Is there a way to let a user run and view Quick Reports without also being able to modify or delete the report definitions themselves?
When setting up Segregation of Duties (SOD) functional areas, an API method list shows both a plain method name and a similarly-named variant with a trailing underscore — which one should actually be selected?
Users randomly get a 400 BadRequest error when logging into a clustered IFS Cloud environment, inconsistent across devices and not tied to time of day or browser cache.
Users are automatically signed in via SSO without ever seeing a Microsoft account-picker prompt, even though multiple Microsoft 365 accounts might be available — is there an IAM/IFS-side setting to force that account-selection prompt to appear?
A Configuration Context Mapping expression meant to say "apply this context to users NOT in group X" ends up applying (or not applying) inconsistently, working sporadically rather than reliably excluding just that group.
A BPA validation workflow has been added to a Permission Set, but users running it still get SE_UNAUTHORIZED, even though adding the workflow to the permission set should have granted access.
Is there a way to prevent specific users from accessing Page Designer and Navigator Designer, since a general-purpose administrative permission set grants both by default?
Do users who already have a Full User license also need a separate Employee & Manager Self Service (ESS/MSS) license allocated, to access the same self-service pages?
Is there a way to bulk-report which Permission Sets a whole group of specific Projections are granted to at once, rather than checking one projection at a time through the Projection Grant screen?
Can a specific command (like a bound projection action button) be made visible only to users in certain user groups, while the rest of the page stays accessible to everyone?
Login events only show for the current month — is there a way to retain and view them for previous months as well?
No questions match. Try a broader term or reset the filters.