Thesaurus Payroll Manager Bureau version and Agent ROS Digital certificates

Thesaurus Payroll Manager Bureau version and Agent ROS Digital certificates

Thesaurus Payroll Manager is designed for installation on individual users’ PCs. However, many bureau users install the software to a remote desktop or a shared server. This enables all users to view all employer clients each time they run the payroll software. Each individual user still requires a password to access the employer clients that they are responsible for.

For PAYE Modernisation, a digital certificate is required to enable download of RPNs and submission of PSRs using the B2B API.

For a bureau, the cert used should be the overall admin certificate for the bureau’s TAIN. Additional admin certificates for additional TAINs may also be installed.

It should be noted that, once installed, users do not have visibility of the certificate password and will only have access to their own employer clients by virtue of the payroll passwords.

Remote or virtual desktop

The installation of digital certs on remote or virtual desktops follows the same process as on a local desktop.

The remote instance of Thesaurus Payroll Manager needs to be able to access the p12 or p12.bac file during installation of the cert.

If all users are accessing the same instance of Thesaurus Payroll Manager on the remote desktop, the certificate installed will need to be the overall admin cert for the TAIN used by the practice. For additional TAINs, additional certs may be installed and, once again, these need to be the overall admin certs for those TAINs.

Shared server setup

This is where the software is installed on a server and each user then runs the software from the server, accessing it through an icon/shortcut on their own desktop.

Normally the software will also need to be installed on each individual PC as the various library files used by the software will need to be accessible on each local machine.

Installing agent certificates in this environment requires a common admin cert to be installed on each individual PC. This would be achieved by the partner/manager installing the admin cert using a memory stick or shared drive containing the p12 or p12.bac file on each PC.

It should be remembered that this cert will only be used by the payroll software and is no good otherwise, without the relevant certificate password.

If it is preferred that employee sub certs are used instead of the overall admin cert then the software will not be able to hold the cert details for each user. Therefore individual users will need to install their sub cert and enter their password every time they launch Thesaurus Payroll Manager. Otherwise their RPN/PSR calls will fail due to invalid cert permissions.

Other options available are:

1. Install Thesaurus Payroll Manager on each individual PC and run the software locally. Cert details installed will be saved locally

2. Move to our other software BrightPay. Although BrightPay is installed locally on each PC, it can point to data files held on a shared server location.