Why different role types?

Hi,
Qust a simple question:
Why there is a special "nested" role? I would imagine that any role could be a "member" of other roles. Why is it not that way?
Motivation behind this is simple. Imagine a hierarchical role structure. Like an bank teller has some rights, teller supervisor has all the rigts of a teller plus some additional rights, departmet director has all the rights of a supervisor (and teller) and yet some other, etc.
I will neet to create "directorManagedRole" that will contain the directors, then create "directorNestedRole" that will contain "directorManagedRole", then "supervisorManagedRole", then "supervisorNestedRole" that will be "supervisorManagedRole" + "directorNestedRole" ... I hope you get the idea.
There are plenty of role definition objects that will complicate the management of role hierarchies. I will need to create at least two role definition per "business layer" role. And this can create real confusion, because I have to assign users to "*ManagedRole" but check for "*NestedRole".
Are there any reasons why it is implemented in such a way? Why the role mechanism cannot be unified?

Similar Messages

Different role types. Was: "Hi sap gurus"

define and differentiate the following types of roles
1.single role
2.composite role
3.derived role
4.child role
5.parent role
Message was edited by: Moderator
Please use meaningfull thread subject titles.

Hi
There are 5 types of Roles:
1) Single Role.
2) Composite Role. (Max 164 Single Roles can be attached to one Composite Role)
3) Derived Roles.
4) Orphans Role.
5) Reference Roles.
Composite roles 
A composite role is a container with several different roles. For reasons of clarity, it does not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are also called roles.
Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role. Creating composite roles makes sense if some of your employees need authorizations from several roles. Instead of adding each user separately to each role required, you can set up a composite role and assign the users to that group. The users assigned to a composite role are automatically assigned to the corresponding (elementary) roles during comparison.
The menu tree of a composite role is, in the simplest case, a combination of the menus of the roles contained. When you create a new composite role, the initial menu tree is empty at first. You can set up the menu tree by choosing Read menu to add the menus of all roles included. This merging may lead to certain menu items being listed more than once. For example, a transaction or path contained in role 1 and role 2 would appear twice. If the set of roles contained in a composite role changes, the menu tree is also affected. In such a case, you can completely rebuild the menu tree or process only the changes. If you choose the latter option, the Profile Generator removes all items from the menu, which are not contained in any of the roles referenced. It is possible (and often necessary) to change the menu of a composite role at any time. You adjust these menus in the same way as the menus for roles.
Derived roles 
Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before.
The higher-level role passes on its authorizations to the derived role as default values, which can be changed afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either. Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level.
The menus passed on cannot be changed in the derived roles. Menu maintenance takes place exclusively in the role that passes on its values. Any changes immediately affect all inheriting roles. You can remove the inheritance relationship, but afterwards the inheriting role is treated like any other normal role. Once a relationship is removed, it cannot be established again.
In real time scenario Roles and Authorizations are primarily based on Company codes in many cases and in some scenarios are also based on Cost centers or divisions etc. IN such scenario, a Master role is created and many child roles are created with relevant Organizational levels added to the same. So any change to the master role would be drilled down to Child roles and hence it would avoid a lot of Maintenance overhead.
E.g.: Master Role -- Z_SAP_FI_BUYER_000
Child Role1 -- Z_SAP_FI_BUYER_CC1
Child Role 2 -- Z_SAP_FI_BUYER_CC2
Child Role 3 -- Z_SAP_FI_BUYER_CC3
Orphans Role
Orphans Roles are Stand-alone roles and are many a times required for IS uses/. So a System Admin role, a Security Auditor role and many other special roles mainly not used in Business side are created as ORPHANS. This role limits the user to a particular organization.
Reference Role
They are SAP standard Roles.
Reward points if helpful

AP- Why exchange rate type between Post invoice and Post payment is differe

AP- Why exchange rate type between Post invoice and Post payment is different ?
Hello,
I have question
when post AP invoice , document type KR
document date = 11.12.2009
posting date = 31.12.2009
entry date = 05.01.2010
this document using exchange rate type B (standard translation at bank selling rate) on 31.12.2009 (use posting date )
but when post payment for above document,document type ZP
document date = 25.06.2010
posting date = 25.06.2010
entry date = 24.06.2010
this document using exchange rate type M (standard translation at average rate) on 23.06.2010
please answer
why do post invoice and post payment use different exchange rate type?
and why at payment donot use posting date for get exchange rate ?

Nanas,
Sorry if im not being clear...
My point is: the difference rates customization for payments is done at FBZP.
At Paying Company Codes, you have 4 flags for exchange rates differentes.
At Control Data look:
*Do not Post any Exchange Rate Differences:
If the indicator is not set, the difference between the exchange rate at the time of posting and the exchange rate at the time of payment is determined for items which are posted in foreign currency. The payment program uses the translation rate in the currency table in the system for this purpose.
*No Exchange Rate Differences for Partial Payments:
Has the effect that the payment program for partial payments (requests for payment using transaction F-59) does not post exchange rate differences.
*Processing of Bill of Exchange Payments:
*Separate Payment for each Payment Reference
Regards
Bruno

PR generated with different doc type in rollout porject ....why?

Dear Friends.
We have done rollout.
Earlier imlementation - c. code=A200 .
Using standard document type-NB for PR generation.
Latest Rollout - c. code =A100
Using copy of standard document type NB as ZNB for PR generation.
My problem is that when in A100 MRP runs it generates PR with doc. type-NB (NOT ZNB) why?
same way PR generated by Plant maintanace module(PM) in doc.type-NB(Not ZNB) why?
Regards,
Mahesh.

Hi,
Check the below path of configuration, PR created with MRP run have different document type.
SPROMM-Consumption based planningplanningprocurement proposalDefine external procurement.
Hope it will help you
Thanks

Vendor Payment with different document types

Dear Sapguru,
We have a scenario where a particular vendor payable is in two different document types for example, RE and KZ.
When we execute TC F110, the payment proposal is grouping the payments by document type. I.e. it grouped all the documents under type RE and grouped all the documents under type KZ and created two line items in the payment proposal.
Actually, we want to have a single group consisting of all the document types payable to the vendor.
We have checked different SAP notes and also verified out system settings, but the problem still remains.
Can somebody let us know how to group all the open items in a single line item in F110 irrespective of document types.
Thanks in Advance.
Regards.,
Rama

Dear Naravi,
the main factor which affects the grouping of items is the Structure ZHLG1:
ZBUKR
ABSBU
LIFNR
KUNNR
EMPFG
WAERS
ZLSCH
HBKID
HKTID
BVTYP
SRTGB
SRTBP
XINVE
PAYGR
UZAWE
DTWS1
DTWS2
DTWS3
DTWS4
KIDNO
All these fields have to coincide, to have a single payment.
Please check why two documents with different document type are paid into two different payments.
Read the SAP notes 109233 and 164835 and 305414 as well.
I hope this helps.
Mauri

How to assign different Message Type to different Doc. Types

Hi,
Can anyone tell me how can I assign different Message Type to different Doc. Types e.g. in ME21N. So that whenever the Doc Type is selected the respective Message Type is automatically assigned.
Lucky

hi there
follow this path
spro - materials management - purchasing - messages - output cntrol - message types - define message types for p/o
then
spro - materials management - purchasing - messages - output cntrol - message determination schemas - define message determination schemas for purchase order
then
go to
mn04
give doc type - enter
enter partner role & other parametrs

How do I set CUP to display the different request types user-interface?

How do set CUP to default into the initial Request Access screen with request links? The one that lists different request types for end-user to click on the link of the preferred request type?
I am running GRC 5.3 and when I click on CUP from the lauch pad, the system takes me straight to the My Work tab, and I don't want users to request access at that level.
I would want them to initially see the request access link, and choose a request type by clicking on a request type link (without having to log-off and log back on in order to see the link).
Thank you in advance for help in this..
Regards,
Odwa

That is a good point. You would only achieve hidding the link there as well - and would make the launchpad difficult to use for users who do want to logon first.
This is a case comparable to using ST01 on performance optimized coding while "testing" with SAP_ALL. It looks like you need full access (*) to do anything, until you test it with the enduser role...
Perhaps we can have some infos here from the OP on what this change is intended to achieve? Probably there is a better solution than changing the stylesheet.
Cheers,
Julius

Different reference type passed to SubVI

Hi all,
I use a subVi to access some properties of an XY graph (scale, offset ...) that's why I use a reference to the graph and give it to the subVI.
Now I would like to use the same subVI in order to modify the same properties but for an intensity graph.
Of course when I connect the intensity graph reference to the subVI, the wire gives an error related to incompatible reference type.
Could someone tell me how I could proceed to connect different reference types to the same subVI input?
I tried to use "to more generic class" component but I'm not able to find how to use it in this case.
Thanks in advance for your help

Hi Fabrice,
You could place a Case Statement indexed by the type of graph whose properties you want to access / modify, etc. The reason for mentioning that is the fact that you may not be able to use the same property node for both types of graphs, especuially if you access properties that are not common between the two.
There may be tricks that you could try, but as far as using the component "to more generic class", it would have to be located in the calling vi and not the sub-vi. That is so the same (sub-vi) Terminal can be used.
However, I am not sure that it would work... I think I understand what you are trying to do... I'm not sure if you'll be successful due to the reference types (might be worth a try).. Nevertheless, if you simply wish to use the same sub-vi for two different graph types, then using the Case Statement will be the quickest solution to implement.
RayR

Cost / Revenue for Project Role Types

Dear All,
I need your suggestion on cost / revenue rate for multiple project roles type of the project elements. I am defining various project roles such as account manager / project manager / Team leader / Team members etc. which will be assigned to project. There will be different cost / revenue hourly rate for each role type. I have defined hourly cost / revenue rate for organisation management. But i oberved that hourly rate is getting copied to all type of role in project & the same is update as planned cost.
Request you to suggest how to mainatin different hourly rate for various project roles in side project.
Thank you in advance.
Regards,
Ranjan

Hi,
Make sure you have done following settings
SPRO>Collaboration Projects >Connection to External Systems>Accounting Integration>Define Cost/Revenue Rates
here you define Cost revenue rates
Now i feel you have assigned these rates in define Task types in SPRO>Cproj>structure>define task types
in this case it ll take same cost revenue rates.
you remove these
and in SPRO >Collaboration Projects > Resource Management>Basic Settings for Project Roles> Role types
assign the rates.
clear the browser Cache, cookies.
Make sure you log off and then try to create new Project with the settings
It shd help.
P.s. Zhenbo plz correct me if im wrong...
Niranjan
Award points if useful.

Why custom inspection type?

Hi Guys,
Why would we need custom inspection type? What criterion should be considered while configuraring custom inspection types?
Can somebody throw a light on this?

There are several reasons. The primary resaons is that for certain functionality can be assigned at the inspection type level. this includes:
1) different plan usages - inspection plans have defined usages. An inspectoin type searches for plans with specific usages. You might want to have different sets of plans for different purposes. An 04 might use plans with usage 05. While a Z04 might use plans with a usage of 03. You might create manual inspection lots with the Z04 and automatic ones with the 04.
2) Copy results functionality is set up by inspection type. In the same plant you might only want to use copy functionality for certain materials, so you set up different inspection type for that.
3) you can set up the default values that are used in the material master for each inspetion type. If you have a situation with vastly different settings, having a second inspection type might help in maintainance.
I'm sure their might be other uses as well that others here can mention.
FF

Different structure types in itab

hello experts,
how can i fill the itab with different structure types.
if i give the componenttype/domain to 'any' in my structure declaration, then its not saving and showing the error.
how to solve this problem
thanks
Tim

Hi,
I think there is no general structure which accepts data of any types. I have the doubt why you need one internal table for storing data of different structure. You can declare multiple internal tables and store corresponding structure to that itab.
If you are looking for some internal table type whose structure can be dynamic then you can go for Field symbols table which is of form
field-symbols <itab> type standard table.
this can hold data of any structure.
but not rows of different structure ( which i think have no reason to be so )
Cheers
Kothand

Different roles depending of URL?

Hello,
we want to implement access to our Portal EP 6.0 SP9 from Intranet and Internet.
User should get different roles depending the URL.
Example:
Intranet URL: http://server:50000/irj/portal -> role A
Internet URL: https://domain.de/portal -> role B
Reason is security, critical systems are only in role B.
How can I do that?
Thanks
Frank

Frank,
my I propose a different approach? I looks as if you want to separate internal users (entering without proxy server) and edxternal users (coming through a proxy). Why not simply create an additional authentication scheme for internal users (probably the higher priviledged ones). Build a custom login module that checks the origin of the user (internal/external, e.g. based on the request's IP address).
Now, you have two authschemes, say "internal" and "external". Assign "internal" a higher priority value than "external" and assign this authscheme to all critical content.
Thus, all users that want to access this content, need to pass the "internal" authscheme. Users coming from external willl fail this test and thus can't access the critical content.
Hope this helps you. If so, please mark this question as closed and reward points. Otherwise give some lines why this is not helpful for you - or if you need further assistance.
Regards,
Dominik

RFID Fixed Device: Different action type

Hi Forum,
we are working with a fixed device.
The same "device group" could send via PML message different command:
- Tag commissioning
- Tag decommissioning
AII determines and execute the right "rule"
Unfortunately AII determines the same "action type", because in customizing ("Condition and rule --> Activities --> Assign action type to Device Group role") to the same Business Role/Doc Type we could assign just one default "action type".
How could we address different action type? Is there an additional field in PML message we could manage? Or ...?

Hi Paolo
There are two ways:
1.Maintain different device groups for different roles corresponding to different action types. Thus, in this approach it is not possible to assign different roles to same device group.
2. Alternatively, define one device group. To this device group assign ALL Roles. Now assign different action types to this AII Roles.
Also maintain the condition for fixed devices for different business processes.
Going by second approach you will be able to assign diiferent action types to one role (i.e. ALL Roles) under one device group.
The only problem with the second approach is, you wont be able to maintain the different location ids for different processes for the same device group.

While transporting a role getting issue - Role type is undetermined

Hi
While trying to transport a single role getting the below error :
Role type is undetermined.
Can somebody help?
Regards
Saurabh

Saurabh,
I faced something pretty much similar and snote:: "770358 - PFCG: Role copy fails due to data inconsistency" worked perfectly for me.
Snote describes quite nicely about the root cause.
Please note this error might come up when you try to copy this role, perform pfud as wel.
Thanks,
Brahmeshwar

Join columns of different data types

Can i join two columns of different data types in a single statement. Is there any cast or convert statement
SELECT B~PARTNER AS RESP_GROUP
FROM BUT000 AS B
INNER JOIN CRMV_LINKPARTNER AS C ON BPARTNER_GUID = CPARTNER_NO.
Here PARTNER_GUID is Raw 16 and PARTNER_NO is Char 32, the query is not returning any rows.
Thanks
Akila.R

Hi!
Basically we can say, you can't join them, but you might try this way:
SELECT B~PARTNER AS RESP_GROUP
FROM BUT000 AS B
INNER JOIN CRMV_LINKPARTNER AS C ON BPARTNER_GUID = CPARTNER_NO(16). "add
(16)
Or an other version
C~PARTNER_NO+16(16) "depends on, where is the real number stored
Regards
Tamá

Why different role types?

Similar Messages

Maybe you are looking for