Security on psLens

Permission Lists

Mon, 01 Jan 0001 00:00:00 +0000

Permission Lists

URL: /permissionlists

Permission lists (PSCLASSDEFN, sometimes called classes) are the lowest-level grantable security object. Every menu, component, page, and function authorization attaches to one.

What You Can Do

View Full Definitions: See description, last modified information, and general settings.
View Authorizations: See which menus and components the permission list authorizes.
View Assigned Roles: See which roles include this permission list.
Sign-on Settings: View allowed sign-on times and other access constraints.

When It’s Useful

Auditing what access a particular permission list grants before assigning it.
Incident response: what could a compromised permission list have touched.
Finding permission lists that are overly broad (see also the Full Access Permission Lists report).

Roles

Mon, 01 Jan 0001 00:00:00 +0000

Roles

URL: /roles

Roles (PSROLEDEFN) are named bundles of permission lists. Users get roles, not permission lists directly.

What You Can Do

View Included Permission Lists: See the list of permission lists assigned to the role.
View Assigned Users: See which users are assigned this role.
Metadata Inspection: See the role’s description and last modified information.

When It’s Useful

Understanding what an unfamiliar role grants.
Checking whether a role contains permission lists that are unexpectedly broad.
Finding all users who have a particular role.

Users

Mon, 01 Jan 0001 00:00:00 +0000

Users

URL: /users

Users (PSOPRDEFN, historically called operators) are login accounts. Each carries a set of roles, a primary permission list, a row-security permission list, and a process profile. Search supports both OPRID and name.

What You Can Do

View Assigned Roles: See the roles assigned to a user.
Core Security Attributes: See primary permission list, row security permission list, and process profile.
Account Metadata: View account status (active/inactive), last login, and email address.
Password Settings: See password-related settings (whether a password is set, when it expires).

When It’s Useful

Checking what access a specific user has.
Reviewing user accounts during security audits.
Finding accounts that are inactive but still have broad role assignments.
Investigating who has access to a sensitive area of the system.