Analysis Authorization Object not working

Hi Gurus,
I m working on BI 7.0, I have created an analysis authorization object zz_div for 0DIVISION characteristic.
For a given report i want a given user to view only data for '32' and '33' 0DIVISION.
I have followed the below steps but still the report shows all data instead of restricted one.
1)RSECADMIN -> Maintenance ->zz_div ->Create
2) Add 0DIVISION in Auth structure , and in details
I     EQ     32
I     EQ     33
3) Add 0TCAIPROV with I     EQ     0SD_C03
4) Add 0TCAACTVT, 0TCAKYFNM, 0TCAVALID, this having details as
I     CP     *
5) Then in User tab -> Assignment -> User -> Change-> Inserted ZZ_DIV-> Save
6) In Query created a Authorization variable(with no input prompt) and restricted 0DIVISION.
Following are the authorization object in that user's Role (Reporting Only)
S_RFC
S_TCODE
S_GUI
S_BDS_D
S_BDS_DS
S_OC_SEND
S_RS_AUTH - only having zz_div
S_RS_COMP
S_RS_COMP1
S_RS_ICUBE
S_RS_RSTT
S_RS_TOOLS
S_RS_PARAM
I have surfed lots of thread for this issue but not getting a solution
Tell me what i m missing in above or any additional setting need before creating analysis authorization
Edited by: Sonal Patel on Apr 18, 2009 8:10 AM

Hi
Thanks a Ton for ur reply
I have checked in SPRO : Analysis Authorization
where the authorization mode is " OLD obsolete Concept With RSR Authorization Objects "
We have to do the same in Production system .Can u please how its going to effect to others authorizations if change it to New Concept
Thanks
Sonal....

Similar Messages

Hierarchy Analysis Authorization does not work after transport

Hi Gurus,
I am facing a issue in hierarchy analysis authorization in quality system but the same authorization works perfectly fine in development.
All hierarchy authorizations works in Quality except for this one. I found one old sap note describing this as program error but this note is not applicable in BW 7.3.
I have checked the table RSECVAL, RSECHIER and authorization is active so everything looks good. Please advise if anyone faced this issue after transporting hierarchy auths to other systems
Regards,
Salman

Salman,
What I understood from your description is that you have same role+AA in Dev and QA, which provides access in Dev for all the nodes for said hierarchy but in QA, same role+AA provides access to the same hierarchy for all the nodes but one. Try to create a ZTEST analysis authorization in QA itself with access for the problematic hierarchy node and see if it works ? This will rule out the case if there is a difference in hierarchy in DEV & QA.
Regards,
Shivraj Singh

SU24 - Search by Auth object returns "Authorization object not available"

If I try to select by Authorization Object :
F_CLOS_BKA
or
M_MATE_DG
I got "Authorization object not available" error
I can't find F_CLOS_BKA and M_MATE_DG in the TOBJ table as well.
But if I select by Transaction :
F975
or
DGR3
It display
F_CLOS_BKA CHECK YS
M_MATE_DG CHECK YS
Question : Is this Normal?

Hi Dominick,
I recommend to open a ticket at SAP to clarify that....
The correct components should be:
F975-->IS-B-BCA-PT-GLP
DGR3-->EHS-DGP
I suggest to ask them (as they are responsible for delivering the values for SU22) why the deliver proposals for
objects, which do not exist (I have found note #1170774 for F_CLOS_BKA (but this note is 'brand new'), M_MATE_DG seems not to be delivered at all).
It would be nice, if you would post the result of your queries...
thx,
B.rgds,
Bernhard

Quicktime objects not working on GoLive

I have a GoLive CS2 Student Version. My Quicktime Objects are not working. I tried to drag the track objects to the page or to layer and no avail.
Can you help me? I spent a whole day to finally figure out the Quicktime objects not working.

Thank you for the support John,
To explain what I am doing in more detail: I am basically making an image gallery with thumbnail buttons of each image. When the user enters this page I want to have the automatic slideshow of a few images. Then the user have the option to click on the buttons to see the images. I was able to make a slideshow in GoLive. But the transition is abrupt. According to the GoLive Help Menu there is a way to make the trasnition smoother using the timeline editor, but it is too difficult to follow up for me. So I downloaded another program called SWFn'Slide which was very easy to make the smooth transitional slideshow. Now I am trying to insert the SWF file into my page. But I can't figure out how to do it. In my understanding, I must place a layer on the page and on that layer I must place the SWF track from the Quicktime Objects tab. But I cannot drag any of the Quicktime Objects tools into the page. Again I am having a problem inserting a SWF file into the page.

ME21N Material group level authorization is not working in ECC 6.0

Dear Security Experts,
We have created a role Z_ME21N with one Tcode ME21N. The role has to restrict users in the material group level.
For that, we added Authorization object M_MATE_WGR.
1. When we are trying to add field values for {M_MATE_WGR, BEGRU}, generally it should show me the list possible values to be used based on the MM configuration related to Material Authorization Group. We have correctly configured the authorization groups from V_TBRG for M_MATE_WGR. But itu2019s not showing any possible values.
2. However we are able to add values manually, but I guess these are not being considered during authorization check and our restriction on Authorization group level in ME21N is not working.
Test Scenario: We have manually added values 005,007,009,010,013 (which is pointing to specific material group) to BEGRU of M_MATE_WGR. We already assigned this Authorization Object to role Z_ME21N and this role has been assigned to u2018testuseru2019, but the authorization check with the M_MATE_WGR authorization group is not happening. It allows operations on all the material groups.
Anybody came accross same scenario?
SAP Prodcut version : ECC 6.0
Database : SQL Server 2005
Support pack level : 15
Please share your views, thanks in advance.
Regards,
Abu Sandeep

Dear All,
I got a reply just now from SAP regarding the same issue.
I coudnt understand what SAP and you are saying.
Dear Abu
*Apologies for the delay. This message has been turned on to application*
*area of MM from the Basis side just now.*
*Unfortunately, authorization object "M_MATE_WGR " is not checked*
*in the purchasing transactions (PR & PO), the system works as standard*
*functional designed.*
*Only the following objects are checked in PR/PO:*
*M_BEST_BSA Document Type in PO M_BANF_BSA Document Type in PR*
*M_BEST_EKG Purchasing Group in PO M_BANF_EKG Purchasing Group in PR*
*M_BEST_EKO Purchasing Org. in PO M_BANF_EKO Purchasing Org. in PR*
*M_BEST_WRK Plant in PO M_BANF_WRK Plant in PR*
*Setting in check/maintain on in SU24 only means that the profile*
*generator will propose the object when creating a user, however is*
*does not mean that M-MATE_WGR will be checked.*
*Please close this message by pressing the confirm button at your*
*earliest convenience.*
*Many thanks in advance for your understanding.*
So, how can I resolve this problem? John, are you sure that, you implemented this successfully?
SAP says, this cant be done.
Regards,
Abu Sandeep.

BI authorization objects not appearing in RAR, error while generating role

Hi
I am facing certain problems relating to integration of BI module version 7 with GRC Access Controls version 5.3 and support package 06. I am describing the problems in details below:
(a) In Risk Analysis and Remediation (RAR) component, I am creating Functions and
      Risks for Business Intelligence (BI) module. For that I have downloaded the
      descriptive text and authorization object data from BI development system and
      uploaded the same in RAR. Then I have created 2 Function Ids DBI1 (having action
      RSA1) and DBI2 (having actions RSA11, RSA12, RSA13, RSA14, RSA15) and 1
      Risk Id for BI (having Function Ids DBI1 and DBI2) in RAR. But when I checked
      the permission tabs of the Function Ids DBI1 and DBI2, I could not find any
      authorization objects for the actions in them.
(b) In Enterprise Role Management (ERM), when I am trying to create a Role TEST-BI
       in DBI 100 and I put the BI transaction codes in authorization data , I get the
       authorization objects . Risk analysis is also being done successfully. But at the time
       of Role generation in background mode , it is giving an error message :
       Error generating role TEST-BI for system DBI 100: Unable to interpret * as a number.
       I am thus unable to generate any role in DBI 100.
(c) In Compliance User Provisioning (CUP), I have imported a standard role from DBI
      100. Then I have added Functional Area, Business Process, Subprocess and
      Criticality Level to this role in CUP. But when I try to assign this Role to an user, it
       gives an error Error creating request. But requests are getting created and roles are
       being assigned to users in ECC development systems using the same Initiator, CAD, stage
       and path.
Can anyone please help me ?

-

Authorization CRM_BPROLE not working

Hi Experts,
We need below authorization for business partners in CRM 2007 UI,
Accounts - Only Edit & Display
Contacts - Create, Edit, Display
Employees - Only Display
For that we are using CRM_BPROLE authorization object as suggested in SAP Note 1129682 we also activated the BADI as mentioned in the Note. But the authorization object is still not working, is there anything else that we must do to make this object active.
We tried using CRM_BPROLE along with B_BUPA_RLT also, but that too is not working in CRM UI.
Appreciate you help.....
Regards,
Vikas

Hi,
at my current customer I have implemented OSS note Note 1259940 - Authority check for accounts depending on roles
Symptom
You use the authorization object B_BUPA_RLT and the activity 02 to control whether the user has the authorization to change data, depending on the roles that are assigned to an account, contact or employee. If the user has no change authorization for at least one business partner role, then the user is not authorized to lock the business partner.
Other terms
CRM WebClient UI
B_BUPA_RLT
PFCG
PARTNERROLE
Solution
Implement the method IF_UIU_BP_AUTHORITY~CHECK_EDIT of the BAdI BADI_CRM_BP_UIU_AUTHORITY in the enhancement spot CRM_UIU_BP_ENHANCEMENT. For this, implement the source code contained in the correction instructions. This note cannot be implemented using SNOTE.
I have setup my roles in that sense that I have maintained the same values in both objects, meaning CRM_BP_ROLE and B_BUPA_RLT. This works pretty well so far...
Kind regards
Davy Pelssers
SAP CRM/SAP Security consultant
www.dasap.be

Authorization object not to allow certain user to enter sloc PO

Dear All,
i have manage to go su21 to create under mm purchasing authorization object called Y_BEST_LOC with Acty and LGORT field. other than that i have insert check item under program RM06ENHI. after that i go to su24 to assign the transaction code check for me21 and me22. under field value for me21, my new object i want to assign value (interval) = $LGORT, but don;t know how so i leave it blank.
Come to user profile i adding this object into the authorization to check, and put in only allow for 0001 and 0002 location. But the user still can save the PO when choose 0004 without error. I want to know missing step that should be done to prevent certain user to order under 0004 storage location.
Kindly suggest and guide me. thanks in advance
Regards
Aishah

ME21/ME21N doesn't even check if the material is extended to the storage location entered in the PO. I don't think what you did is enough to restrict users per storage location, you need to find a user exit or BAdi and do the authorization check in the your custom code
AUTHORITY-CHECK OBJECT 'Y_BEST_LOC'
         ID 'ACTVT' FIELD '01' "Create
         ID 'LGORT' FIELD '0002'. "Storage Location 0002
IF SY-SUBRC = 0.
" User has authorization
ELSE.
message 'Not authorized for storage location' type E
ENDIF.
You may have to use the following Business Add-in (TCode SE18)
ME_CHECK_ALL_ITEMS                    : Run Through Items Again in the Event of Changes in EKKO

Display/Change/Delete of planning object not working in BPS

Hi Guys
While displaying or changing object in planning workbench, system is taking too long to process the request and request doesn't completes even in hours. The following operations are not working
1. Delete Planning Area/Level.
2. Display/Change planning Level.
3. Display/Change Planning Layout.
4. When clicking on Variable Tab of infoarea.
5. When clicking on Set variable button.
In all of the above mentioned cases System displays a message "Generating Environment" and it runs for indefinite time.All this is ha0
We are on Suppport Pack 12 of BI NetWeaver(2004S)and we are using BPS for our planning application.
Thanks
Tripple k

Hi Dear
Thanks for info. i know that it will take some time to regenerate the BPS classes after making changes in cube but in my system its taking at least half an hour which i think is too much.....i don't think that its normal behaviour of system...
Thanks
Kamal

Create Type as Object not working in linux oracle 11g

Pleae refer to the following simple create type as object statement.
CREATE OR REPLACE TYPE EC_VIEWABLETYPES as object ( CASE_TYPE_ID NUMBER)
It is working in oracle 11g and windows server 2008 environment.
But it is not working in oracle 11g with linux environment.
I am executing this statement as dynamic sql as follows
CREATE OR REPLACE PROCEDURE TEMP_SP
AS
BEGIN
DECLARE vcType VARCHAR2(30);
BEGIN
SELECT OBJECT_TYPE into vcType FROM USER_OBJECTS
WHERE OBJECT_NAME='EC_VIEWABLETYPES' AND OBJECT_TYPE='TYPE';
EXCEPTION
WHEN NO_DATA_FOUND THEN
EXECUTE IMMEDIATE 'CREATE OR REPLACE TYPE EC_VIEWABLETYPES as object ( CASE_TYPE_ID NUMBER) ';
COMMIT;
RETURN;
END;
END;
exec TEMP_SP
please let me know what i am missing ?

And error is:ORA-00600: internal error code, arguments: [kothc_uc_md5:lxerr], [], [], [], [], [], [], [], [], [], [], []
ORA-06512: at "ATIPAGENT.TEMP_SP", line 10
ORA-01403: no data found
ORA-06512: at line 1
..Query:exec TEMP_SP...Previous Query:CREATE OR REPLACE PROCEDURE TEMP_SP AS BEGIN DECLARE vcType VARCHAR2(30); BEGIN
SELECT OBJECT_TYPE into vcType FROM USER_OBJECTS
WHERE OBJECT_NAME='EC_VIEWABLETYPES' AND OBJECT_TYPE='TYPE'; EXCEPTION WHEN NO_DATA_FOUND THEN
EXECUTE IMMEDIATE 'CREATE OR REPLACE TYPE EC_VIEWABLETYPES as object ( CASE_TYPE_ID NUMBER) ';
COMMIT;
RETURN;
END;
END;

ISE authorization Policy not working

Hi ,
I have configured the ISE as per the belwo link
https://supportforums.cisco.com/document/110031/central-web-authentication-cwa-guests-ise
but my authorization policy is not working as when user get connected to guest wlan it get authneticated but when it look for authorization
it going to default policy it should hit on above policy created screen shot as below

What version of ISE + patch are you running?. Could you please send an screenshot of AUTH policies including the default --- > USE part?. Are you using customized portal for the first authentication process?
CWA is pretty straightforward. Only issues I faced was multiple VM (ISE Personas) running on one single server was not replicating properly the AUTHZ policies so I added the PSN persona into the PAN Node and everything worked fine immediately. In addition to that, I realized that I needed at least ONE ENTRY into the ISE PAN Internal Endpoints DB so I could hit the AUTH Policy for MAB & user not found condition which sent me to the AUTHZ = User Unknown + Redirect. Once I authenticated the user using the Default Portal that meant I hit the GUEST FLOW policy. If you are using customized portals for the first authentication process, check: web portal mgmt. --- > Guest --- > MultiPortal Configurations --- > Customized Portal -- > Authentication part.

Substituting View object not working.....

Hi All,
I am working on iSupplier portal, I am trying to add requeter name on the line lavel of PO details page of iSupplier.
But the by substitutions of Standard View Object is not working.
1. I have extend the PosViewLinesVO object with Custome PosViewLInesVOEx
2. Add the View Object in the ViewOrderAM.class
3. Go to SSTest.jpr file and add the substitutinons by edit optin.
4.Then trying to test on the standalon . But the it's not working
5. The View PosViewLInesVO having viewlink with PosViewShipmentsVO so i am unable understand, if i am add a new column requeter name on the personalization than it giving error.
6. I f i open the about the page is shown both the view original view PosViewLineVO and the Extend View PosViewLinesVOEx.
Can any body help me. why the View Substitution is not working.
I have the screenshots of the error but am not able to attach it over here. Could you please ping me your ID so that I can forwards the Error Msg file to you guys.
In the doc,I have attached the screen sort and the requirement details.
Help Appreciated.
Thanks

If you are working on R12, there are some bugs with VO extension :
1)If a expert mode VO based on EO is extended and new attributes from EO are included, the new attributes turn out to be transient.The resolution is you would have to manually edit the extended VO xml file and include EO reference in new attributes.
2) If expert mode VO based on sql query is extended all attributes automatically become Update : Never in extended VO, you need to go to each attribute in VO wizard and change the type to Update:Always.
--Mukul

Java object with ArrayList of custom objects not working

I have a custom java object that has an ArrayList of another set of custom objects (code listed below). I can pull back a Customer object (to flex client) and it's recognized as a Customer action script object, but the ArrayList in the Customer object is not recognized as an ArrayCollection of Accounts. Instead it is an ArrayCollection of Action Script Objects.
At first I thought something was wrong with my action script Account class, but then I tried to pull back just an Account and it was recognized as an action script Account. It's just when I have my Customer object with an ArrayList of Accounts that it isn't getting converted.
Is there something else I need to do to have that ArrayList be recognized as an ArrayCollection of Accounts on the Flex Client side? Is there some way of specifying what type an ArrayCollection is mapped to?
Thanks in advance for the help!
public class Customer {
     private String name;
     private String address;
     private ArrayList<Account> accounts;
     public Customer(){
     public String getName(){
          return name;
     public void setName(String str){
          name = str;
     public String getAddress(){
          return address;
     public void setAddress(String str){
          address = str;
     public ArrayList<Account> getAccounts(){
          return accounts;
     public void setAccounts(ArrayList<Account> list){
          accounts = list;
public class Account {
     private long accountNumber;
     private String type;
     private double balance;
     public Account(){
     public long getName(){
          return accountNumber;
     public void setName(long l){
          accountNumber= l;

I accidently found how to make this work. I may have missed something while reading about blazeDS reflection, but I thought I'd pass this along anyway.
What I have is I have an class A. In class A I have an arraycollection of Class B. If I want that arraycollection to return to the server with the correct class, then I need to include Class B in the compiled swf. How I have done that is to create a dummy variable of type B. Importing B will not work you actually need to have a member variable of type B even if you don't need it.
Example
import dataobjects.B;
[RemoteClass(alias="dataobjects.A")]
public class A {
   private var _b:B; //This is never used, but needed to include B object in swf to be reflected.
   private var_ bList:ArrayCollection = new ArrayCollection();
public function A(){
public function set bList(list:ArrayCollection):void{
     _bList = list;
public function get bList():ArrayCollection{
    return _bList;

Authorization scheme not working.

My requirement is I want to allow access only to few people for some pages, buttons.
I am using Authorization scheme with scheme Type as "Exists SQL Query"
Working Query
SELECT p.EMP_ID FROM people p where emp_alias=:APP_USER and p.EMP_alias = 'ABC'
Not Working query
SELECT p.EMP_ID FROM people p where emp_alias=:APP_USER AND p.EMP_alias in ('ABC','XYZX)
Error: ORA-00907: missing right parenthesis
ERR-1082 Error in executing authorization scheme code.
Can anyone say what am I missing.

Thank you, adding braces and putting OR condition worked.
SELECT p.EMP_ID FROM people p WHERE emp_alias = :APP_USER AND (p.EMP_alias = 'ABC' OR p.EMP_alias = 'XYZX')
But not sure, how it is working some times and not working some times, if I have new lines, it doesnt work and if I have multiple conditions, it doesnt work.
This doesnt work..
SELECT p.EMP_ID FROM people p WHERE p.EMP_alias= :APP_USER and (emp_alias='ABC' or emp_alias='XYZ') and (p.EMP_ROLE='DBA' or p.EMP_ROLE ='DBAMGR')

Price analysis in webshop not working

Hi,
Our requirement is to display price analysis in an internal webshop as the business would like to understand how pricing is working.
I have set the enable.pricing parameter in XCM to 'true'. We made the following changes in the web.xml --
<context-param>
<param-name> priceAnalysis.isa.sapmarkets.com</param.name>
<param-value>true</param-value>
I also added the prc_trace parameter to the user parameters.
One old SAP note had mentioned changes to 2 parameters (priceAnalysis and enable.Price). When we made this change to the web.xml, we were able to see the price analysis in the product catalog (in the form of a hyperlink on the price in the page that gets displayed when one drills down in to the product hyperlink).
However the price analysis in the shopping basket or the order (in edit mode) is not working.
Does anyone have any ideas on what we might have missed?
Any helpful replies would be appreciated.
thanks

Hi Easwar,
we initially made the change only to the UI component through XCM. After a server bounce, no changes were seen on the webshop.
Then we added the code as per the old SAP note (which mentioned changes to 2 parameters). Price analysis started working for the product catalog after re-starting the server in visual admin. It was still not working at the shopping basket/order level.
This was the code --
<context-param>
<param-name>enable.priceAnalysis.isa.sapmarkets.com</param-name>
<param-value>true</param-value>
<description>Turn on IPC price analysis</description>
</context-param>
<context-param>
<param-name>priceAnalysis.isa.sapmarkets.com</param-name>
<param-value>true</param-value>
<description>Turn on IPC price analysis</description>
</context-param>
We then tried commenting the first part but this made no changes. Commenting the entire code again has resulted in no hyperlink on the price of products in the product catalog.
regards,
Jaya

Analysis Authorization Object not working

Similar Messages

Maybe you are looking for