SOX compliant roles and user security

afleet

hello folks, as part of building sox compliant roles, we need to create a role (say, USER ADMIN) that, if given to a particular user, will allow them to:

a) insert/update/delete a user
b) insert/update/delete a role
c) assign/unassign roles to other users.
d) assign table/form/object access rights to roles.

This may sound a little strange, but that's what we need to achieve. A user with a role other than SUPER needs to do this.

we've had success creating other functionality-specific roles, eg GL POST, CUSTOMER MASTER MAINTENANCE, VENDOR MAINTENANCE, and we've done this by starting off with a role with no rights, and iteratively assigning rights as we attempt to perform the tasks in question, and noting which rights are required as they fail.

Crude, but effective.

This approach does not seem to work with user admin. If we throw any table or form that seems by name to be user related or security rated at this new USER ADMIN role, the result is still the same. The submenu items under the Tools... Security menu are still greyed out.

Can anyone point us in the right direction?

kine

There is one special role for this: SECURITY

If some user have this role, he can create, modify, delete users, give them roles, but he can assign only roles he himself is member (for example he is not able to assign role super to someone, if he is not SUPER user...). I am not sure, if this role include changing permissions for the roles...

Do not forgot, that access to the menu is driven by System type permissions (not table, datatable but system)...