Authorization Layers and Role Design
LN authorization operates at three layers: session access (which forms a user can open), data authorization (which records a user can view or modify), and function authorization (which operations a user can perform within a session). Roles aggregate these permissions into manageable units. Design roles around business functions, planner, buyer, warehouse operator, rather than departments, to create reusable permission sets that map cleanly to job responsibilities.
- Define roles around business functions with documented session access lists and permission boundaries
- Use session authorization groups to manage large sets of related sessions as a single permission unit
- Implement company-level authorization to restrict users to the legal entities they work with
- Configure function-level authorization for sensitive operations: cost visibility, price overrides, and master data changes
Segregation of Duties Implementation
Audit compliance requires segregation of duties (SoD) in LN. Critical SoD conflicts include: creating vendors and processing payments, entering and approving purchase orders, posting journals and managing the chart of accounts. LN's authorization model supports SoD enforcement through role exclusion rules, but these must be configured explicitly.
Build a SoD conflict matrix during implementation and validate it against role assignments regularly.
- Build a SoD conflict matrix mapping incompatible function combinations for your industry and audit requirements
- Configure role exclusion rules in LN to prevent assignment of conflicting roles to the same user
- Generate monthly SoD violation reports and remediate any conflicts within a defined SLA
- Document SoD control evidence for auditors including role definitions, exclusion rules, and violation reports
Authorization Lifecycle Management
Authorization models degrade without lifecycle management. Users accumulate permissions as they change roles, temporary access becomes permanent, and new sessions get deployed without proper authorization configuration. Implement a closed-loop process: HR-triggered provisioning, role-based assignment, periodic certification, and automated deprovisioning.
Track all authorization changes in an audit log that satisfies regulatory review requirements.
- Integrate user provisioning with HR processes so role assignments change automatically with job changes
- Require manager approval for all role assignments and document the business justification
- Conduct semi-annual authorization certification where managers review and confirm each user's access
- Maintain a complete authorization change log with timestamps, approvers, and business justifications
Try it here, free
Infor LN User Access Review Checklist
A practical checklist for periodic review of who can do what in Infor LN, covering roles, privileged access and segregation of duties.
Frequently asked questions
What is SoD in Infor LN?
SoD means segregation of duties: no single user should hold two incompatible duties, such as creating a vendor and releasing payment to that vendor, or entering and approving the same purchase order. In Infor LN you enforce this through how you design roles and authorizations, so that incompatible session and function combinations are never granted to one user.
How do you check SoD conflicts in Infor LN?
Start from a conflict matrix that lists incompatible duty pairs for your audit scope, map each LN role to the sessions and functions it grants, then compare every user's combined roles against the matrix. Do this at role design time and again on a schedule, because access drifts as people change jobs. Check whether your Infor licence includes a governance and risk tool for automated conflict analysis; if not, the same review can be run from exported authorization data.
Who should own SoD reviews for Infor LN?
Business owners should certify who needs which access, while IT and internal audit supply the data and test the controls. Keep evidence of the matrix, the reviews and any approved exceptions, since auditors usually ask for all three.
Strengthen your LN security, our consultants design audit-ready authorization models for manufacturers.