IFS Cloud: Add a Permission Set, What an IAM User Is and Linking an Employee to a Supervisor
ifs cloud how to add permission set
Also searched as
- ifs cloud what is iam user
- ifs cloud how to add employee to supervisor
- ifs cloud grant permission set to user
Short answer
An IAM user is the sign-in identity held in IFS Identity and Access Management, which authenticates the person. The IFS application user and its permission sets decide what that person may do. To add access, grant a permission set to the application user and make sure the identity maps to it; the supervisor relationship is an employee and organization setting, not a security one.
Applies to: IFS Cloud 21R1 and later. Page names differ slightly by release and by how your identity provider is federated.
How to grant a permission set
- 1Confirm the person has an IAM identity (a sign-in) and an IFS application user mapped to it. If the identity comes from a company directory, check it exists there first.
- 2Open the user administration page in Aurena and find the application user.
- 3Open the permission sets assigned to the user and add the required set. Choose the narrowest set that covers the job.
- 4Save, then ask the user to sign out and back in so the new rights are loaded.
- 5Test the specific page or action the user needs, and a page they should not see.
- 6Record the request, the approver and the date for audit.
What an IAM user is
IFS Cloud separates who you are from what you can do. Identity and Access Management handles authentication: sign-in, tokens and, usually, federation to your company directory. The application user in IFS holds the authorization: permission sets, site and company access and personal settings. Both must exist and be linked for a person to work.
The same IAM layer also holds service clients used by integrations. Treat those like privileged accounts with their own owners and rotation process.
Permission sets done well
A permission set bundles access to pages, projections and data. Build sets by job role, not by person, and combine a small number per user. Avoid giving broad administrator sets to fix a single failing page.
When a user reports missing access, find the exact page or projection involved, find which set grants it, then decide if the user's role should carry that set. This keeps access reviews simple. Periodically compare each role's real usage with its assigned sets.
Employee to supervisor
The supervisor link is part of the employee and organization data, not the security model. It is typically maintained in the employee or organizational structure setup and then used by processes such as approvals and time or expense reporting. Granting a supervisor role in security does not by itself make someone the approver.
If an approval cannot find an approver, check that the employee record has the supervisor set, that the supervisor is an active employee with an application user, and that the approval step uses that relationship.
Try it here, free
IFS Cloud Upgrade Test Checklist
A grouped test checklist for IFS release updates and upgrades covering environments, core processes, integrations, reports, security and sign-off.
Common pitfalls
- !Fixing access problems by adding broad administrator sets.
- !Creating the identity but not the application user, or the reverse.
- !Expecting a permission change to apply to an existing session.
- !Assuming the supervisor setting controls security rights.
- !Leaving integration clients without an owner or review.
How an ERP-grounded AI assistant handles this
Access reviews are slow when someone has to read permission set definitions by hand. A private assistant with read-only access to your IFS security data can answer who can approve purchase orders, which users hold a given set and which sets give access to a projection, and show the query behind each answer. Changes still go through your approval process.
Frequently asked questions
Why does a new permission set not take effect?
The user's session may still hold the old rights, so a sign-out and sign-in is the first step. Also check that the set grants the specific projection or page, and that company or site access is set.
Is an IAM user the same as an IFS user?
No. The IAM user is the sign-in identity used for authentication. The IFS application user holds authorization data. They are linked, but they are maintained in different places.
Can I give a permission set to a group?
Directory groups can be used for authentication and mapping in many setups, but whether they drive permission set assignment depends on your configuration. Check how your identity federation is set up.
How do I make someone an approver?
Approval depends on the approval template or workflow you configured. It usually needs the person to be a valid user with the right permissions and to be linked through the supervisor or role set in that template.
Related
IFS Cloud OData Projection API: Fixing 401 and 403 Errors
IFS Cloud exposes its data through OData v4 projections under /main/ifsapplications/projection/v1/, secured by OAuth2 tokens from IFS IAM. A 401 almost always means the token is missing, expired or issued by the wrong realm; a 403 means the identity is authenticated but its permission sets do not grant that projection or its entity actions.
Error fixIFS Cloud: Unable to Save, Internal Server Error and Quick Report Problems
In IFS Cloud a save failure or internal server error is almost always a server-side exception returned through the projection the page calls. Read the error detail, reproduce it in the browser network tab, then check the middleware and database logs for the real cause, which is typically a business rule, a missing permission, a bad customization or a stale cache. Quick Report problems are usually a missing permission grant or mismatched bind parameters.
How-toIFS Cloud Report Builder, Appearance Designer, Custom Menus and Approval Templates
There is no single report builder in IFS Cloud. Formatted documents come from the report designer for your release (Crystal only on older layouts), ad hoc lists come from Quick Reports, and the look and layout of pages is adjusted with the page designer tools, custom menus and approval templates. Use the supported tools and keep customization small so updates stay easy.
How-toHow to Set Up Business Events and Actions in IFS
IFS Business Events fire when a defined condition on a Logical Unit is met, such as a new record, an update, or a specific attribute changing, and Actions subscribe to those events to send email, invoke a workflow, or call an external service. Both are configured in Solution Manager (or the Events and Actions work area in IFS Cloud) without requiring custom PL/SQL for most standard cases.
How-toIFS Cloud Workflow Example, External File Templates, Update Analyzer and PO Status
Treat IFS Cloud configuration as a set of building blocks: workflows or business events to react to changes, external file templates to load or send flat files, an update analysis step to check what a release will touch in your customizations, and the supported database views for reading data such as purchase order status. This page shows how each fits together with a worked approval example.
How-toIFS Cloud Report Designer, Quick Reports and Crystal Reports: Which to Use
IFS Cloud has several reporting routes. Use Quick Reports for fast read-only lists of data, the report designer route for formatted operational documents such as order confirmations and pick lists, legacy Crystal-based layouts only where you already have them, and the analytical tools for dashboards. Report rules then control when and how a report is produced and sent.
AI for ERPAI for IFS Cloud in aerospace and defense manufacturing
Add AI to IFS Cloud for aerospace and defense: projections, Aurena UX, Lobby, and engineer-to-order data, deployed on-prem or in your private cloud.
AI for ERPAI Agents for ERP, Running On-Prem
A practical guide to on-prem AI agents for ERP: what they can safely automate, where human approval belongs, and how to design the guardrails.
Stuck on IFS Cloud?
Talk to engineers who work inside IFS Cloud every week, and who build private AI that answers these questions from your own ERP data.
Keep exploring
Free tools
- IFS Cloud Upgrade Test ChecklistA grouped test checklist for IFS release updates and upgrades covering environments, core processes, integrations, reports, security and sign-off.
- IFS Cloud Implementation Statement of Work TemplateDocument template for an IFS Cloud implementation statement of work covering scope, deliverables, assumptions, roles, change control and acceptance.
- IFS Cloud Data Migration Object TrackerEditable tracker for IFS Cloud migration objects with source, owner, cleansing status and effort so you can see remaining work in hours.
ERP fixes and how-tos
- IFS Cloud OData Projection API: Fixing 401 and 403 ErrorsGetting 401 or 403 from an IFS Cloud OData projection? Learn how to get a token from IFS IAM, grant the projection to a permission set, and send valid requests.
- IFS Cloud: How to Set Up Parts, Find Help and Use Web DevtoolsSet up a part in IFS Cloud from Part Catalog to Inventory, Purchase and Sales part, and learn where the built-in help, user guide and developer tools are.
- How to Add a Custom Field to an IFS Cloud PageStep-by-step guide to adding a custom field in IFS Cloud with configuration mode, plus data types, permission needs, upgrade safety and why a field may not show.
Guides
- How to Configure User Security Groups in SyteLineStep-by-step guide to configuring user security groups in Infor SyteLine CloudSuite Industrial. Set up group hierarchies, form permissions, and IDO-level access controls.
- How to Set Up Role-Based Access Control in SyteLineConfigure role-based access control (RBAC) in Infor SyteLine. Map organizational roles to security groups, enforce segregation of duties, and manage permission inheritance.
- SyteLine IFS Framework Development GuideComplete guide to SyteLine IFS framework development. Form architecture, grid components, IDO binding, and IFS best practices for developers.
AI on your ERP
- AI for IFS Cloud in aerospace and defense manufacturingAdd AI to IFS Cloud for aerospace and defense: projections, Aurena UX, Lobby, and engineer-to-order data, deployed on-prem or in your private cloud.
- IFS Field Service Management AI Integration: Private AI on IFS Cloud Service DataAI for IFS Field Service Management: service requests, work tasks, agreements and technician data via IFS Cloud APIs, joined to parts and finance. On-prem.
Integrations
- How to build an MCP server for IFS CloudHow to build a Model Context Protocol server for IFS Cloud: which read-only tools to expose, IFS IAM auth, stdio versus HTTP transport, scoping and audit.
- How to add an AI chatbot to IFS CloudHow to add an AI chatbot to IFS Cloud: grounded answers from IFS data and documents, embedding in Aurena or a portal, role-aware access and fully on-prem models.
Software
- IFS CloudIndependent guide to IFS Cloud, the ERP and enterprise asset and service platform: modules, integration options, limitations, alternatives and AI use cases.
- IFS Field Service ManagementIFS Field Service Management covers service orders, scheduling optimisation and mobile work within IFS Cloud. Modules, integrations, AI uses and alternatives.