Security

The security model used by the system integrates the different components of the system architecture, controls who can access the system, and defines the actions that system users can perform.

Using security features, you can configure system login behavior, define password strategies, create and maintain users and roles, as well as specify user access to domains and entities.

The guiding rule in role-based security is that access to a resource is not allowed unless it has been specifically granted. Role-based security features let you control user access to all menu-based application resources, as well as some resources that represent activities that are not directly accessed from the menu.

• Standard programs, which display on the system menu as a single maintenance function. Standard programs are available in both the .NET User Interface ((UI) and character interface.

• Component-based functions, which display on the system menu as items with one or more associated activities. A component-based function is always associated with an activity or multiple activities. Component-based functions are available only in the .NET UI.

Using the login security features, you can secure your system from unauthorized users, as well as optionally implement single sign-on to improve ease of access for system users.

You also can configure additional types of security that provide enhanced protection for individual database records, fields, sites, GL accounts, and so on.

Note: If you intend to use other components of the QAD Enterprise Application Suite that communicate with core functions through APIs—for example, QAD QXtend Outbound (QXO)—a system administrator must configure security for these add-on products appropriately. These security details are included in the relevant product documentation of the other components.

When a user logs in, the system determines the programs or functions to display on the application menu based on the user’s roles in the current domain and entity. This occurs in exactly the same way regardless of whether login is from the character user interface or the .NET UI.

Important: The various system security controls are primarily effective within an application session. The system database should be protected from any unauthorized access, not just access from within an application session. Additional controls should be considered to prevent compromise of system data using other means. See Operating System and Progress Security for details.

During an application session, several different types of security operate at the same time.