How Does Banner Security Work? Classes, Objects and Roles
Banner controls access with users, security classes and object roles, plus value-based and finance security. How it fits together and how to keep access clean.
How does Banner security work?
Banner security grants access to objects (pages, processes and reports) through security classes. Each class is granted objects with a role such as BAN_DEFAULT_M (maintenance) or BAN_DEFAULT_Q (query-only), and users are assigned to one or more classes, usually on GSASECR. On top of object security, Banner supports finer controls such as fund and organisation security in Finance and fine-grained access control that limits which rows a user can see.
Overview
Banner security is role-based: objects go into classes, classes go to users.
The layers
| Layer | What it controls |
|---|---|
| Object security | Which pages, jobs and reports a user can open, and whether they can change data |
| Security classes | Bundles of objects that represent a job role, such as "Registrar clerk" |
| Value-based / fine-grained access | Which rows a user can see, for example only certain student levels |
| Finance fund/org security | Which funds and organisations a user can query or post to |
| Self-Service roles | What students, faculty and employees can see in Self-Service |
A clean security model
- Design classes around roles, not individuals.
- Separate query and maintenance classes where possible.
- Review access at least yearly with each module owner.
- Remove access promptly when staff change roles or leave.
- Log and audit high-risk objects such as payroll update or grade change.
Important: SSO does not replace Banner security. A user who can sign in still needs the right classes. See how SSO works with Banner 9.
ITCadence runs Banner security reviews and access clean-ups. Book a review.
Frequently asked questions
BAN_DEFAULT_M allows maintenance (insert, update, delete) on an object, while BAN_DEFAULT_Q allows query-only access.
It is better practice to grant objects to security classes and assign users to classes, so access is role-based and easier to audit.
SSO handles authentication (who you are). Banner security still controls authorisation (what you can do).
Last reviewed by the ITCadence Banner team. Ellucian product capabilities vary by version and licence; confirm details against current Ellucian documentation.
