# Infor LN Not Authorized to Run This Session: How to Fix It > Source: https://netray.co/erp-help/ln-not-authorized-to-run-session > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: ERP Help ## Short answer Infor LN refuses to open a session with a not authorized message when the logged-in user's assigned role does not include that session, or when the session is blocked for the company they are logged into. Grant the session through Common > Authorization Management > Roles, or check the user's role and company context, and the session opens on retry. In most cases this is a permissions configuration issue, not a bug. ## Kind error ## System infor-ln ## Erp Infor LN (Baan ERP) ## Module Security & Authorization ## Query infor ln you are not authorized to run this session ## Alternate Queries - infor ln access denied session - baan you have no authorization for this program - infor ln user cannot open session security - infor ln role does not include session ## Applies To Infor LN 10.x (10.5-10.7) role-based authorization model in Common > Authorization Management ## Steps ### Grant a user access to a blocked session **Items:** Confirm the exact session code the user is trying to open (visible in the title bar or error detail, for example tdsls4100m000) and note which company they are logged into. Open Common > Authorization Management > Roles and find the role or roles assigned to the affected user in Common > Authorization Management > Users. Check whether the session is included in any of the user's assigned roles. If it is missing, add it to the appropriate role rather than creating a one-off exception for a single user. Verify the role itself is authorized for the company the user is logged into; LN authorization is company-specific, so a role granted in one company does not automatically apply in another. Check for an explicit deny: some sites restrict a session for a role deliberately as a segregation of duties control, so confirm the restriction is not intentional before changing it. Save the role change and have the user log off and back on, since role assignments are typically cached for the duration of the session. If the user still cannot open the session, confirm the session itself is not disabled at the package level in Tools > Development > Sessions, which produces a similar-looking error. ## Sections ### How LN authorization actually works **Body:** Infor LN controls session access through roles, not direct user-to-session grants. A user is assigned one or more roles in Common > Authorization Management > Users, and each role lists the sessions, menus, and optionally field-level permissions it grants. The not authorized error simply means none of the user's assigned roles include the session they tried to open. Authorization in LN is also company-specific. A role that grants a session in one company does not carry over to another company automatically, which is the most common surprise for admins used to simpler, single-company systems. Multi-company and multi-site LN implementations need the role reviewed per company. ### Segregation of duties versus misconfiguration **Body:** Not every not authorized message is a mistake. Many LN implementations deliberately restrict sessions like approving purchase orders or posting invoices to specific roles as a segregation of duties control, often tied to an internal audit or compliance requirement. Before granting broad access, check whether the restriction was intentional. A quick way to tell the difference: check whether the session was ever included for that role, or ask the security administrator. If it was removed on purpose, route the request through whatever approval process governs access changes instead of simply re-adding it. ### Common places this trips people up **Body:** New employees copied from an existing user's role assignment inherit that assignment exactly, including any sessions the original user did not have. If a new hire is missing access another team member has, the template used to create them is usually the problem, not the individual role definition. Role changes made in a test or acceptance environment do not migrate to production automatically. If access works in a sandbox but not in the live system, confirm the role change was actually transported or re-applied in production. ### When it is not a role problem at all **Body:** If every user, including an administrator with broad authorization, gets the same error for one specific session, the session itself may be disabled or its menu entry deactivated in Tools > Development > Sessions rather than a role issue. Check the session's own status before spending time on individual role assignments. ## Pitfalls - Granting a session to an individual user instead of adding it to their role, which creates an untracked one-off exception that gets lost at the next access review. - Forgetting that authorization is company-specific and only fixing access in the company the admin happened to be logged into. - Overriding a segregation of duties restriction without checking whether it was placed there deliberately for audit reasons. - Assuming a role change takes effect immediately, without the user logging off and back on. - Not checking whether the session itself, rather than the user's role, was disabled at the package level. ## Ai Angle A grounded assistant over LN's authorization tables can answer why a specific user cannot open a specific session directly, by reading the user's assigned roles, the role's session list, and the company context, instead of an admin clicking through several sessions to piece it together. It can also flag when a requested grant would reopen a segregation of duties gap the organization deliberately closed, surfacing that context before an admin approves the change rather than after. ## Faq ### Which session manages user roles in Infor LN? **Answer:** Common > Authorization Management > Roles defines what each role can access. Common > Authorization Management > Users assigns one or more roles to each user, and that combination determines which sessions they can open. ### Does a role apply across all companies automatically? **Answer:** No. LN authorization is evaluated per company. A role that includes a session in one company must be separately verified or assigned for any other company the same user needs to work in. ### Can a super user bypass authorization checks? **Answer:** LN does have accounts that bypass most authorization checks, but relying on them as a workaround for a role missing a session is a poor practice. Fix the role instead, so normal accounts stay correctly scoped. ### Why does the error come back after I add the session to the role? **Answer:** The most common reason is the user did not log off and back on after the role change, so their session is still using cached authorization. Ask them to close all LN clients and log back in before retesting. ## Search terms infor ln not authorized error, infor ln session authorization, baan role based security, infor ln authorization management roles, infor ln user access denied, grant session access infor ln, infor ln multi company authorization, baan erp permissions error, infor ln segregation of duties --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json