CHRS Knowledge Base

Security Dynamic Roles

Updated on

Last Revised: 01/08/2025

Confidentiality Statement

This document has been checked and screen shots do not contain any confidential information (staff names, addresses, social security numbers).

Table of Contents

1.0 Dynamic Roles

1.1 Dynamic Role Publish

2.0 Recruiting

3.0 Workforce Administration

3.1 Workforce Administration Role - CHR_SS_Employee_All

3.2 Workforce Administration Role - CHR_SS_Inactive_Employee

4.0 Absences Management

4.1 Absences Management Role - CHR_AM_Employee_All

This role will be automatically assigned to employees who have at least one active position that is eligible for absences. The role will be automatically removed when the employee no longer has any positions enrolled in absence management

4.2 Absences Management Role - CHR_AM_Approver

4.3 Absences Management Role - CHR_AM_No_Leave_Taken

The role will be provision when the criteria are met and deprovison when any of the criteria are not met

4.4 Absences Management Role - CHR_AM_NLT_Approver

5.0 Time and Labor   

5.1 Time and Labor Role - CHR_TL_Timesheet_Employee

The role will be provision when the criteria are met and deprovison when any of the criteria are not met

5.2 Time and Labor Role - CHR_TL_Approver

The role will be provision when the criteria are met and deprovison when any of the criteria are not met

6.0 Benefits

6.1 Benefits Role - CHR_SS_BENEFITS_FL_CL_VIEW32

6.2 Benefits Role - CHR_SS_BENEFITS_FLUID_ALL

7.0 Labor Cost Distribution (LCD)

8.0 Temporary Academic Employment TAE

9.0 PeopleSoft Advance User

    

1.0 Dynamic Roles

Dynamic role rules in CHRS are defined or coded using PeopleSoft Query, PeopleCode, or the Lightweight Directory Access Protocol (LDAP) directory. We have specifically chosen to utilize the Query Rule Enabled and PeopleCode Rule Enabled (Recruiting Only) feature for several security roles in CHRS. When the specified rules are met, these roles will be automatically provisioned to users.

Conversely, when the rules are no longer met, the roles will be deprovisioned from the users' profiles.

Dynamic Roles tab
Dynamic Roles rule field

1.1 Dynamic Role Publish

The application engine program DYNROLE_PUBL is responsible for assigning dynamic roles based on the query logic that retrieves a list of operator IDs. The DYNROLE_PUBL batch job will be centrally managed by CMS and scheduled to run hourly from 4 am to 8 pm, Monday to Friday.

To view the dynamic roles assigned to a user, you can navigate to the user profile page and access the roles tab, where they will be displayed along with other roles.

  • A comprehensive list of user IDs assigned to a dynamic role can be found on the Roles page, specifically under the Dynamic Members tab.

2.0 Recruiting

The Recruiting dynamic role does not grant access to PeopleSoft pages. Instead, it is used for provisioning and deprovisioning access specifically for the PageUp system. Each user profile should only be assigned one Recruiting role. CMS manages a nightly process to retrieve the users assigned to these roles for PageUp. This process occurs from Sunday through Thursday at 5:30 pm. The recruiting dynamic role will use the PeopleCode Rule Enabled function that will allow campus-specific query role.

  • There are 22 Recruiting roles have been defined to using the PeopleCode Rule Enabled configuration.  
    • All 22 roles need to be configured to use PeopleCode Rule Enabled.
      • Under PeopleCode Rules
      • Record: CSU_FUNCLIB_RS
      • Field Name: ROLENAME Event: FieldFormula
Recruiting Roles (22)
CSURSPUApproveClassComp CSURSPUTDeptAdminII
CSURSPUApprover CSURSPUTDeptAdminIII
CSURSPUApprover-Budget CSURSPUTHMI
CSURSPUCompliance CSURSPUTHMII
CSURSPURecruiterI  CSURSPUTHMIII
CSURSPUSearchChairI  CSURSPUTHMIV
CSURSPUSearchChairII  CSURSPUTHRPartnerI
CSURSPUSearchCommitteeI  CSURSPUTHRPartnerII
CSURSPUSearchCommitteeII  CSURSPUTHRPartnerIII
CSURSPUTApproverBudget  CSURSPUTLeadRecruiter
CSURSPUTDeptAdminI  SURSPUTRecruiterII

Function: each role has their own function name as below.

Role Name Function

Role Name Function
CSURSPUApproveClassComp Get_ApvClassComp
CSURSPUApprover Get_Approver
CSURSPUApprover-Budget Get_AppvBudget
CSURSPUComplianceFacilitator Get_CompFacil
CSURSPURecruiterLimited Get_RecruitLimit
CSURSPUSearchCommitteeChair Get_SrchChairIRole
CSURSPUSearchCommitteChairPlus Get_SrchChairIIRole
CSURSPUSearchCommitteeMember Get_SrchCmmitIRole
CSURSPUSearchCommitteewCompile Get_SrchCmmitIIRole
CSURSPUTApproverBudget Get_BudgetAppv
CSURSPUTDeptAdminLimited Get_DeptAdmIRole
CSURSPUTDeptAdminBaseline Get_DeptAdmIIRole
CSURSPUTDeptAdminPlus Get_DeptAdmIIIRole
CSURSPUTHiringManagerLimited Get_HirMgrIRole
CSURSPUTHiringManagerBaseline Get_HirMgrIIRole
CSURSPUTHiringManagerPlus Get_HirMgrIIIRole
CSURSPUTHMPlusConfidentialDocs Get_HirMgrIVRole
CSURSPUTHRBusinessPartnerLimit Get_HrPtnrIRole
CSURSPUTHRBusinessPartnerBase Get_HrPtnrIIRole
CSURSPUTHRBusinessPartnerPlus Get_HrPtnrIIIRole
CSURSPUT Lead Recruiter Get_LeadRecruit
CSURSPUT Recruiter Baseline Get_RecruiterII
  • Campuses will be responsible for creating queries with their own criteria to meet their specific needs. We have established the following guidelines for campuses to follow when creating queries.
  • Campuses are required to create queries with a dedicated name, including a campus prefix.
Role Name Query Name
CSURSPUTHRPartnerIII CSURSPUTHRPARTNERIII
CSURSPUTDeptAdminIII CSURSPUTDEPTADMINIII
CSURSPUTHMIII CSURSPUTHMIII
CSURSPUSearchChairII CSURSPUSEARCHCHAIRII
CSURSPUSearchCommitteeII CSURSPUSEARCHCOMMITTEEII
  • EXAMPLE: Dedicated Query Name:
    • ST_CSURSPUSEARCHCHAIRII
    • FL_CSURSPUSEARCHCHAIRII
  • The prefix is coming from first two characters of the campus Business Unit. (STCMP, FLCMP)
  • For campuses that choose to use the baseline view record 'CSU_SEC_RS_REGU' to build their campus-specific query, the SQL logic is designed to exclude anyone who already has a CSURSPU% role from being assigned the dynamic role. Below is the SQL.
SQL

SELECT DISTINCT B.ROLEUSER

, j.emplid

FROM PS_JOB J

, PS_ROLEXLATOPR B

, ps_csu_installatn ci

WHERE J.EMPLID = B.EMPLID AND J.EFFDT = (

SELECT MAX(J1.EFFDT) FROM PS_JOB J1

WHERE J1.EMPLID = J.EMPLID

AND J1.EMPL_RCD = J.EMPL_RCD AND J1.EFFDT <= SYSDATE)

AND J.EFFSEQ = ( SELECT MAX(J1.EFFSEQ) FROM PS_JOB J1

WHERE J1.EMPLID = J.EMPLID

AND J1.EMPL_RCD = J.EMPL_RCD AND J1.EFFDT = J.EFFDT)

AND J.EMPL_STATUS IN ('A','L','P','W') AND J.EMPL_CLASS NOT IN ('S','T') AND J.JOB_INDICATOR = 'P'

AND J.JOBCODE NOT IN (

SELECT TRIM(regexp_substr(string_text

, '[^,]+'

, 1

, LEVEL)) jobcode FROM (

SELECT string_text FROM ps_strings_tbl

WHERE program_id = 'CSURSOB'

AND string_id = 'JOBCODE') CONNECT BY instr(STRING_TEXT, ',', 1, LEVEL-1) >0) AND B.EMPLID <> ' '

AND NOT EXISTS ( SELECT C.ROLENAME FROM PSROLEUSER C

WHERE C.ROLEUSER = B.ROLEUSER AND C.ROLENAME LIKE 'CSURSPU%'

AND C.ROLENAME <> 'CSURSPUSearchChairII')

AND J.BUSINESS_UNIT = ci.business_unit AND substr(roleuser,1,2) = ci.csu_campus_cd UNION

SELECT DISTINCT B.ROLEUSER

, a.emplid

FROM ps_per_poi_scrty a

, PS_ROLEXLATOPR B

, ps_per_poi_trans c

, ps_csu_installatn ci

WHERE a.EMPLID = B.EMPLID

AND a.emplid = c.emplid AND a.poi_type = c.poi_type

AND a.scrty_key2 = ci.business_unit

AND substr(roleuser,1,2) = ci.csu_campus_cd AND a.scrty_type_cd = '200'

AND a.poi_type = '00909'

AND c.expected_end_date >= SYSDATE AND C.POI_TYPE IN (

SELECT poi_type

FROM ps_csu_rs_poi_conf WHERE eff_status = 'A')

AND a.EMPLID NOT IN ( SELECT UT.USERID

FROM PS_CSU_RS_USER_STG UT WHERE UT.USERID = a.EMPLID

AND UT.EMAIL_ADDR <> ' ')

AND c.eff_status = 'A' AND a.EFFDT = ( SELECT MAX(a1.EFFDT)

FROM ps_per_poi_scrty a1 WHERE a1.EMPLID = a.EMPLID

AND a1.poi_type = a.poi_type AND a1.EFFDT <= SYSDATE) AND c.EFFDT = (

SELECT MAX(c1.EFFDT)

FROM ps_per_poi_trans c1 WHERE c1.EMPLID = c.EMPLID

AND c1.poi_type = a.poi_type AND c1.EFFDT <= SYSDATE) AND B.EMPLID <> ' '

AND NOT EXISTS ( SELECT C.ROLENAME FROM PSROLEUSER C

WHERE C.ROLEUSER = B.ROLEUSER AND C.ROLENAME LIKE 'CSURSPU%')

3.0 Workforce Adminstration

There are 2 dynamic roles available for accessing PeopleSoft pages in the Workforce Administration module.

3.1 Workforce Administration Role - CHR_SS_Employee_All

  • The role will be provision when the criteria are met and deprovison when any of the critaria are not met.
    • The Employee has an Active status
    • User profiles with a future hire date in JOB up to 180 days ahead (UNION_CD = R03) up to 14 days ahead (all other UNION_CD values)
Role Name Query Descr
CHR_SS_Employee_All CSU_SEC_CHR_SS_EMPLOYEE_ALL Dynamic Query Role - CSU_SEC_CHR_SS_EMPLOYEE_ALL
This role is intended to grant self service access to all employees. Baseline recommendations for employee self-
service.
  • Permission lists linked to Role:
permission lists tab
SQL

SELECT B.OPRID

FROM PSOPRDEFN B, PS_CSU_SEC_JOB_VW A, PS_CSU_INSTALLATN C WHERE ( A.EMPLID = B.EMPLID

AND A.EFFDT =

(SELECT MAX(A_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW A_ED WHERE A.EMPLID = A_ED.EMPLID

AND A.EMPL_RCD = A_ED.EMPL_RCD AND A_ED.EFFDT <= SYSDATE)

AND A.EFFSEQ =

(SELECT MAX(A_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW A_ES WHERE A.EMPLID = A_ES.EMPLID

AND A.EMPL_RCD = A_ES.EMPL_RCD AND A.EFFDT = A_ES.EFFDT)

AND A.HR_STATUS = 'A'

AND C.BUSINESS_UNIT = A.BUSINESS_UNIT

AND C.CSU_CAMPUS_CD = SUBSTR( B.OPRID,1,2) AND A.BUSINESS_UNIT IN ('STCMP','MACMP'))

UNION

SELECT D.OPRID

FROM PSOPRDEFN D, PS_CSU_SEC_JOB_VW E, PS_CSU_INSTALLATN F WHERE ( E.EMPLID = D.EMPLID

AND E.EFFDT =

(SELECT MAX(E_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW E_ED WHERE E.EMPLID = E_ED.EMPLID

AND E.EMPL_RCD = E_ED.EMPL_RCD AND E_ED.EFFDT <= SYSDATE + 180)

AND E.EFFSEQ =

(SELECT MAX(E_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW E_ES WHERE E.EMPLID = E_ES.EMPLID

AND E.EMPL_RCD = E_ES.EMPL_RCD AND E.EFFDT = E_ES.EFFDT)

AND F.BUSINESS_UNIT = E.BUSINESS_UNIT AND F.BUSINESS_UNIT IN ('STCMP','MACMP')

AND F.CSU_CAMPUS_CD = SUBSTR( D.OPRID,1,2) AND E.UNION_CD = 'R03'

AND E.HR_STATUS = 'A') UNION

SELECT G.OPRID

FROM PSOPRDEFN G, PS_CSU_SEC_JOB_VW H, PS_CSU_INSTALLATN I WHERE ( H.EMPLID = G.EMPLID

AND H.EFFDT =

(SELECT MAX(H_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW H_ED WHERE H.EMPLID = H_ED.EMPLID

AND H.EMPL_RCD = H_ED.EMPL_RCD AND H_ED.EFFDT <= SYSDATE + 14)

AND H.EFFSEQ =

(SELECT MAX(H_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW H_ES WHERE H.EMPLID = H_ES.EMPLID

AND H.EMPL_RCD = H_ES.EMPL_RCD AND H.EFFDT = H_ES.EFFDT)

AND I.BUSINESS_UNIT = H.BUSINESS_UNIT AND I.BUSINESS_UNIT IN ('STCMP','MACMP')

AND I.CSU_CAMPUS_CD = SUBSTR( G.OPRID,1,2) AND H.HR_STATUS = 'A'

AND H.UNION_CD <> 'R03' AND H.UNION_CD > ' ')

UNION

SELECT J.OPRID

FROM PSOPRDEFN J, PS_CSU_INSTALLATN K, PS_CSU_SEC_JOB_VW L WHERE ( K.CSU_CAMPUS_CD = SUBSTR( J.OPRID,1,2)

AND L.EMPLID = J.EMPLID

AND L.BUSINESS_UNIT = K.BUSINESS_UNIT

AND L.EFFDT > sysdate

AND (( L.EFFDT < sysdate + 181 AND L.UNION_CD = 'R03')

OR ( L.EFFDT < sysdate + 15 AND L.UNION_CD <> 'R03' AND L.UNION_CD > ' ')) AND L.HR_STATUS = 'A'

AND K.BUSINESS_UNIT IN ('STCMP','MACMP') AND L.EFFSEQ = (SELECT MAX( M.EFFSEQ)

FROM PS_CSU_SEC_JOB_VW M WHERE M.EMPLID = L.EMPLID

AND M.EMPL_RCD = L.EMPL_RCD AND M.EFFDT = L.EFFDT))

3.2 Workforce Administration Role - CHR_SS_Inactive_Employee

  • The role will be provision when the criteria are met and deprovison when any of the critaria are not met.
    • The Employee has an Inactive Status.
    • The Last Date Worked is greater than the current date minus 366 days.
Role Name Query Descr
CHR_SS_Inactive_Employee CSU_SEC_CHR_SS_INACTIVE_EMPLOY Dynamic Query Role - CSU_SEC_CHR_SS_INACTIVE_EMPLOY
This role is intended to grant self service access to recently terminated and retired employees. Update access to addresses and contact details. Read only access to Disability, Emergency Details, Name, Opt
Out, and Veteran Status.
  • Permission lists linked to role.
permission lists tab
SQL

SELECT B.OPRID

FROM PSOPRDEFN B, PS_CSU_SEC_JOB_VW A, PS_CSU_INSTALLATN C WHERE ( A.EMPLID = B.EMPLID

AND A.EFFDT =

(SELECT MAX(A_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW A_ED WHERE A.EMPLID = A_ED.EMPLID

AND A.EMPL_RCD = A_ED.EMPL_RCD AND A_ED.EFFDT <= SYSDATE)

AND A.EFFSEQ =

(SELECT MAX(A_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW A_ES WHERE A.EMPLID = A_ES.EMPLID

AND A.EMPL_RCD = A_ES.EMPL_RCD AND A.EFFDT = A_ES.EFFDT)

AND A.HR_STATUS = 'A'

AND C.BUSINESS_UNIT = A.BUSINESS_UNIT

AND C.CSU_CAMPUS_CD = SUBSTR( B.OPRID,1,2) AND A.BUSINESS_UNIT IN ('STCMP','MACMP'))

UNION

SELECT D.OPRID

FROM PSOPRDEFN D, PS_CSU_SEC_JOB_VW E, PS_CSU_INSTALLATN F WHERE ( E.EMPLID = D.EMPLID

AND E.EFFDT =

(SELECT MAX(E_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW E_ED WHERE E.EMPLID = E_ED.EMPLID

AND E.EMPL_RCD = E_ED.EMPL_RCD AND E_ED.EFFDT <= SYSDATE + 180)

AND E.EFFSEQ =

(SELECT MAX(E_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW E_ES WHERE E.EMPLID = E_ES.EMPLID

AND E.EMPL_RCD = E_ES.EMPL_RCD AND E.EFFDT = E_ES.EFFDT)

AND F.BUSINESS_UNIT = E.BUSINESS_UNIT AND F.BUSINESS_UNIT IN ('STCMP','MACMP')

AND F.CSU_CAMPUS_CD = SUBSTR( D.OPRID,1,2) AND E.UNION_CD = 'R03'

AND E.HR_STATUS = 'A') UNION

SELECT G.OPRID

FROM PSOPRDEFN G, PS_CSU_SEC_JOB_VW H, PS_CSU_INSTALLATN I WHERE ( H.EMPLID = G.EMPLID

AND H.EFFDT =

(SELECT MAX(H_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW H_ED WHERE H.EMPLID = H_ED.EMPLID

AND H.EMPL_RCD = H_ED.EMPL_RCD AND H_ED.EFFDT <= SYSDATE + 14)

AND H.EFFSEQ =

(SELECT MAX(H_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW H_ES WHERE H.EMPLID = H_ES.EMPLID

AND H.EMPL_RCD = H_ES.EMPL_RCD AND H.EFFDT = H_ES.EFFDT)

AND I.BUSINESS_UNIT = H.BUSINESS_UNIT AND I.BUSINESS_UNIT IN ('STCMP','MACMP')

AND I.CSU_CAMPUS_CD = SUBSTR( G.OPRID,1,2) AND H.HR_STATUS = 'A'

AND H.UNION_CD <> 'R03' AND H.UNION_CD > ' ')

UNION

SELECT J.OPRID

FROM PSOPRDEFN J, PS_CSU_INSTALLATN K, PS_CSU_SEC_JOB_VW L WHERE ( K.CSU_CAMPUS_CD = SUBSTR( J.OPRID,1,2)

AND L.EMPLID = J.EMPLID

AND L.BUSINESS_UNIT = K.BUSINESS_UNIT

AND L.EFFDT > sysdate

AND (( L.EFFDT < sysdate + 181 AND L.UNION_CD = 'R03')

OR ( L.EFFDT < sysdate + 15 AND L.UNION_CD <> 'R03' AND L.UNION_CD > ' ')) AND L.HR_STATUS = 'A'

AND K.BUSINESS_UNIT IN ('STCMP','MACMP') AND L.EFFSEQ = (SELECT MAX( M.EFFSEQ)

FROM PS_CSU_SEC_JOB_VW M WHERE M.EMPLID = L.EMPLID

AND M.EMPL_RCD = L.EMPL_RCD AND M.EFFDT = L.EFFDT))

4.0 Absences Management

  • There are four dynamic roles available for Absence Management.

4.1 Absences Management Role - CHR_AM_Employee_All

  • This role will be automatically assigned to employees who have at least one active position that is eligible for absences. The role will be automatically removed when the employee no longer has any positions enrolled in absence management.
    • The Employee has an Active Status.
Role Name Query Descr
CHR_AM_Employee_All CSU_SEC_CHR_AM_EMPLOYEE_ALL Dynamic Query Role - CHR_AM_Employee_All
This role grants access to employee self- service absence management functionality
  • CSU Time Tile View with Pages access on Employee Self Service Landing Page
tile view pages
SQL

SELECT DISTINCT B.OPRID

FROM PSOPRDEFN B, PS_CSU_SEC_JOB_VW A, PS_CSU_INSTALLATN C WHERE ( A.EMPLID = B.EMPLID

AND A.EFFDT =

(SELECT MAX(A_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW A_ED WHERE A.EMPLID = A_ED.EMPLID

AND A.EMPL_RCD = A_ED.EMPL_RCD AND A_ED.EFFDT <= SYSDATE)

AND A.EFFSEQ =

(SELECT MAX(A_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW A_ES WHERE A.EMPLID = A_ES.EMPLID

AND A.EMPL_RCD = A_ES.EMPL_RCD AND A.EFFDT = A_ES.EFFDT)

AND A.HR_STATUS = 'A'

AND A.ABSENCE_SYSTEM_CD = 'AM'

AND C.BUSINESS_UNIT = A.BUSINESS_UNIT

AND C.CSU_CAMPUS_CD = SUBSTR( B.OPRID,1,2))

4.2 Absences Management Role - CHR_AM_Approver

  • This role will be provision to a Active employee who has absence eligible employees reporting to them.
Role Name Query Descr
CHR_AM_Approver CSU_SEC_CHR_AM_APPROVER Dynamic Query Role - CSU_SEC_CHR_AM_APPROVER

This role grants access to Absence Management Approver (approval, entry on employee behalf, balance Inquiry).

Assigned to everyone in a REPORTS_TO position.

This role can not be re-named because the name is hard coded in app package

PeopleCode
csu_tlam_approvals.GetUsersDynamicGroup
  • Approvals Tile View on Manager Self Service Landing Page
manager tile page
SQL
SELECT DISTINCT B.OPRID

FROM PS_CSU_SEC_JOB_VW A, PSOPRDEFN B, PS_CSU_INSTALLATN C WHERE ( A.EFFDT =

(SELECT MAX(A_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW A_ED

WHERE A.EMPLID = A_ED.EMPLID AND A.EMPL_RCD = A_ED.EMPL_RCD AND A_ED.EFFDT <= SYSDATE)

AND A.EFFSEQ =

(SELECT MAX(A_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW A_ES WHERE A.EMPLID = A_ES.EMPLID

AND A.EMPL_RCD = A_ES.EMPL_RCD AND A.EFFDT = A_ES.EFFDT)

AND A.EMPLID = B.EMPLID AND A.HR_STATUS = 'A'

AND C.BUSINESS_UNIT = A.BUSINESS_UNIT

AND C.CSU_CAMPUS_CD = SUBSTR( B.OPRID,1,2) AND EXISTS (SELECT 'X'

FROM PS_CSU_SEC_JOB_VW D WHERE D.EFFDT =

(SELECT MAX(D_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW D_ED WHERE D.EMPLID = D_ED.EMPLID

AND D.EMPL_RCD = D_ED.EMPL_RCD AND D_ED.EFFDT <= SYSDATE)

AND D.EFFSEQ =

(SELECT MAX(D_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW D_ES WHERE D.EMPLID = D_ES.EMPLID

AND D.EMPL_RCD = D_ES.EMPL_RCD AND D.EFFDT = D_ES.EFFDT)

AND D.REPORTS_TO = A.POSITION_NBR AND D.HR_STATUS = 'A'

AND D.ABSENCE_SYSTEM_CD = 'AM'))

4.3 Absences Management Role - CHR_AM_No_Leave_Taken

  • The role will be provision when the criteria are met and deprovison when any of the critaria are not met.
    • The Employee has an active job record
    • The Employee is Salaried or Hourly
    • The Employee is enrolled in Absence Management
    • 30 Days delay deprovisioning of the role for mid-month changes from Salary to Hourly
Role Name Query Descr
CHR_AM_No_Leave_Taken CSU_SEC_CHR_AM_NO_LEAVE_TAKEN Dynamic Query Role - CSU_SEC_CHR_AM_NO_LEAVE_TAKEN
This role will grant access to the No Leave Taken self-service pages.
  • CSU Time Tile View on Employee Self Service Landing Page
time tile
SQL

SELECT B.OPRID

FROM PS_CSU_SEC_JOB_VW A, PSOPRDEFN B, PS_CSU_INSTALLATN C WHERE ( A.EFFDT =

(SELECT MAX(A_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW A_ED WHERE A.EMPLID = A_ED.EMPLID

AND A.EMPL_RCD = A_ED.EMPL_RCD AND A_ED.EFFDT <= SYSDATE)

AND A.EFFSEQ =

(SELECT MAX(A_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW A_ES WHERE A.EMPLID = A_ES.EMPLID

AND A.EMPL_RCD = A_ES.EMPL_RCD AND A.EFFDT = A_ES.EFFDT)

AND A.EMPLID = B.EMPLID AND A.HR_STATUS = 'A'

AND C.BUSINESS_UNIT = A.BUSINESS_UNIT

AND C.CSU_CAMPUS_CD = SUBSTR( B.OPRID,1,2) AND A.ABSENCE_SYSTEM_CD = 'AM'

AND A.EMPL_TYPE IN ('S','H')) UNION

SELECT E.OPRID

FROM PS_CSU_SEC_JOB_VW D, PSOPRDEFN E, PS_CSU_INSTALLATN F WHERE ( D.EFFDT =

(SELECT MAX(D_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW D_ED WHERE D.EMPLID = D_ED.EMPLID

AND D.EMPL_RCD = D_ED.EMPL_RCD

AND D_ED.EFFDT <= sysdate - 30) AND D.EFFSEQ =

(SELECT MAX(D_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW D_ES WHERE D.EMPLID = D_ES.EMPLID

AND D.EMPL_RCD = D_ES.EMPL_RCD AND D.EFFDT = D_ES.EFFDT)

AND D.EMPLID = E.EMPLID

AND F.BUSINESS_UNIT = D.BUSINESS_UNIT

AND F.CSU_CAMPUS_CD = SUBSTR( E.OPRID,1,2) AND D.HR_STATUS = 'A'

AND D.EMPL_TYPE IN ('S','H')

AND D.ABSENCE_SYSTEM_CD = 'AM')

4.4 Absences Management Role - CHR_AM_NLT_Approver

  • This role will be provision to a Active employee who has absence eligible employees reporting to them. The criteria is the same as CHR_AM_Approver.
Role Name Query Descr
CHR_AM_NLT_Approver CSU_SEC_CHR_AM_NLT_APPROVER Dynamic Query Role - CSU_SEC_CHR_AM_NLT_APPROVER
This role grants access to Absence
Management No Leave Taken Approver.
SQL

SELECT DISTINCT B.OPRID

FROM PS_CSU_SEC_JOB_VW A, PSOPRDEFN B, PS_CSU_INSTALLATN C WHERE ( A.EFFDT =

(SELECT MAX(A_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW A_ED WHERE A.EMPLID = A_ED.EMPLID

AND A.EMPL_RCD = A_ED.EMPL_RCD AND A_ED.EFFDT <= SYSDATE)

AND A.EFFSEQ =

(SELECT MAX(A_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW A_ES WHERE A.EMPLID = A_ES.EMPLID

AND A.EMPL_RCD = A_ES.EMPL_RCD AND A.EFFDT = A_ES.EFFDT)

AND A.EMPLID = B.EMPLID AND A.HR_STATUS = 'A'

AND C.BUSINESS_UNIT = A.BUSINESS_UNIT

AND C.CSU_CAMPUS_CD = SUBSTR( B.OPRID,1,2) AND EXISTS (SELECT 'X'

FROM PS_CSU_SEC_JOB_VW D WHERE D.EFFDT =

(SELECT MAX(D_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW D_ED

WHERE D.EMPLID = D_ED.EMPLID

AND D.EMPL_RCD = D_ED.EMPL_RCD AND D_ED.EFFDT <= SYSDATE)

AND D.EFFSEQ =

(SELECT MAX(D_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW D_ES WHERE D.EMPLID = D_ES.EMPLID

AND D.EMPL_RCD = D_ES.EMPL_RCD AND D.EFFDT = D_ES.EFFDT)

AND D.REPORTS_TO = A.POSITION_NBR AND D.HR_STATUS = 'A'

AND D.ABSENCE_SYSTEM_CD = 'AM'))

5.0 Time and Labor

  • There are two dynamic roles related to Time and Labor (T&L).

5.1 Time and Labor Role - CHR_TL_Timesheet_Employee

  • The role will be provision when the criteria are met and deprovison when any of the critaria are not met.
    • The employee has an active job data row.
    • The employee has an active Time Reporter Data Record.
    • The employee is not assigned the CHR_TL_WebClock_Employee role.
Role Name Query Descr
CHR_TL_Timesheet_Employee CSU_SEC_CHR_TL_TIMESHEET_EMPLO Dynamic Query Role - CSU_SEC_CHR_TL_TIMESHEET_EMPLO
This role grants access to the employee self-service fluid timesheet
SQL

SELECT DISTINCT B.OPRID

FROM PSOPRDEFN B, PS_CSU_SEC_JOB_VW A, PS_TL_EMPL_DATA C, PS_CSU_INSTALLATN E

WHERE ( A.EMPLID = B.EMPLID AND A.EFFDT =

(SELECT MAX(A_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW A_ED WHERE A.EMPLID = A_ED.EMPLID

AND A.EMPL_RCD = A_ED.EMPL_RCD AND A_ED.EFFDT <= SYSDATE)

AND A.EFFSEQ =

(SELECT MAX(A_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW A_ES WHERE A.EMPLID = A_ES.EMPLID

AND A.EMPL_RCD = A_ES.EMPL_RCD AND A.EFFDT = A_ES.EFFDT)

AND A.HR_STATUS = 'A' AND A.EMPLID = C.EMPLID

AND A.EMPL_RCD = C.EMPL_RCD AND C.EFFDT =

(SELECT MAX(C_ED.EFFDT) FROM PS_TL_EMPL_DATA C_ED WHERE C.EMPLID = C_ED.EMPLID

AND C.EMPL_RCD = C_ED.EMPL_RCD AND C_ED.EFFDT <= SYSDATE)

AND C.TIME_RPTG_STATUS = 'A' AND NOT EXISTS (SELECT 'X'

FROM PSROLEUSER D

WHERE D.ROLEUSER = B.OPRID

AND D.ROLENAME IN ('CHR_TL_WebClock_Employee')) AND E.BUSINESS_UNIT = A.BUSINESS_UNIT

AND E.CSU_CAMPUS_CD = SUBSTR( B.OPRID,1,2))

5.2 Time and Labor Role - CHR_TL_Approver

  • The role will be provision when the criteria are met and deprovison when any of the critaria are not met.
    • Employee has Active employees that report to their position.
    • At least one of the reports-to employees has an active Time & Labor enrollment.
Role Name Query Descr
CHR_TL_Approver CSU_SEC_CHR_TL_APPROVER Dynamic Query Role - CSU_SEC_CHR_TL_APPROVER
This role grants access to the fluid approvals page for Time and Labor entries
SQL

SELECT DISTINCT B.OPRID

FROM PS_CSU_SEC_JOB_VW A, PSOPRDEFN B, PS_CSU_INSTALLATN C WHERE ( A.EFFDT =

(SELECT MAX(A_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW A_ED WHERE A.EMPLID = A_ED.EMPLID

AND A.EMPL_RCD = A_ED.EMPL_RCD AND A_ED.EFFDT <= SYSDATE)

AND A.EFFSEQ =

(SELECT MAX(A_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW A_ES WHERE A.EMPLID = A_ES.EMPLID

AND A.EMPL_RCD = A_ES.EMPL_RCD AND A.EFFDT = A_ES.EFFDT)

AND A.EMPLID = B.EMPLID AND A.HR_STATUS = 'A'

AND C.BUSINESS_UNIT = A.BUSINESS_UNIT

AND C.CSU_CAMPUS_CD = SUBSTR( B.OPRID,1,2) AND EXISTS (SELECT 'X'

FROM PS_CSU_SEC_JOB_VW D, PS_TL_EMPL_DATA E WHERE D.EFFDT =

(SELECT MAX(D_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW D_ED WHERE D.EMPLID = D_ED.EMPLID

AND D.EMPL_RCD = D_ED.EMPL_RCD AND D_ED.EFFDT <= SYSDATE)

AND D.EFFSEQ =

(SELECT MAX(D_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW D_ES WHERE D.EMPLID = D_ES.EMPLID

AND D.EMPL_RCD = D_ES.EMPL_RCD AND D.EFFDT = D_ES.EFFDT)

AND D.REPORTS_TO = A.POSITION_NBR AND D.HR_STATUS = 'A'

AND D.EMPLID = E.EMPLID

AND D.EMPL_RCD = E.EMPL_RCD AND E.EFFDT =

(SELECT MAX(E_ED.EFFDT) FROM PS_TL_EMPL_DATA E_ED WHERE E.EMPLID = E_ED.EMPLID

AND E.EMPL_RCD = E_ED.EMPL_RCD AND E_ED.EFFDT <= SYSDATE)

AND E.TIME_RPTG_STATUS = 'A'))

6.0 Benefits

  • There are two dynamic roles specifically designed for querying Benefits information in eBenefits Employee Self Service.
  • A dynamic query provisions applicable the eBenefits ESS role (full Benefits ESS or view-only Benefits ESS-note that there will be a separate query for full access campuses and a separate query for view-only campuses) for benefits-eligible EEs (JOB_ELIG_FLD_1 or JOB_ELIG_FLD_3 equals ‘Y’) for the USER ID tied to benefits primary job campus (PRIMARY_JOB) when the BPJ’s Payroll Status (JOB.EMPL_STATUS) = A, S or P. (Recommend a separate Benefits ESS Go-Live once you finish Wave 1 conversion processing. I.e., do not go live on Benefits ESS at the same time you go-live on CHRS-wait 3-4 weeks to allow for post conversion tasks to be completed and for conversion cleanup/stabilization.)
    • The Benefits ESS Role security queries run daily at noon and at 4am.
    • Campuses should not manually provision/de-provision for an employee the applicable Benefits ESS role because the dynamic queries will ignore USER IDs where the roles have been manually provisioned.
  • The dynamic queries de-provision Benefits ESS access when BPJ is no longer benefits eligible (JOB_ELIG_FLD_1 or JOB_ELIG_FLD_3 equals ‘N’). The dynamic queries de-provision Benefits ESS access when the BPJ’s Payroll Status (JOB.EMPL_STATUS) = T, U, R, Q, L or W.
    • Example 1: EE employed at Stanislaus (STA) and Fullerton (FUL). STA owns the BPJ, so EE has view only Benefits ESS access provisioned on STA User ID.
      • FUL User ID would have no Benefits ESS role provisioned. BAS events are assigned to STA Schedule IDs (STA-EM, STAO22, STASNP).
        • If STA job EMPL_STATUS changes to T, U, R, Q, W or L, view-only Benefits ESS access is deprovisioned on STA User ID.
        • If STA job EMPL_STATUS changes to T, U, R or Q, FUL job becomes BPJ and if EE is benefits-eligible, is then provisioned with full Benefits ESS on FUL User ID.
        • If STA job remains BPJ and EMPL_STATUS changes from W or L to A or P then view-only Benefits ESS access is provisioned on STA User ID.
    • Example 2: EE employed at STA and FUL. FUL owns the BPJ, so EE has full Benefits ESS access provisioned on FUL User ID. Would not have Benefits ESS access on the STA User ID. BAS events are assigned to FUL Schedule IDs (FUL-EM, FULO22, FULSNP).
      • If FUL job EMPL_STATUS changes to T, U, R, Q, W or L, full Benefits ESS access is deprovisioned on FUL User ID.
      • If FUL job EMPL_STATUS changes to T, U, R or Q, STA job becomes BPJ and if EE is benefits-eligible, is then provisioned with view-only Benefits ESS on STA User ID.
      • If FUL job remains BPJ and EMPL_STATUS changes from W or L to A or P then FUL Benefits ESS access is provisioned on FUL User ID.

6.1 Benefits Role - CHR_SS_BENEFITS_FL_CL_VIEW32

  • This role is provisioned by a dynamic query to campuses that are using view-only eBenefits Self Service when the campus is the employee’s benefits primary job. View Only Benefits ESS is for campuses not yet ready to deploy full Benefits ESS.
    • Employees will access view-only Benefits ESS via the CSU Benefits Summary tile. Employees will only have access to the Benefits Summary and Dependent Coverage components on the tile. Use the security role CHR_SS_BENEFITS_FL_CL_VIEW32 for view only Benefits self-service. See the next screen shot of the Benefits ESS tile for an example.
    • Employees can also access the CSYou Benefits Tile, which takes them to the Systemwide Benefits Portal page.
Role Query Description
CHR_SS_BENEFITS_FL_CL_VIEW32 CSU_SEC_CHR_SS_BENEFITS_FL_CL Dynamic Query Role - CSU_SEC_CHR_SS_BENEFITS_FL_CL

This role is provisioned by a dynamic query to campuses that are using view-only eBenefits Self Service when the campus is the employee’s benefits primary job. The provisioning/deprovisioning dynamic query contains valid campuses that assign this role.

DO NOT MANUALLY PROVISION or DEPROVISION THIS ROLE.

Users with this role can access the Employee Self Service Benefits Summary Tile. The Benefits
Summary Tile is a view-only tile.
  • CSU Benefits Summary and CSYou Benefits Tiles View on Employee Self Service Landing Page
benefits tile page
benefits summary page
SQL

SELECT DISTINCT B.OPRID

FROM PSOPRDEFN B, PS_CSU_SEC_JOB_VW A, PS_CSU_INSTALLATN C, PS_PRIMARY_JOBS D

WHERE ( A.EMPLID = B.EMPLID AND A.EFFDT =

(SELECT MAX(A_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW A_ED WHERE A.EMPLID = A_ED.EMPLID

AND A.EMPL_RCD = A_ED.EMPL_RCD AND A_ED.EFFDT <= SYSDATE)

AND A.EFFSEQ =

(SELECT MAX(A_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW A_ES WHERE A.EMPLID = A_ES.EMPLID

AND A.EMPL_RCD = A_ES.EMPL_RCD AND A.EFFDT = A_ES.EFFDT)

AND C.BUSINESS_UNIT = A.BUSINESS_UNIT

AND C.CSU_CAMPUS_CD = SUBSTR( B.OPRID,1,2) AND A.EMPL_STATUS IN ('A','S','P')

AND ( A.ELIG_CONFIG1 = 'Y' OR A.ELIG_CONFIG3 = 'Y') AND A.EMPLID = D.EMPLID

AND A.EMPL_RCD = D.EMPL_RCD AND D.EFFDT =

(SELECT MAX(D_ED.EFFDT) FROM PS_PRIMARY_JOBS D_ED WHERE D.EMPLID = D_ED.EMPLID

AND D.PRIMARY_JOB_APP = D_ED.PRIMARY_JOB_APP

AND D.EMPL_RCD = D_ED.EMPL_RCD AND D_ED.EFFDT <= SYSDATE)

AND D.PRIMARY_JOB_IND = 'Y'

AND A.BUSINESS_UNIT IN ('STCMP','MACMP'))

6.2 Benefits Role - CHR_SS_BENEFITS_FLUID_ALL

  • This role is provisioned by a dynamic query to campuses that are using full eBenefits Self Service when the campus is the employee’s benefits primary job. Full eBenefits ESS is for campuses ready to deploy self-service for qualified Life Event enrollment, New Hires and Newly-benefit eligible employee benefit enrollment, and for the annual Open Enrollment exercise. Use the security role CHR_SS_BENEFITS_FLUID_ALL for full Benefits self-service.
    • Life Events and Open Enrollment BAS events use activity guides.
      • Employees will access Benefits ESS via the CSU Benefits Summary tile, the Open Enrollment tile (this tile is only active during the annual Open Enrollment period), the CSU Life Events tile, the Hire/Newly Benefit Eligible tile and the Benefits Statements tile. Employees may not have access to every component on the tiles. ESS transactions on the CSU Life Events Tile and the Open Enrollment Tile use activity guides, which guide the employee through the benefit enrollment and benefit submission process. See the next screen shot of the Benefits ESS tiles for an example.
      • Employees can also access the CSYou Benefits Tile, which takes them to the Systemwide Benefits Portal page.
Role Query Description
CHR_SS_BENEFITS_FLUID_ALL CSU_SEC_CHR_SS_BENEFITS_FLUID Dynamic Query Role - CSU_SEC_CHR_SS_BENEFITS_FLUID
This role is provisioned by a dynamic query to campuses that are using full eBenefits Self Service when the campus is the employee’s benefits primary job. The provisioning/deprovisioning dynamic query contains valid campuses that assign this role. DO NOT MANUALLY PROVISION
or DEPROVISION THIS ROLE. Users with this role can access the Employee Self Service Open Enrollment Tile, the Life Event Tile, and the Hire/Newly Benefit Eligible Enrollment Tile to perform Benefits self-service transactions. This role also provides access to the view-only Benefits Summary Tile and the Benefits Statements Tile where employees can access online enrollment previews for Open Enrollment and online benefit
confirmation statements.
  • CSU Benefits Summary, CSU Life Events, Hire/Newly Eligible Enrollment, CSYou Benefits and Benefit Statements Tiles View on Employee Self Service Landing Page
SQL

SELECT DISTINCT B.OPRID

FROM PSOPRDEFN B, PS_CSU_SEC_JOB_VW A, PS_CSU_INSTALLATN C, PS_PRIMARY_JOBS D

WHERE ( A.EMPLID = B.EMPLID AND A.EFFDT =

(SELECT MAX(A_ED.EFFDT) FROM PS_CSU_SEC_JOB_VW A_ED WHERE A.EMPLID = A_ED.EMPLID

AND A.EMPL_RCD = A_ED.EMPL_RCD AND A_ED.EFFDT <= SYSDATE)

AND A.EFFSEQ =

(SELECT MAX(A_ES.EFFSEQ) FROM PS_CSU_SEC_JOB_VW A_ES WHERE A.EMPLID = A_ES.EMPLID

AND A.EMPL_RCD = A_ES.EMPL_RCD AND A.EFFDT = A_ES.EFFDT)

AND C.BUSINESS_UNIT = A.BUSINESS_UNIT

AND C.CSU_CAMPUS_CD = SUBSTR( B.OPRID,1,2) AND A.EMPL_STATUS IN ('A','S','P')

AND ( A.ELIG_CONFIG1 = 'Y' OR A.ELIG_CONFIG3 = 'Y') AND A.EMPLID = D.EMPLID

AND A.EMPL_RCD = D.EMPL_RCD AND D.EFFDT =

(SELECT MAX(D_ED.EFFDT) FROM PS_PRIMARY_JOBS D_ED WHERE D.EMPLID = D_ED.EMPLID

AND D.PRIMARY_JOB_APP = D_ED.PRIMARY_JOB_APP AND D.EMPL_RCD = D_ED.EMPL_RCD

AND D_ED.EFFDT <= SYSDATE) AND D.PRIMARY_JOB_IND = 'Y'

AND A.BUSINESS_UNIT IN ('FLCMP','CICMP'))

CSU Benefits Summary, CSU Life Events, Hire/Newly Eligible Enrollment, CSYou Benefits and Benefit Statements Tiles View on Employee Self Service Landing Page

7.0 Labor Cost Distribution (LCD)

  • There is a single dynamic role for LCD that grants users access to the "View Paycheck Cal Employee" tile on the Employee Self Service landing page. This role does not provide access to PeopleSoft pages directly. When a user clicks on the tile, they will be redirected to the SCO sign-on screen.

7.1 LCD Role - CHR_LCD_Employee

Role Name Query Descr
CHR_LCD_Employee CSU_SEC_CHR_LCD_EMPLOYEE Dynamic Query Role - CSU_SEC_CHR_LCD_EMPLOYEE
This role grant users access to the View Paycheck Cal Employee tile on ESS
landing page. There is no PeopleSoft page access provided on this role.
ESS landing page with tiles
  • Access Cal Employee Connect in portal.
cal connect portal sign in page
SQL 

SELECT DISTINCT B.OPRID

FROM PS_PAY_CHECK A, PSOPRDEFN B, PS_CSU_INSTALLATN C WHERE ( A.EMPLID = B.EMPLID

AND C.BUSINESS_UNIT = A.BUSINESS_UNIT

AND C.CSU_CAMPUS_CD = SUBSTR( B.OPRID,1,2))

8.0 Temporary Academic Employment (TAE)

  • There is one TAE dynamic role that grant users the CSU TAE Approval Chart tile. In addition, the two employee self service roles: CHR_SS_Employee_All and CHR_SS_Employee_All_A grant access to the CSU TAE Appt Notice tile for Active employe on the Employee Self Service landing page.
    • TAE Role - CHR_TF_Approval_Chart
Role Name Query Descr
CHR_TF_Approval_Chart CSU_SEC_CHR_TF_APPROVER Dynamic Query Role - CSU_SEC_CHR_TF_APPROVER
This role would be given to someone at the campus so they can view their
pending approvals on their home page.
approval chart landing page
SQL

SELECT B.OPRID, A.EMPLID

FROM PS_CSU_TF_APPROVER A, PSOPRDEFN B WHERE ( A.EMPLID = B.EMPLID)

9.0 PeopleSoft Advance User

  • Administrative staff or super users should have the role "CHR_PT_PeopleSoft_Advance" assigned to their user profile to access and process additional functionalities. This role provides access to component interfaces, web libraries, and web services.
    • PeopleTools - CHR_PT_PeopleSoft_Advance
Role Name Query Descr
CHR_PT_PeopleSoft_Advance CSU_SEC_CHR_PT_PS_ADVANCE Dynamic Query Role - CSU_SEC_CHR_PT_PS_ADVANCE
This role is typically given to someone that has a business who needs additional permissions to CI, web
libraries and web services
SQL

SELECT DISTINCT A.ROLEUSER FROM PSROLEUSER A WHERE ( A.ROLENAME IN

('CHR_PT_Process_Monitor','CHR_TL_Payroll_Admin','CHR_AM_Payroll_Admin','CHR_TL_Administr ator','CHR_WA_TFE_Admin','CSURS_Campus_Administrator','CSURS_Campus_Inbound','CHR_PT_ PeopleTools'))

End of Article

0 Comments

Add your comment

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Previous Article (job aid) SECURITY PAGE
Next Article (job aid) Security Plan and Requirements

Security

Job Aids: Step-by-Step Instructions 15
Reports Job Aids: Step-by-Step Instructions 3
Troubleshooting / FAQ 0
Standardization and Data Dictionary 1
Security Guides 7

Recently Updated Articles

More Recently Updated Articles
Do you need an article? Contact Us