Group Security

Skip Ahead To

Navigating To The Group Security Page

  • In the Main Navigation menu, open the Security Setup folder.
  • Click on the Group Security page.

Reviewing the Group Security page

  1. Group Security:
    • Provides a drop-down that’s used to select the security group for editing.
  2. Properties:
    • Contains various properties of the selected security group.
      • Note: This section contains managing the whitelisted IP Addresses.
  3. Group Membership:
    • Assigns another security group to an existing security group.
  4. Default Favorites:
    • Allows for various default settings for members of the selected security group.

IP Address Restrictions

IP address restrictions can be a helpful tool that will prevent employees from logging in or punching from offsite. If your organization has a concern that employees are punching in from places other than their work computers and getting paid for hours they’re not working, IP address restrictions can help alleviate that concern.

Permissions can be established to allow employees to login to the system and manage/send requests, approve time off and other Time & Attendance details while maintaining the lockout from the Web Punch Clock.

Managing IP address restrictions whitelist

As organizations expand to new locations, or improve their IT infrastructure, IP addresses may change during the process. Therefore, to avoid employees from being locked out of the TimeStar system, it’s important to manage the IP address whitelist via the Group Security page.

1. Select the Security Group that requires modification via the drop-down:

2. Locate the Restrict Access by IP Address or DNS, and click Manage Restrictions.

A warning window will appear, click OK.

3.  On the pop-up window, select the Address Type to restrict

You will have the ability to set the Address Type restrictions by:

      • Single IPv4 Address
      • IPv4 Network
      • IPv4 Range
      • Single IPv6 Address
      • IPv6 Network
      • Local IP

4. Click the plus button under assigned IPs to add a new line

5. IP Address – Enter the IP address into the text box that will be allowed access

    • Note: Check with your IT representative if you are unsure of your IP address. You may also search for the phrase “what is my IP address” in your favorite search engine to identify your public IP address.
For IP Address Restrictions to be used, you must have a Static IP Address.

6. Click Save

  • Repeat steps above to add another single IP Address or Address Range.
  • Close out of window when all entries have been added.

7. Apply IP Restrictions to selected security group by setting the Restrict Access by IP Address or DNS to Yes

8. Click Save

Restricting A Security Groups Pay Type Access

1. Select the Security Group needing pay type restrictions in the Select Group drop-down.

2. Click on the Restrictions tab.  No earning codes listed in the Pay Type Access Restrictions box means the Security Group will not be restricted and will have access to all earning codes.

Pay Type Access Restrictions with no pay types listed does not necessaryily mean all employees with that security group will have access to all pay types. Individaul employees may have User Security restrictions in place.

3. Move the pay types that the security group should have access to the left under Pay Type Access Restrictions.  In the example below, the Supervisor Security Group will be allowed to access the Personal Leave, Regular, Sick Leave, and Vacation earning codes.

4. Click

Restricting A Security Groups Future Pay Type Access

Administrators can restrict pay types that a Security Group may access on a future date by setting restrictions on the Group Security page.  These settings can also be set through User Security settings to apply to an individual employee.  In addition, Group Restrictions and User Restrictions may be used together.

To limit the pay types that a Security Group should have access to on a future date, follow the steps below:

1. Select the Security Group to set up pay type restrictions for in the Select Group drop-down.

2. Click on the Restrictions tab.  No earning codes listed in the Restrict Future Pay Types box means the Security Group will not be restricted and will have access to all earning codes on a future date.

3. In the Restrict Future Pay Types section, move the pay types the Security Group should not be allowed to access to the left.  Pay Types they are allow to enter are left on the right.  In the example below, the Supervisor group will be allowed to access all of the Pay Types in the system, up to and including whatever the current date is, but entering any time after today’s date will be restricted to Personal Leave, Sick Leave, and Vacation earning codes.

4. Click

Restricting A Security Groups Current & Future Pay Type Access

Administrators can restrict pay types that a Security Group may access up to and including today’s date as well as restricting pay type access on a future date by setting restrictions on the Group Security page. These settings can also be set through User Security settings to apply to an individual employee.  In addition, Group Restrictions and User Restrictions may be used together.

To limit the pay types that the Security Group should have access to up to today’s date as well as future dates, follow the steps below:

1. Select the Security Group to set up pay type restrictions for in the Select Group drop-down.

2. Click on the Restrictions tab.  No earning codes listed in the Restrict Future Pay Types box means the Security Group will not be restricted and will have access to all earning codes on a future date.

3. Set the restrictions for the Security Group.

  • A. In the Pay Type Access Restrictions section, move the pay types the group should be allowed to access to the left.  In the example below, the Supervisor Security Group will be allowed to access the Personal Leave, Regular, Sick Leave, and Vacation earning codes.
  • B. In the Restrict Future Pay Types section, move the pay types the group should not be allowed to access to the left.  Pay Types they are allow to enter remain on the right based upon the earnings they are allowed access to in the Pay Type Access Restrictions section.

In the example below, the Supervisor Security Group will be allowed to access the Personal Leave, Regular, Sick Leave, and Vacation earning codes, up to and including today’s date, but entering any time after today’s date will be restricted to Personal Leave, Sick Leave, and Vacation earning codes and Regular hours will not be accessible.

4. Click

Restricting A Security Groups Org Level Access

To restrict the organization levels a Security Group will have available for selection, establish those restrictions on the Group Security page.  These settings can also be set through User Security settings to apply to an individual employee.  In addition, Group Restrictions and User Restrictions may be used together.

Please Note: If parent-child relationships have been established within the company org level items, this will also have an impact on what the Security Group employee may access.

1. Select the Security Group to set up pay type restrictions for in the Select Group drop-down.

2. Click on the Restrictions tab.  No org level items listed in the Org Level Access Restrictions box means the Security Group will not be restricted and will have access to all org level items.

3. Company: If you have multiple companies built within your system that you must toggle between, select the appropriate company the employee belongs to. This is very rare as most organizations can use org levels within a single system to define separate companies.

4. Depth: Select the org level depth you would like to restrict.  Company ABC Glass has four org levels. Company, which has Locations within it. Each Location has Departments within it.  Finally, each Department will have a list of Jobs associated with it.

5. Permissions: There are four permissions that can be selected: restrict from all items, home items only, disallow all access, selected org level items.

    • All Items – for the organization level depth selected, all of org level items will not be available for the group.
    • Home Items Only – For the organization level depth selected, the group will only be able to see the employee’s home organization levels and will not be able to override organization levels to any value.
    • Disallow All Access – The group will not see this organization level depth for any Daily Procedures records or on the Employee Information – Groups page. The organization level will display on reports.
    • Selected Org Level items – The group will have access to the employee’s home organization level assignment as well as the selected organization level items when overriding an employee’s organization levels. Select those organization levels in the listing box below the org levels drop-down.

6. Move the org level items to the left the allow or deny access depending on the permission type selected.

In the example below, the IT Supervisor Security Group in company ABC Glass will have their Department org level items restricted to only allow access to IT Networking and IT Security.

7. Click

Add, Edit, Or Remove A Mobile Profile

Adding a Mobile Profile to a Security Group will determine what features the employees assigned to that group will have access to on the Mobile App. One group of employees could have access to punching and time-off requests, while others may just be able to use the time-off request feature. Mobile Profiles are also where any geofenced locations would be established. For more information on Mobile Profiles, please see our Mobile Profiles support page.

A. Select the Security Group to modify.

B. Select the Mobile Profile to apply, or select (none) to remove the ability to use the Mobile App. 

C. Click the button.

If a Mobile Profile is assigned to an employee's User Security page, it will take precedence.
Was this article helpful?
Dislike 1 0 of 1 found this article helpful.