Signing in, and who can do what
Signing in
Open the address setup gave you, like http://SERVERNAME:47474, in Edge or Chrome. Ledger Doctor signs you in with your Windows account; there's no separate password. Your name shows at the top right of every page.
If the browser asks for a user name and password, the server isn't in the browser's Local intranet zone. Single-label names like GPAPP01 usually are. Ask IT to add http://SERVERNAME to the Local intranet zone by Group Policy.
If Edge or Chrome shows a bare "HTTP ERROR 401" page instead, Windows sign-in wasn't sent. Two common causes:
- An InPrivate or Incognito window. These don't send your Windows sign-in. Use a normal window.
- On the server itself, or another Windows Server, with Internet Explorer Enhanced Security Configuration on. The browser doesn't trust the address for Windows sign-in. Ask IT to allow it by Group Policy (Edge:
AuthServerAllowlist; Chrome:AuthServerAllowlist), listing the server's name, orlocalhoston the server itself.
The four roles
A Ledger Doctor admin gives roles on the Security page, to Windows groups or to people, for one GP company or all of them. Once Security is on, someone without a role sees a page asking them to contact an admin, and nothing else.
| Can | Viewer | Processor | Approver | Admin |
|---|---|---|---|---|
| See issues, closes, reconciliations, tie-outs and reports, and download them | Yes | Yes | Yes | Yes |
| Scan and recheck, work close tasks, prepare reconciliations, write flux explanations, follow guides | Yes | Yes | ||
| Preview a fix, and ask an approver to apply it | Yes | Yes | ||
| Apply and undo fixes, mark findings as expected, review close tasks and reconciliations, sign off the flux review, change the close steps | Yes | |||
| Manage Security and Settings, install updates | Yes |
Admin doesn't include Approver: managing access doesn't by itself let someone approve fixes. An admin who also approves gives themselves Approver too. Admin is always for every company.
The people setup listed as approvers (in ledgerdoctor.json on the server) are always admins, so there's a way back in if the last admin is removed by mistake.
Before Security is turned on
After the update that adds Security, Ledger Doctor works as before until an admin turns Security on: the people setup listed are admins and approvers, and everyone else who can reach the page is a processor. Give the roles first, then choose Turn Security on. Ledger Doctor won't turn it on until someone has Approver, and the admin turning it on keeps Admin.
Approval rules
- Someone else reviews. Whoever completed a close task, or prepared a reconciliation, can't also review it. Tasks Ledger Doctor completes itself, from a check that found nothing, don't need a review.
- Two approvers for fixes that change posted amounts. The first approval waits under Needs approval; a different approver's approval applies it. Fix history names both. Fixes that don't change amounts need one approver.
- Small team. With fewer than two approvers, an admin can turn on Small team: let one person do it alone. One approver can then review their own work and approve amount fixes alone. Every time that happens, it's written to the security log. See If one person does the accounting, or one person approves.
The rules apply once Security is on.
If one person does the accounting, or one person approves
Many companies have one person in finance, or a small team where one person approves. Ledger Doctor works for both. When an admin ticks Small team: let one person do it alone on Security, a panel opens before anything is saved. It asks how your team works and offers to set the roles up for you.
One person does the accounting
That person needs Approver for every company they work in. A Processor can only ask for fixes, and with nobody else to approve them, the requests would wait forever. The panel lists everyone, people and Windows groups, who has Processor on any company now, with the companies.
Click Make them Approvers and turn on Small team. Each of those Processor roles becomes Approver for the same companies, and Small team turns on. Viewer and Admin roles stay as they are. If nobody has Processor, the panel just turns Small team on and says who the approvers are.
A small team with one approver
For two or three people where one person approves. Pick the approver from the people and groups who have Processor or Approver. If exactly one has Approver now, they're picked to start with. If the person you pick is a Processor, they're made an Approver for the companies they have.
Everyone else stays a Processor. Their fixes go to the approver as requests, and the approver reviews their close work, as usual. With Small team on, the approver can also review their own work and apply fixes that change posted amounts alone. If someone else also has Approver, the panel names them, with a box to tick if they should be a Processor instead. Nothing changes for them unless you tick it.
Click Set up the approver and turn on Small team.
What the panel points out
- A Windows group. Making a group an Approver makes everyone in it an approver. The panel names the group.
- Two or more approvers. Small team is meant for teams with fewer than two approvers. If the change would leave two or more people or groups with Approver, the panel says so. You can still go ahead, or choose Just turn on Small team.
- Nobody with Approver. Security can't be turned on until someone has Approver. Give it to someone first.
Just turn on Small team turns it on and changes no roles. Cancel changes nothing. Each role change, and turning Small team on, is written to the security log, for example "Made RIDGEVIEW\mlopez an Approver for TWO (Small team setup)". The Security page then shows how Small team was set up, such as "Small team: one approver, RIDGEVIEW\mlopez". Turn Security on when the roles are right.
With Small team on, the approver can apply any fix themselves, including fixes that change posted amounts, which run straight away instead of waiting for a second approver. They can also review their own close tasks and reconciliations. Each time they do something the rules would normally give to a second person, it's written to the security log, so an auditor can see when one person did both.
If someone says a fix is "waiting under Needs approval", or that they can't review their own task, check two things on Security. Is the person who should approve an Approver rather than a Processor? And is Small team on?
Needs approval
Approvers see Needs approval in the menu, with how many things wait on them: fixes a processor asked for, amount fixes waiting for a second approver, and recently completed close tasks to review.