0VENDOR value issues in one report BI

Question

Hi BI Experts,
We have an issue in one of our BI reports. One user (say 'A') has 0VENDOR=* in his analysis authorization and another user (say 'B') has 0VENDOR restricted to the value fetched for that user during runtime. Rest all authorization are same for A and B
In Table /BIC/AZSMOLD0100, User B is assigned to Vendor 'X'
When the report is executed,
User A is able to see the rates for various billing docs for all settlement documents nos. under vendor 'X'
But User B is not able to see the rates (rates column is empty) for various billing docs for setllement document no. under vendor 'X'
Issue#1: Is this a security error? If not then whats the issue?
Issue#2:
- When I gave '#' as a value in analysis auth for 0VENDOR ('#' is supposed to be for unassigned values), User B is now able to see the rates for various billing docs for settlement document nos. under vendor 'X', But in additon is also able to see data of vendor's to which it is not assigned. Does '#' here means all vendor's as in '*'?
- When I gave aggregation (' : ') as a value for 0VENDOR, user B us able to see rates but this again gives output for other vendors
Regards
Rasheed Ahmad

Answer 1

Issue #1: It sounds like a design issue. The recommendations above to use ST01 are useful, BUT... using the security error log tool under RSECADMIN will give you a much more accurate read on the problem. You can even execute the query using the rights of User A or B while using this tool.
Issue #2: The "#" symbol is a single character wild-card in the security system, and does not mean "Null". Hence your confusion. One should also not grant a specific value AND aggregate rights to a user, that confuses things.
Despite the availability of help files and a few SDN documents, we found the most useful way to understand analysis authorizations was to use RSECADMIN in a controlled fashion and determine exactly how things behaved.
One important hint... Do NOT grant an Analysis Authorization ("AA") to ANY user that contains a "*" or ":" authorization for any authorization relevant info object that you want to control for that user. BI 7 authorization works very differently from Bex 3.x authorization. Instead, we found that creating an AA for each family of infoproviders and authorization restriction worked best.