User Types

Use Ennov InSight Security Administration to manage Users and Groups, and to assign privileges to them appropriately. The following table describes the types of Ennov InSight users.

Ennov InSight Administration 7.3 Log on to IdP Configured Ennov InSight

Notes About Users

— If the user belongs to an IdP group and the group is already in Ennov InSight , then the user inherits the established privileges of the group. If you want to assign specific privileges to the user that are different from the group's privileges, you can override the rights by disassociating the user from the group and changing the security privileges.

— To assign security privileges to users who do not belong to an IdP group, you must first override the users by clicking the Disassociate User from the Group button and then assign security privileges to each individual user.

— Alternatively, if you choose to use the field level/page-level security feature in Ennov InSight , you can associate these users with a role and assign security privileges to the role.

— Ennov InSight does not support a domain user having membership in a group of a different domain.

Security Privileges for Users or Groups

Security privileges assigned to individual users or a groups of users are used to manage the user accounts and group assignments.

The levels of security privileges that you can assign to individual users or a group of users are:

— Enabling and disabling users

— License modules

— Access rights

— Product family/product rights

— Application country rights

— Entity security

— Home page access

— Functional security

— Field-level/page-level security

You manage user accounts, passwords, and group assignments through your Identity Provider (IdP) server, rather than in Ennov InSight . However, you assign Ennov InSight privileges to an IdP users and groups by adding them to the Users/Groups page in security administration. In addition, you assign privileges to roles using security administration.

The following sections describe the procedures you should use to add users and groups and specify security privileges.

Note: When you change an IdP settings and restart the server, e-mail addresses may became unavailable in Concerned Parties attributes and Notifications; the list of available e-mail addresses will be empty. This happens because the users that existed before you change the IdP settings have not been resynchronized with an IdP. If you change an IdP, you must synchronize these changes before the e-mail list will be updated.

Enabling and Disabling User Privileges

Enabling or disabling user security privileges determines user access to the Ennov InSight system. User privileges can be enabled or disabled as follows:

Access Rights

Your license contract for Ennov InSight determines the number of read, write, and admin licenses you may assign for each module. If you are assigning privileges to a group of users, the number of licenses you use is the same as the number of users in that group. You cannot exceed the privileges indicated by your license. Access rights cannot be assigned unless at least one module license is set to Read. The following table describes the access rights.

Manage User Access Rights

Manage user access by setting rights consistently.

Ennov InSight offers several methods for controlling user access. Using a consistent approach will ensure that the right users have access to the information they need and no more.

An example of defining user access inconsistently:

1. Under Product Family/Product Rights, the user access to a product family is provided.
2. Under Application Country Rights, the user access to applications is provided .
3. Under Product Family/Product Rights, the user access to the product family is removed.

In this case, the user cannot see the product family in the product family tree, but can still edit applications on application pages.

Product Family/Product Rights

Provide record-level security permissions with the Product Family/Product rights.

Record-level security permissions allow access to a specific product family first followed by access to an application and other elements. Enabling product family/product rights allows you to view events, registrations, tasks, references, notifications, sequences, sequence assemblies, and product detail sets associated with the specified product family and its products. This applies to all views as well as querying.

To ensure privileges are applied correctly for a user, first select and save the license module security settings, then choose the other security settings (product family/product, application country, entity security, and so on).

Important: Duplicate or conflicting product family permissions should not be defined when creating security permissions for users or groups as it may cause security conflicts for a user when they access the application. For example, if write access for a product family is enabled to a user or a group, that same product family should not be added again. The security screen as it is currently implemented does not prevent this.

Make sure that you define security for a user consistently throughout Security Administration. Defining security inconsistently does not produce the required results .

Product Family/Product Rights Options

The Product Family/Product Rights dialog box provides options for assigning user privileges for record-level access.

The following table describes the options in the Product Family/Product Rights dialog box.

Product Families and the Default Administrative User

The default user in Ennov InSight is an administrative user

As an administrative user, you can: add users, groups and roles; assign and modify user security privileges; create product families. However, by default, the administrative user cannot view the product families that he or she creates. You must enable the administrative user to view the product families.

Application Country Rights

For each product family that a user can access, the Application Country Rights dialog box enables an administrator to grant the user access to the specific countries associated with those product families.

Note: To ensure user privileges are applied correctly, first select and save the license module security settings, then choose the other security settings, such as: product family/product, application country, and entity security.

— For CP (Centralized Procedure) applications, users must have access to the individual rapporteur or co-rapporteur country, or any one of the application countries, to view the application.

— For MRP (Mutual Recognition Procedure) type applications, users who have access to a country that is either a CMS (concerned member state) or an RMS (reference member state) can see that application, all associated sequences, and other information.

Application Country Rights Attributes

The Application Country Rights dialog box enables an administrator to grant users access to the specific countries. The Application Country Rights attributes provide permissions to users.

The table describes the attributes of the Application Country Rights option.

Entity Security Options

In the Entity Security section in System Administration, the entities that are available depend on the license modules available to the user. For example, if you give a user write privileges for the Submission Planning and Tracking (SPT) module, only the functions associated with the SPT module are available.

The Entity Security options in Security Administration enable an administrator to assign the appropriate privileges for access to entities that are required for a user. The following table describes the available entity security privilege options.

Ennov InSight License Modules by Feature

The following tables list Ennov InSight features and the license modules in which they are available.

Product Families, Clinical Trial Shared Data

Products, Pharmaceutical Products

Registrations, Full Product Presentations, Registration FPP Attachments and FPP Previous EV Codes

Registration Attachment

Medicinal Products, Medicinal Product Actions, Data Visualization

xEVMPD Wizards and Queries

Applications

Comparators

Events

Sequences

Product Detail Sets (PDS)

Assembly Types

Activity Workflow

Projects

Tasks, Notifications, and References

Change, Change Details

Reports

The reports listed in the table include the reports that you can generate by using Ennov InSight queries.

Approval Management

Submittal Management and Lifecycle

General Assembly

Planning and Tracking

Review and Approval

Document Analysis

General Publishing

eCTD Publishing

Paper Publishing

Administration

Home Page Access

The functions and elements that are available to users on the Home Page depend on the license modules selected and the Home Page Access settings in System Administration. For example, if you give a user write privileges for the Submission Planning and Tracking (SPT) module, only the elements associated with the SPT module are available.

Yes enables a user to access specific tabs and menu commands on the home page. For example, if Applications is set to Yes, the user can view the Applications tab. In addition, the Applications command appears on the New menu.

The applications that are displayed are further restricted by product family/product rights and application country rights.

Home page access options also include administration access. If you choose Yes for Security Administration, Data Administration, and Technical Administration, these commands are available on the home page and the user is able to perform administration activities.

Home Page Access Settings

In Security Administration, the Home Page Access settings enable an administrator to grant users access to functionality on the home page, subject to the license modules available to the user.

The availability of wizards and other options on the home page is determined by the license modules to which the user has access and whether you choose Yes or No to the wizards under Home Page Access. Wizard access is not affected by the product family/product and application country rights assigned to a user. Therefore, even though a user may have only Read privileges for product family/products and application countries, if you choose Yes for the wizard options, the wizard commands are available to the user on the home page.

If the default [Select] is set it denies permission and equals None.

Security Defaults for Home Page Access

In the following table, each permission can be changed only if any of the listed modules is installed and licensed. If the Selected Module Permission is set to Read, all elements are limited to Read.

Functional Security

In Security Administration, the Functional Security settings enable an administrator to grant access to users for functionality in the system, subject to their available license modules.

The following table describes the functional security on the Privilege Detail page.

Assembly Functions and License Modules

The assembly functions that are available depend on the license modules available to the user:

Field-Level/Page-Level Security

Field level/page level security is an optional Ennov InSight function. You can create roles in the system that enable you to assign field-level/page-level security. Each role has a set of fields that can be defined as read-only, modifiable or hidden for each page on which these fields reside.

Ennov InSight provides three XML-mapped roles: user, liquent_role1, and liquent_role2. When you create a role, you associate it with one of the XML-mapped roles available. Users and groups assigned to the role you create have access to fields as defined by the role. Field-level/page-level security applies to the following Ennov InSight entities: — Product Families

— Products

— Applications

— Registrations

Note: For each role, each field on these entity pages is defined as read-only, modifiable, or hidden.

Users associated with liquent_role1 and liquent_role2 have the ability to create product families. While it is best practice is to not give liquent_role1 or liquent_role2 users data administration access, you can add the following empty field group to liquent_role1 and liquent_role2 in the meta.overrides.xml to prevent members of these roles from creating product families:

<fieldGroup name="adminCreateFieldGroup"/>

Please note, if the overrides file is modified to use this fieldGroup, a harmless MetaException error will occur.

Ennov InSight ships with three roles. However, there is no limit to the number of roles you can define. Contact your Account Executive to consult with our Client Enablement team for information about defining and configuring field-level security for your system.

If you do not use field-level security, the following apply:

— Users/groups with the appropriate security privileges are able to view all attributes associated with the product family, product, application and registration entities.

— Users/groups with the appropriate security privileges are able to create and modify product family, product, application and registration entities.

View Users and Groups

To view Users and Groups for configured Identity Providers (IdP):

1. Select Go To > Security Administration.
2. On the Security Administration page, click Users and Groups.

The Security Administration page lists all the users and groups along with the Identity Provider Name information.

Modifying a User or Group

In Security Administration, an administrator can modify user or group privileges in the application to disable, remove, re-associate or change the privileges.

In Security Administration, an administrator can modify user or group privileges in the application to disable, remove, re-associate or change the privileges.

To modify a user or group:

1. Choose Go To > Security Administration.

   The Security Administration page opens listing all the users and groups.

2. Click the link for the user or group you want to modify.

   The Privilege Detail page for the user or group opens.

3. Do any of the following:

— To disable the user/group, choose Disable as of and enter the date when the user/group should no longer be able to log into Ennov InSight . If you do not specify a date, the user/group will remain enabled.

— To remove a user from a group, click Disassociate User from the Group, then change the privileges for the user. The User Type for an overridden user on the Privilege Detail page is STANDALONE.

Note: If the user does not belong to an IdP group and you click Disassociate User from the Group, the field-level/ page-level security assigned to the role with which the user is associated is retained unless you specifically move the user to a different role.

— Click Re-associate User with the Group to replace the user's privileges with those defined for the IdP group.

Note: Before you re-associate a user with a group, remove the user from any roles with which he or she has been associated.

— Change the security privileges for the user/group.

4. Click Save when you are finished.

Assign User or Group Security Privileges

In Security Administration, an administrator can assign security privileges for users or groups on the Privilege Detail page.

To assign security privileges for users or groups:

1. Choose Go To > Security Administration.

   The Security Administration page opens listing all the users and groups.

2. Click the link for the user or group for which you want to assign privileges. The Privilege Detail page for the user or group opens.
3. On the Privilege Detail page, specify the access rights for the license modules.

   After setting the access rights for a license module, wait for the page to refresh. The entity, home page access and functional security options associated with the module become available. After the page refreshes, you may define access rights for another license module.

4. Click Save.

   The license module options you chose are not saved until you click the Save.

5. Under Entity Security, click the arrow for each entity you want to grant the user/group access to and set the access level to grant.
6. Click Save.
7. ClickProduct Family/Products Rights > Add.>

   The Product Family/Product Rights dialog box opens.

8. Do one of the following in the Product Family/Product Rights dialog box:

   Option	Description
   All	Give the user/group access to all product families.
   Select	Select the specific product families the user/group can access. When using Select, you must return to this page to give the user/group access to any product families that are added later.

9. Click the Access Level arrow and choose the appropriate access level.
10. Click Save.
11. On the Privilege Detail page, click Add under Application Country Rights.
12. In the Application Country Rights dialog box under Product Families, do one of the following:

    Option	Description
    All	Give the user/group the same application country access to all product families.
    Select	Select the specific product families to which the user/group has application country access. When using Select, you must return to this page to give the user/group access to any product families that are added later.

13. In the Application Country Rights dialog box under Countries, do one of the following:

    Option	Description
    All	Give the user/group the same access to all countries for the product families specified in this step.
    Select	Select the specific countries for the selected product families specified under Product Families. When using Select, you must return to this page to give the user/group access to any countries that are added later.

    Note: To configure a user with Read access level to all Application Countries and with Write access to some Application

    Countries, you must follow a specific order: first add the Write access for the specific Application Countries, and then

    (using the Add button) add the Read access to All. If you find that you cannot modify this setting, delete the user permission and perform this procedure to configure the permission/access for the user.

14. Click the Access Level arrow and choose the appropriate access level.
15. Click Save.

    Note: If you are giving the user/group different access levels to different product families, you must repeat steps 9-12 for all the product family/application country combinations.

16. Under Function Security, choose whether the user/group can access the following: — Functions on the home page

    — Assembly functions

17. Click Save.

Create a Role

The system allows the creation of multiple roles with the same display name. However, this does not affect the behavior of the functionality. To avoid any confusion, it is recommended to give a unique display name to every role created in Ennov InSight .

Note: If you want to use the field-level/page-level security feature in Ennov InSight , you must create a role.

To create a role:

1. Choose Go To > Security Administration.

   The Security Administration page opens listing all the users and groups.

2. On the Security Administration page, click .
3. On the Create Role wizard window, enter a name for the role in the Display Name box.
4. Click the XML-mapped Role arrow and choose the XML mapped role to associate with this role.
5. Choose users and/or groups from the Users/Groups Available box and move them to the Selected box to associate them with the role.
6. The list of available users is limited to the following: overridden users, users who do not belong to any IdP group, users who have been added to Ennov InSight , and who do not already belong to a role.
7. The list of available groups includes groups that have been added to Ennov InSight and who do not already belong to a role.
8. Click Next. The wizard confirms the creation of the role.
9. Click Finish.
10. Repeat steps 2 through 7 for each role you need to create.

Associate Users or Groups to a Role

Associating users or groups with a role provides those users or groups with the privileges assigned to the role in the system.

To associate users or groups to a role:

1. Choose Go To > Security Administration.

   The Security Administration page opens listing all the users and groups.

2. On the Security Administration page, choose the role from the list.

   The Privilege Detail for role page opens.

3. To associate users or groups to the role, select users or groups in the Available box and move them to the Selected box.
4. Click Save.

Disassociate Users or Groups from a Role

Users and groups can belong to only one role in Ennov InSight

To disassociate users/groups from a role:

1. Choose Go To > Security Administration.

   The Security Administration page opens listing all the users and groups.

2. On the Security Administration page, choose the role from the list.

   The Privilege Detail for role page opens.

3. To disassociate users/groups from the role, select the users/groups in the Selected box and move them to the Available box.
4. Click Save.

Security Privileges for Roles

Security privileges can be assigned to a role.

However, the security settings defined for a role are not applicable to the overridden users or groups assigned to the role. They apply to the users assigned to the role but have no defined security privileges.

Note: You may want to assign security privileges to a role when you want several users who are not part of an IdP group to have the same set of security privileges and field-level security in Ennov InSight .

Assign Security Privileges to a Role

In Security Administration, an administrator can assign security privileges to a role. Users and groups can then be assigned to the role.

To assign security privileges to a role:

1. Choose Go To > Security Administration.

   The Security Administration page opens listing all users and groups.

2. On the Security Administration page, choose the role from the list.
3. On the Privilege Detail page, choose the license modules.

   Note: Choose one module and wait for the page to refresh. The entity, functional and assembly level options associated with the module become available. Then choose another module. The license module options you chose are not saved until you click the Save button.

4. Save.
5. Under Product Family/Products Rights, click Add.
6. In the Product Family/Product Rights window, do one of the following:

   Option	Description
   All	Give the role access to all product families.
   Select	Specific product families the role can access. When using Select, you must return to this page to give the user/group access to any product family/products that are added later.

7. In the Application Country Rights dialog box under Product Families, do one of the following:

   Option	Description
   All	Give the role access to the same application country to all product families.
   Select	Select specific product families to which the role has application country access. When using Select, you must return to this page to give the role access to any product families that are added later.

8. In the Application Country Rights dialog box under Countries, do one of the following:

   Option	Description
   All	Give the role access to all countries for the product families specified in this step.
   Select	Select the specific countries for the selected product families specified under Product Families. When using Select, you must return to this page to give the role access to any Countries that are added later.

9. Under Entity Security, click the arrow for each entity you want to grant the role access to and set the access level to grant, and then click Save.
10. Click the Access Level arrow and choose the appropriate access level.
11. Save.
12. Under Function Security, choose whether the role can access the following: — Functions on the home page

    — Assembly functions

13. Save.

Disable Roles

An administrator can disable a role that is no longer used in the system.

Before disabling the role in the system, users and groups must be disassociated from the role.

To disable a role:

1. Disassociate users and groups from the role to be disabled.

   Note: If the users and groups are not disassociated, field level security will remain in effect for the users and groups still associated with the disabled role.

2. Choose Go To > Security Administration.

   The Security Administration page opens listing all IdP users and groups.

3. On the Security Administration page, choose the role from the list. The Privilege Detail for role page opens.
4. On the Privilege Detail page for the role, choose Disabled as of and enter the date when the role should be disabled.
5. Click Save.

Enable the Default Administrative User for Product Families

The access level for any users, including administrators, must be enabled to access or view product families.

To enable the default administrative user:

1. On the home page, choose Go To > Security Administration.
2. On the Users/Group page, choose the default admin user.
3. Click Disassociate User from the Group, if necessary.
4. Click OK in the dialog box that appears.

   You can ignore any warnings that appear during this process.

5. Under Product Family/Product Rights, click Add.
6. Under Product Families, choose All.
7. Click the Access Level arrow and choose Admin.
8. Click Save to close the dialog box.
9. Under Application Country rights, click Add.
10. Under Product Families, choose All.
11. Under Countries, choose All.
12. Select Admin as the Access Level.
13. Click Save to close the dialog box.
14. Click Save to save the default admin user.

Ennov InSight License Components

The Ennov InSight components enable different organizational roles and functions within the regulatory lifecycle of a drug product. Each component focuses on one particular area of expertise and includes the ability to control access permissions within the component for specified users and groups.

By assigning access permissions to users or roles, you can enable some users to merely observe or access queries and summaries while enabling others to perform the daily operations of project management, research, planning, and publishing.