WIXLIB

Objects thatmay beimpactedAccess toPredicatePossible OutcomesSAAQUANSelect, Update,Delete, InsertUser will not know if applications for othercolleges exist. They will also be restricted frominsert, updating and deleting question/answersunless the application's college is AS.SOASUPLSelect, Update,Delete, InsertUser will not know if applications for othercolleges exist. They will also be restricted frominsert, updating and deleting additionalapplication information unless the application'scollege is AS.SAAQUIKSelect, Update,Delete, InsertUser will be restricted from inserting theapplication unless the learner's college is AS.SAAEAPSSelect, Update,Delete, InsertUse cannot push electronic application unless theincoming college is AS.SRIPRELSelect, Update,Delete, InsertUser cannot create an application from theelectronic prospect records unless the incomingcollege is AS.RPALAPP,RPAELAP,ROASTAT,RPQLEDGSelectUser cannot view application and decisioninformation.SAASUMISelectUser cannot see applications that do not have acollege AS.SOASRVWSelectUser cannot see applications that do not have acollege AS. SunGard 2004-2008Page 14VBS Using FGAC - Technical

Defining the DomainDomain setup diagramThe diagram represents the setup involved in defining the domain.The tables shown here represent a sampling of the number required for the Admissionsdomain.DomainsDomains define the driver for your VBS rules. Each domain has a driver table for which theVBS rule is written.Note: The domain is usually the parent table of a module. SunGard 2004-2008Page 15VBS Using FGAC - Technical

Naming conventionsBecause the domain table could become very large, you should follow a standard namingconvention for your domains. Preface each domain with the product abbreviation and B,followed by the entity name and VBS.Note: This is the same naming convention that is used for API package names.Examples: SB ADMISSIONS VBS SB CURRICULUM VBSDefining your domainsUsually, you will select the central table for a module or processing area. For reference, itmay be helpful to consult the Entity Relationship Diagrams (ERDs), the Banner TechnicalReference Manuals (TRMs), or the Banner Enlighten Product.ExampleExamples shown in this workbook use the Student TRM on Admissions. SARADAP is thecentral table and is our domain driver. SunGard 2004-2008Page 16VBS Using FGAC - Technical

Banner formUse the FGAC Domain Validation Form (GTVFDMN) to define the domain codes.StepsFollow these steps to define the domain code.1. Access the FGAC Domain Validation Form (GTVFDMN).2. Enter the domain code in the Code field.Examples: SB ADMISSIONS VBS and SB CURRICULUM VBS3. Enter the description.4. Click the Save icon.5. Click the Exit icon. SunGard 2004-2008Page 17VBS Using FGAC - Technical

Banner formUse the FGAC Domain Driver Rules Form (GORFDMN) to enter the domain driver. SunGard 2004-2008Page 18VBS Using FGAC - Technical

StepsFollow these steps to create the domain rules.1. Access the FGAC Domain Code Rules Form (GORFDMN).2. Enter the domain driver in the Domain field.Example: SB ADMISSIONS VBS and SB CURRICULUM VBS3. Enter the driver table.Example: SARADAP for SB ADMISSIONS VBS and SORLCUR forSB CURRICUUM VBS.4. Enter VBS in the Type field for each domain.5. Click the System Required checkbox, if applicable.Note: The system required indicator is usually checked if the row is delivered asSEED data by SunGard Higher Education.6. Click the Save icon.7. Click the Exit icon. SunGard 2004-2008Page 19VBS Using FGAC - Technical

Defining the TablesOverviewEach domain will have at least one table, the driver table. The purpose of the domaintables is to define the launch pad for creating the Oracle policy. The tables defined for adomain carry the same restrictions that are defined for the driver.Example: The domain is for Admissions and the driver is SARADAP. Some of the “children”tables for Admissions are SARCHKL and SARQUAN. When a VBS restriction is built for theAdmissions domain, access to SARCHKL and SARQUAN will be defined by the restriction onSARADAP.The domain tables answer the question of “where else” the VBS restriction should executebesides the domain driver.Tables to includeList the tables that are either children of the domain driver or will follow the samerestrictions as the domain driver. Use the ERD or TRM user guides, or even primary keyand constraints to list all tables that should be included in a domain.Writing the SQLFor each table, write the partial SQL statement that will join the table to the driver table.You will build a piece of a SQL statement that will ultimately be appended to your executingstatement.ExampleTable: SARCHKLDomain driver: SARADAPVBS rule: (SARADAP COLL CODE 1 'AS' OR SARADAP COLL CODE 1 IS NULL)In this example, we are restricting on the college code. SunGard 2004-2008Page 20VBS Using FGAC - Technical

Example of a “normal” queryA normal query to join SARCHKL and SARADAP would be as follows.SELECT 'X' FROM SARCHKLWHERE EXISTS( SELECT 'X' FROM SARADAPWHERE SARADAP PIDM SARCHKL PIDMAND SARADAP TERM CODE ENTRY SARCHKL TERM CODE ENTRYAND SARADAP APPL NO SARCHKL APPL NO)Partial SQLThe partial SQL for the driver SQL join would be as follows.EXISTS( SELECT 'X' FROM SARADAPWHERE SARADAP PIDM SARCHKL PIDMAND SARADAP TERM CODE ENTRY SARCHKL TERM CODE ENTRYAND SARADAP APPL NO SARCHKL APPL NOWhen the predicate is built, FGAC will append the above partial statement to the executingSQL statement, along with the VBS rule (SARADAP COLL CODE 1 'AS.' ORSARADAP COLL CODE 1 IS NULL) SunGard 2004-2008Page 21VBS Using FGAC - Technical

Requirements for setupThe example below shows a breakdown of the pieces required for setup.Note: This does not include the embedded comments that GOKFGAC will add.SQL PredicateSELECT sarchkl pidm, sarchkl admr codeFROM sarchklWHERE sarchkl pidm :pidmAND sarchkl term code entry :term inANDSourceUser executes this SQL queryOracle automatically connectsthe SQL query to the FGACpredicate with an ANDEXISTS ( SELECT 'x' FROM saradapWHERE saradap pidm sarchkl pidmAND saradap term code entry sarchkl term code entry ANDsaradap appl no sarchkl appl noAND ( saradap coll code 1 'AS' ORsaradap coll code 1 is null)The join statement you definedfor the domain table isappendedThe VBS rule coded onGOAFGAC)GOKFGAC concludes thepredicate with ) if necessary SunGard 2004-2008Page 22VBS Using FGAC - Technical

Banner formUse the FGAC VBS Table Rules Form (GORFDPL) to enter the domain tables.Note: If rules are being created for other child tables, they are added here. They arejoined back-to-back to the main driver table using an exists subquery. The trailingparenthesis is left out in the clause since it gets added later when creating the policy. SunGard 2004-2008Page 23VBS Using FGAC - Technical

StepsFollow these steps to enter the domain tables.1. Access the FGAC VBS Table Rules Form (GORFDPL).2. Enter SB ADMISSIONS VBS in the Domain field.3. Enter the table for the rule.4. Check the Active Indicator, if necessary.Note: The Active Indicator is important. You may want to uncheck thisindicator to inactivate all rules for this domain and table. The GOKFGAC processwill not pick up rules for a predicate if this indicator is unchecked. Once youcreate the policy and build the rules, you can check this indicator to activate it.5. In the Driver SQL field, enter the partial SQL statement to join the table to thedomain driver.6. Click the Save icon.7. Click the Exit icon. SunGard 2004-2008Page 24VBS Using FGAC - Technical

Creating Oracle PoliciesIntroductionOnce the domain tables are defined, the policies can be created on the tables. Creating theOracle policies is done for all tables defined in the domain.Running the scriptFollow these steps to create the table policies.1. Connect as BANINST1 to SQLPlus.2. Enter @gfvbsaddpol at the sql prompt.3. You will be prompted for the table name. Enter SARADAP.Note: You can use wildcards, for example, SAR% will pick up all tables inGORFDPL that begin with SAR.Viewing policy dataTo view policy data from SQLPlus select * from dba policies where object name 'SARADAP.Dropping a policyTo drop the policy, run the gfgacdroppol.sql script.Note: This script accepts wildcards for the table name prompt. SunGard 2004-2008Page 25VBS Using FGAC - Technical

About VBS RulesIntroductionThese are the steps to setting up VBS rules. Establish the FGAC Group rule code on GTVFGAC. Set up the Business Profile and assign users to it. Enter the group rule code, domains and the predicate and Users on GOAFGAC. View the resulting predicate for table and User ID on GOIFGAC.The FGAC Group rule code defined on GTVFGAC is meant to be like a header to commonbusiness cases.VBS restrictions and BannerThe diagram shows how the VBS restrictions work with Banner. SunGard 2004-2008Page 26VBS Using FGAC - Technical

Banner formUse the FGAC Group Validation Form (GTVFGAC) to set up the group code.StepsFollow these steps to set up the group code.1. Access the FGAC Group Validation Form.2. Enter the FGAC group code in the Code field.Example: COLLEGEARTSIn this example, we are restricting select, insert, update and delete applicationby college.3. Enter a description.4. Click the Save icon.5. Click the Exit icon. SunGard 2004-2008Page 27VBS Using FGAC - Technical

Establishing the Business ProfilesBanner formYou can enter a business profile for specific users using the FGAC Business Profile ValidationForm (GTVFBPR). SunGard 2004-2008Page 28VBS Using FGAC - Technical

StepsFollow these steps to enter a business profile.1. Access the FGAC Business Profile Validation Form (GTVFBPR).2. Perform an Insert Record function.3. Enter a code for the business profile in the Code field.Example: ARTS&SCIENCES4. Enter a description of the code.Example: College of Arts and Sciences Admissions Users5. Click the Save icon.6. Click the Exit icon. SunGard 2004-2008Page 29VBS Using FGAC - Technical

Assigning User IDs to the Business ProfileBanner formUse the FGAC Business Profile Assignments Form (GOAFBPR) to assign the user IDs to thebusiness profile. SunGard 2004-2008Page 30VBS Using FGAC - Technical

StepsFollow these steps to assign access to specific user IDs.1. Access the FGAC Business Profile Assignments Form (GOAFBPR)2. Enter the appropriate code in the Business Profile field.Example: ARTS&SCIENCES3. Perform a Next Block function.4. Perform an Insert Record function.5. Enter the User ID for whom you want to grant access in the Fine-GrainedAccess User ID field.6. Click the Save icon.7. Click the Exit icon. SunGard 2004-2008Page 31VBS Using FGAC - Technical

Setting up the VBS Group RuleIntroductionUse the FGAC Group Rules Form (GOAFGAC) to set up the predicate for group rules.Using this form, you can enter different predicates for the same domain enter multiple domains with different predicates on the same group rule test your predicate using the validate SQL button inactive all predicates defined in the group rule, or future date a group rule use the help to list tables, columns and operators.Note: Entering different predicates for the same domain may be necessary if differentpopulations have different access requirements. SunGard 2004-2008Page 32VBS Using FGAC - Technical

Banner form SunGard 2004-2008Page 33VBS Using FGAC - Technical

StepsFollow these steps to set up the predicate.1. Access the FGAC Group Rules Form (GOAFGAC).2. Enter the group in the Group field.3. Perform a Next Block function.4. Enter the domain code in the Domain field.Example: SB ADMISSIONS VBS5. Enter the restriction condition in the Predicate field.Example: (SARADAP COLL CODE 1 'AS' OR SARADAP COLL CODE 1 ISNULL )6. Click the Validate SQL button.Note: Selecting Validate SQL will validate the syntax of the sql statemententered.7. Click the Save icon. SunGard 2004-2008Page 34VBS Using FGAC - Technical

Banner formUse the Access to Predicate window of GOAFGAC to define access to the predicate. You willassign the VBS group rule to business profiles and user IDs.Note: You must check Select, Insert, Update or Delete to indicate the accessrestriction. The policy for each of these operations is always created by gfvbsaddpol.sql.Checking these establishes the restriction for the particular group rule and predicate. SunGard 2004-2008Page 35VBS Using FGAC - Technical

Steps - Exercise 1Follow these steps to set up the rule for the Arts and Sciences Office.1. Click the Access to Predicate tab to access the window.Note: You can also select Business Profile Access to Predicate or User Access toPredicate from the Options menu.2. Enter the business profile name in the Profile field.Example: ARTS&SCIENCES3. Enter a description.4. Select the appropriate checkbox(es), based on the access the business profileshould have: Apply to All Users Select: Checking this implies that the restriction is applicable whenevera row is selected from the table. Insert: Checking this implies that the restriction is applicable whenevera row is inserted into the table. Update: Checking this implies that the restriction is applicable whenevera row is updated into the table. Delete: Checking this implies that the restriction is applicable whenevera row is deleted from the table.5. Perform a Next Block function to access the User Access to Predicate block.6. Enter the specific User ID Banner Guest in the User field.7. Select the appropriate checkbox(es), based on the access the user should have.8. Click the Save icon. SunGard 2004-2008Page 36VBS Using FGAC - Technical

Steps - Exercise 2Follow these steps to set up the restrictions on the curriculum table SORLCUR(SB CURRICULUM VBS).1. Click the Group Attributes/Predicate tab.2. Perform a Next Record function.3. In this case, the predicate is: SORLCUR COLL CODE 'AS'4. Click the Access to Predicate tab. Set up the userid banner guest in the useraccess to predicate. SunGard 2004-2008Page 37VBS Using FGAC - Technical

Viewing the RestrictionsIntroductionUse the FGAC Predicate Inquiry Form (GOIFGAC) to display the status of the policy and thepredicate for a table. This allows you to test your predicate and to see what restrictions arein effect for each user ID/table.Banner form SunGard 2004-2008Page 38VBS Using FGAC - Technical

StepsFollow these steps to view the resulting predicate for table SARADAP and User ID.1. Access the FGAC Predicate Inquiry Form (GOIFGAC).2. Enter the User ID and the table name in the key block.3. Perform a Next Block function.Note: The GOKFGAC package embeds comments in the predicate to tell you thedomain name and then the rule names so you can easily trace where the SQL iscoming from.4. Repeat steps for next table SORLCUR.5. Click the Exit icon. SunGard 2004-2008Page 39VBS Using FGAC - Technical

Disabling GOKFGAC FGAC for ProcessesIntroductionBanner JOBS and FORM type objects can be exempted from all VBS and PII FGACprocessing.Banner 7.0 is delivering all JOBS type objects along with FORMs GUIALTI, SOAIDEN,GOAMTCH, FOIIDEN, GOAFPII and GUASYST.Banner formAny object can be made exempt by inserting it on the FGAC Excluded Objects Form(GORFEOB). SunGard 2004-2008Page 40VBS Using FGAC - Technical

StepsFollow these steps to insert an object to be exempt.1. Access the FGAC Excluded Objects Form (GORFEOB).2. Perform an Insert Record function.3. Enter the object that you want exempted.4. Click the Save icon.5. Click the Exit icon. SunGard 2004-2008Page 41VBS Using FGAC - Technical

Self CheckQuestion 1Before building the VBS group rule, a(n) should be completed to fill in allthe pieces that are required for setting up the rule, and to be able to trace its ramifications.This must be done in tandem with the functional Banner Business Analysts at yourinstitution.A. Domain DriverB. Group RuleC. Analysis WorksheetD. Business ProcessQuestion 2A domain is often the central table for a module or processing area.True or False SunGard 2004-2008Page 42VBS Using FGAC - Technical

Question 3Match the Banner form name to its purpose by entering the appropriate letter next to thedescription.Enter the domain driverDefine the domain codes and identify the domain as aVBS typeEnter the domain tablesA. FGAC Domain Validation (G

The table that follows lists the various Banner objects that are impacted by the VBS Group Rule. These need to be analyzed before activating the rule. In this example, even though the VBS rules are on Banner Student tables. In addition to core Banner objects, other components of the Banner U