Analysis Authorization Problem

Hy, i have create a Analysis Authorization object ZCOMPCODE with 0COMPCODE as characteristic.
So i assign this object to a users and i create a variable to filter 0COMPCODE with processing type "authorization".
The problem is that when execute the BEx query i receive the message : No authorization.
When assign 0BI_ALL to user the ZCOMPCODE has not effect but the query run correctly.
How can i resolve this serious problem?
Regards,
Andrea Maraviglia

Dear Andrea,
When you have a problem with authorization data access, may be you need check the following stuff:
1 All InfoObjects are relevant authorization (see Business Explorer the check box authorization relevant for each InfoObject Tcode RSD1) which these are part of InfoProvider where query request data. It is very important, because you have to include all of this InfoObject (Characteristic) in your analysis authorization.
2. Remember add the standard characteristic. 0TCAACTVT (3 value), 0TCAIPROV (InfoProvider Tech Name), 0TCAVALID (* value).
3. In each characteristic relevant authorization, I suggest that add the colon “:” value to avoid problem with variable authorization in the query.
4. Furthermore, the user need one role for standard object authorization: 
. S_RS_COMP (Activities 03, 16)
. S_RS_COMP1 (Query owner)
. S_RFC (BEx Analyzer or BEx Browser only)
. S_TCODE (RRMX for BEx Analyzer)
I hope that can help you!
Luis

Similar Messages

  • Analysis Authorization problem (new BI auth concept)

    Hi,
    I am trying to implement a analysis authorization for controlling the sales organization characteristic.
    I am working in a APO system.... when I set a * in the value list for the sales organization ..... I can select characteristic in demanding Planing   without problem....
    but when I create a whole list of all possible values (selecting from a pop up list) in the analysis authorization like this
    I EQ 2000
    I EQ 2001
    I get a message :
    You do not have authorization for all the
    characteristic values selected
    I will appreciate any idea
    Thanks
    FedeX

    Hi,
    I was able to trace the problem...and now I do not understand why I get as Result : "Not Authorized"
    here the last part of that trace log:
    Value selection partially authorized. Check of remainder at end
    Following Set Is Checked
    Contents
    SQL Format:
    NOT /BIC/YWSO_S
    ORG IN ('#','0605','0624','0625','0707','0807','2000','2001','707','807',':')
    AND TCAACTVT = '03'
    Comparison with Following Authorized Set
    Characteristic Contents
    0TCAACTVT I CP *
    I EQ #
    I EQ 0605
    I EQ 0624
    I EQ 0625
    I EQ 0707
    I EQ 0807
    I EQ 2000
    I EQ 2001
    I EQ 707
    I EQ 807
    I EQ :
    Result
    Not Authorized
    All Authorizations Tested
    Message EYE007: You do not have sufficient authorization
    No Sufficient Authorization for This Subselection (SUBNR)
    Following CHANMIDs Are Affected:
    103 ( <charac name> )
    Remaining Set
    <no info in this column>
    I really not identify any difference between the data in Following Set Is Checked and Comparison with Following Authorized Set
    well if someone has some idea... I will appreciate it.
    Thanks
    FedeX
    Edited by: FedeX on Apr 1, 2009 4:33 PM

  • BW Analysis Authorization Problem when no selection is done

    Hi Everybody,
    I am facing the following problem with the implemented authorization concept.
    We have marked 2 IOs as Authorization relevant: company and costcenter. We have defined an authorization object where the values are assigned through two variables $ZCompany and $ZCostcenter. The values are picked up from 2 Ztables where the User/Usergroup/Values assignement is done. Eveything seems to work fine.
    We have a problem when using an optional variable built on Company or Costcenter in our queries and no selection is done.
    If no selection is done, the variables ZCompay and ZCostcenter both are given values equals *. It si the same as every value. Since the user ZTESTUSER is authorized only for some comapnies and some costcenters,  the match between the * selection and the authorization set is not sucessful and the user doesn´t get any authorization. this is what we can when executing the display error log:
    Following Set Is Checked  Comparison with Following Authorized Set  Result  Remaining Set 
    Characteristic  Content in SQL Format 
    0TCAACTVT
    ZIFCM004
    ZIFCM014
    0TCAACTVT = '03'
    AND ZIFCM004 LIKE *
    AND ZIFCM014 LIKE *
    Characteristic  Content in SQL Format 
    0TCAACTVT  I EQ 03
    ZIFCM004  I EQ $Z1PME009
    ZIFCM014  I EQ $Z1PME004
    Partially or Fully Authorized (Intersection)   Characteristic  Content in SQL Format 
    0TCAACTVT
    ZIFCM004
    ZIFCM014
    NOT ZIFCM004 IN ('0012','0015')
    AND 0TCAACTVT = '03'
    OR ZIFCM004 IN ('0012','0015')
    AND NOT ZIFCM014 IN ('00000000000000012100','00000000000000012300')
    AND 0TCAACTVT = '03'
    Value selection partially authorized. Check of remainder at end
    Following Set Is Checked  Comparison with Following Authorized Set  Result  Remaining Set 
    Characteristic  Content in SQL Format 
    0TCAACTVT
    ZIFCM004
    ZIFCM014
    NOT ZIFCM004 IN ('0012','0015')
    AND 0TCAACTVT = '03'
    OR ZIFCM004 IN ('0012','0015')
    AND NOT ZIFCM014 IN ('00000000000000012100','00000000000000012300')
    AND 0TCAACTVT = '03'
    Characteristic  Content in SQL Format 
    0TCAACTVT  I EQ 03
    ZIFCM004  I EQ $Z1PME009
    ZIFCM014  I EQ $Z1PME004
    Not Authorized   
    What i don´t really understand is why the user doesn´t get any authorization only for the values subset for which he is authorized for. Is that normal according to your experience?
    How can we get rid of it obtaining that for such selection the user gets authorizations for the subset?
    Thanks in advance
    Best regards
    Enrico
    Edited by: Dottblabla on May 3, 2010 12:13 PM

    Hi,
    thank you both for the answers.
    Since the user is authorized for some certain values rappresenting a subset of * (all values) I dont really understand why he receives an error message as if he hasn´t any authorization at all. According to my logic, a partial dispaly of the data should be possible.. according to my logic, I repeat
    Using a mandatory variable would force the user to give a value. The problem is that we have users who are authorized for a large number of costcenters. In this case the best solution would be to define the mandatory variable as a selection option, allowing the user to define intervals of values as well. BUT in this case we would have the same problem described above as soon as the user pick up an interval of values containing also single costcenters for which he has no authorization. I hope, it is clear what i mean.
    Using an Authorization variable has the only charme that we get a kind of preselection of values. If the user wants to modify the selection and to define an interval, then we face the same issue again.
    It seems to me that BW Authorization concept doesn´t work with "subset" of values. Am i right? Any suggestion?
    Best regards
    Enrico

  • Problem wih analysis authorization for two scenarios on same data provider

    Dear all,
    I am looking for a solution on the following authorization scenario (using the new analysis authorization). Unfortunately everything that I tried did not work out as expected:
    User A is allowed to manually access query 1 (based on cube A) with authorization on all sites A-Z
    The same user A shall get an email distribution automatically (derivation of the filter in the query out of the authorization) for query 2, which is as well based on cube A, but this time the authorization shall be limited only to site A.
    As both queries are based on the same infoobject (0PLANT) and the same infoprovider (0TCAIPROV) I always get the result for all sites A-Z. The 0TCAACTVT is in both cases 03 (display), so I have no chance to distinguish between reporting and email distribution.
    Probably the only chance would be to derive the values for the email distribution scenario not from the authorization directly, but using a customer exit to fill the filter - but I would prefer a "standard" solution...
    Any ideas??
    Thanks,
    Andreas

    Dear Andreas,
    Before give you an alternative for you problem, Iu2019d like to comment the combining authorization concept:
    http://help.sap.com/saphelp_nw70/helpdata/EN/46/98cd87f37d19ace10000000a11466f/frameset.htm
    For this reason I suggest you which combing restriction through authorization and query filter. For query 2 try to use in 0PLANT characteristic the single value u201Csite Au201D, this restriction give you only authorization for see this value.
    Otherwise, you have to use customer exit.
    I hope that alternative help you to find a solution,
    Luis

  • Problem with analysis authorization- 0BI_ALL always needed

    Dear all:
    we have a serious issue on so-called "analysis authorization" now. We have auth-restricted user who only have authorization to access data on one company code. We also create a BI-authorization in analysis authorization and assign the following auth-relevant object to this authorization-
    0TCAACTVT = 01-03
    0TCAIPROV = ALL
    0TCAVALID = ALL
    0TCAKYFNM = ALL
    0COMP_CODE = A001
    And we create one query with only company code and number of employee in the row and column. But everytime we execute this query, there s always message" No Authorization". We used ST01 to trace and the result shows we need to have "0BI_ALL" in auth object S_RS_AUTH. If we added 0BI_ALL, all company code data will display, which definitely no auth restriction at all. Is there any specific authorization setting we need to do?
    We are stuck here pretty bad. Thank you all in advance if any input.
    BR
    SF

    Hi,
    I guess the Authorization profile is active , and in the Tcode PFCG -> Role name -> User tab page ( user comparision is done ).
    Check if any of the tab page shows red light .
    And assignment of 0BI_ALL is not a solution , as any user can do anything in the system.
    Also do not forget to log - off and log-in into system after changing into any of the authorization profile to see changes that had happened.
    Hope that helps.
    Regards
    Mr Kapadia
    Assigning points is the way to say thanks in SDN.

  • Analysis Authorization in BO 4.0 Webi report

    Hi All,
    I am using BO 4.0 and creating connection from Information Design tool to a BW query using BICS client. This connection is then published to CMC.
    We are using SAP authentication and importing the roles from BW system. We have added profiles to this role and these profiles have Analysis Authorization set on Company Code. So one user can access data to one company code and vice versa. Now this works well in Bex Analyzer, but if I try to create a report in Webi, the analysis authorization fails. I went through the forum before posting this question and I found that is in 3.1 version and in most cases using SSO in universe connection solved the problem.
    However in 4.0 I am using BICS client and followed the same processes to create a connection but for some reason it doesn't work ? Is this suppose to work differently in 4.0 ?
    I have tried:
    1. To create connection in Information Design tool using SSO, selecting user ID and password. It doesn't work.
    2. Checked the Bex query and it already has Company code as a Characteristic restrictions (I have made it a mandatory variable).
    3. Publish the connection to CMC with my Enterprise and SAP ID and in both cases it doesn't work.
    Please let me know if anyone encountered a similar issue and what is the best method to resolve this.
    (BO 4.0 no service pack or fix pack installed on the system yet)
    Thanks - Appreciate your help !
    Prasad Rasam

    Ingo,
    1. To create connection in Information Design tool using SSO, selecting user ID and password. It doesn't work.
    >> Correct you need to setup you OLAP Connection with SSO.
    >>> What I meant was I created the connections using both the methods, Using SSO it allows me to create a connection. The ID which I am using to create a connection has Admin access to BOBJ system. When I login as a regular user to create a Webi report and select this new connection, it throws an error message 'The DSL Service returned an error: com.businessobjects.dsl.services.workspace.impl.QueryViewAnalyzer$CannotGetCubeFromConnectionException: Cannot get the cube from the connection'
    Using the other method to create a connection with User ID and password, I can create a connection and with the normal user login I can connect to the BW query but Analysis Authorization doesn't work.
    Ingo : Could you be more specific what you mean here with the different users ? When you say "regular" user are you referring to an SAP credentials or SAP BusinessObjects Enteprrise credentials ?
    2. Checked the Bex query and it already has Company code as a Characteristic restrictions (I have made it a mandatory variable).
    >> The variable in the BEx query needs to be an authorization variable.
    >>> This has already been set as Authorization variable. There is still a question here. If I select the variable as Authorization variable, I cannot set the other parameters in the query properties such as Mandatory variable (as this is greyed out).
    Ingo : What other parameters would you like to configure ? Could you perhaps describe the scenario with more details ?
    regards
    Ingo Hilgefort

  • Analysis Authorization Issue 7.3

    Hello Friends,
    System BW 7.3, Currently there are 80 odd analysis authorization objects
    We want to introduce a new info object (GL Account) to be authorization relevant, ( there are few objects in the system which are already authorization relevant in the system with proper analysis authorization objects and they are working fine)
    Things done, made the GL Account object authorization relevant in RSA1, Created 2 analysis authorization objects with GL Account and TCT objects and one with hierarchy restrictions and one open access.
    Added this object to the user in addition to its already existing authorization objects. Created authorization variable in BEx.
    Some how the authorization is not picked up and it gives us all the values in the report. But if I add the GL Account info object to the existing analysis authorization objects then it works fine.
    I do not want to change all the existing analysis authorization objects to add GL Account.
    Your inputs are most welcome.
    Thanks
    Ed.

    Gajesh- I have added the new analysis authorization object to the user in RSECadmin.
    Subhendu- Problem statement: What are the steps involved in making a new info object(GL Account) authorization relevant. Authorizations are given at hierarchy level. Can we create a new analysis authorization with  GL Account only or do we have to add it to every existing analysis authorization
    I have done the following steps
    1. Made the GL Account object authorization relevant in RSA1,
    2. Created 2 new analysis authorization objects with GL Account ( with hierarchy restrictions) and TCT objects and one with GL Account open access.
    3. Added this object ( which has restrictions) to the user in RSECADMIN, in addition to its already existing authorization objects.
    4. Created authorization variable in BEx.
    5. No existing analysis authorization objects have been changed.
    When I test the report, It does not restrict based on the hierarchy that I have given, it gives open access.
    But If I add GL Account with restrictions to the existing analysis authorization object, it works good.
    Guess I am missing some thing here.
    Do you need any other screen shots.
    Thanks
    Ed.

  • BW Analysis authorization issue on cost center range

    Hello BIW security experts
    I have a problem where I created an analysis authorization on a cost center range and it looks like the interval is not working. The report is just a list of cost centers (demo to users to prove that analysis authorizations work in order to skip 2 managerial cost centers.
    . Cost centers are numeric. Example:  2000100. In the drop down list they appear as such.
    . I want to have the following cost center range: 1000000 to 1000771, 1000773 to 2000771, 2000773 to 9999999.
    Thereofore 1000772  and 2000772 should not appear in the list.
    . In the analysis authorization I have put the 3 ranges above on 3 separate lines. 'BT' is the operator. The cost centers have been selected from the drop down list.
    Results:  I get only 1 record from the report....  2000772. (which is one I want to exclude..
    Steps tried to debug:
    . When I put a list of cost centers in the analysis authorization on separate line with the 'EQ' operator, then the report works.
    . I tried putting ' ' delimiters since cost center is a char field but it fails.
    . I tried adding leading and trailing zeros to fill up the char(10) but no luck.
    . I tried creating a hierarchy with the interval and put it in the hierachy auth. tab and it does not work either. It gives the same number of records than the first step.
    . A hierarchy with single values work.
    I do not know what else to try..
    Thanks.
    YB.

    Good morning
    Here it is from RSECVAL
    ZCC_TEST     0COSTCENTER                    I       BT        1000000                                                      1000771
    ZCC_TEST     0COSTCENTER                    I       BT        1000773                                                      2000771
    ZCC_TEST     0COSTCENTER                    I       BT        2000773                                                      9999999
    ZCC_TEST     0COSTCENTER                    I       EQ        #
    ZCC_TEST     0COSTCENTER                    I       EQ        :
    ZCC_TEST     0INFOPROV                         I       CP        *
    ZCC_TEST     0TCAACTVT                        I       EQ        03
    ZCC_TEST     0TCAIPROV                         I       CP        *
    ZCC_TEST     0TCAKYFNM                       I       CP        *
    Thank you for your help.

  • Analysis Authorization based on Hier node with multiple display hierarchies

    Hi guys - I've got a problem where s.o. might have an idea of how to switch on the light at the end of the tunnel, I am currently standing in:
    Requirement:
    Cost Center Authorization should be given through RSECADMIN, reporting should be possible for any hierarchy that exists for the authorization relevant info object.
    Preferred solution:
    The Cost Center Analysis Authorization should be given through RSECADMIN - Hierarchy node assignment.
    u2022     A dedicated Authorization Cost Center Hierarchy will be maintained in ECC6 as an alternative cost center hierarchy and extracted into BW.
    u2022     The RSECADMIN Hierarchy node assignment should be based on a particular node (Type 2).
    u2022     The display level will be specified as required (here: Level 7)
    u2022     The Authorization granted should be independent of hierarchy name and version (validity 3).
    Reporting Scenario and technical impact:
    As mentioned above, when designing and running a query the user should be able to freely select other (i.e. than the authorization) display hierarchies for the authorization relevant reporting object 'Cost Center' as well. The technical names of the semantically relevant hierarchy nodes could therefore vary. E.g. cost centers 1, 2 and 3, being assigned under hierarchy node u2018Au2019 of the RSECADMIN relevant authorization hierarchy, could be subsumed by hierarchy node u2018Bu2019 in another display hierarchy, which the user may want to display in accordance to his reporting needs. Ideally, the alternative display hierarchy should therefore display node u2018Bu2019.
    My findings so far (based on prototyping) turn out that this is not possible as long u2018Bu2019 (and its hierarchy) is not authorized in RSECADMIN. Can these findings be confirmed? And if not, would anyone have an idea of how to facilitate the reporting scenario?
    Would there be any other way to grant access, possibly based on RSECADMIN single values, and also enable the user to flexibly display hierarchies with only those hierarchy nodes whose single cost center values the user has been given access to?
    Thanks everyone for your input...
    Claus
    Edited by: Claus64 on Jul 13, 2009 4:10 AM

    HI CLause,
    On Jul 14 2009, you wrote in SDN and said:
    FYI: Found a solution...
    The hierarchy analysis authorization will be based on a navigational attribute of cost center.
    With analysis authorizations it is possible to declare the Auth object (e.g. 0COSTCENTER__RACCAUT0) as authorization relevant and leave the superior object 0COSTCENTER auth irrelevant.
    The auth will be given for 0COSTCENTER__RACCAUT0. This object will be placed as a filter of the query, being restricted by an Authorization variable for hierarchy nodes.
    Due to the concept of Analysis Authorizations, this variable will automatically pick up the nodes granted as part of RSECADMIN Hierarchy based Authorization.
    As mentioned above, 0COSTCENTER as the regular reporting characteristic remains auth irrelevant and can therefore take any hierarchy thatu2019s available. Reporting on single values will be possible, too. Only those nodes show up that hold the authorized cost centers in accordance to the authorization.
    If the auth relevant 0COSTCENTER__RACCAUT0 is not used in the query definition by either not taking it in as a filter or skipping the Auth variable, the query will launch the message that the authorization is missing. No data show up at all.
    Claus
    See this thread:
    Analysis Authorization based on Hier node with multiple display hierarchies
    I am also in the same situation as you and need to understadn your solution. I understand that you created a Nav Attr on 0COSTCENTER and made this auth relevant whilst ensuring that 0COSTCENTER is NOT auth relevant. This is all fine. The issue was you have multiple hierachies for 0COSTCENTER, how did the new Nav Attr help you solve your issue. When loading 0COSTCENTER what values did you load ino the new Nav Attribute and how did that link to the hierachies? Also, in RSECADMIN you created hiearchy nodes based on the Nav Attribute but I am confused as to what values you have in the Nav Attr.
    I appreciate if you can share your solution from the past in more details.
    many thanks

  • Need analysis authorization help

    Hello Gurus,
    Could someone please help me out with my Analysis Authorization issue?
    We have a BW query and workbook outputting "Tcode usage" like the following:
    UserGroup| Username| Tcodename| Frequency
    This one has been running long time without any problems in reporting authorization, but now We want to get it restricted and only allow data associated group HR to display using new Analysis authorization. The scenario for this report is as follows:
    1. Rsecadmin >Maintenance> Create New authorization "Group" which consists of 4 characteristics: 0TCAACTVT, 0TCAIPROV, 0TCAVALID and 0TCTUSRGRP(which is the characteristic about group name and already authorizatio relevant). Set 0TCTUSRGRP "EQ HR".
    2.Assigned this authorization to a role using PFCG through the S_RS_AUTH. Other authorization objects in this role are:   S_BDS_D, S_BDS_DS, S_RS_MPRO, S_RSEC, S_RS_COMP, S_RS_COMP1, S_RS_HIER, S_RS_ICUBE, S_RS_ODSO.
    3.In BEx analyzer, set type: Characteristic Values and Variable filled from authorization and value "Selection Option". Unselected "ready for input". Put the characteristic associated with group name to filter windown on the top righ hand side of the Query Designer. Also compare users in PFCG.
    The question is the I still get all data about all groups. Looks like the authorization group doesn't work. I  used the "execute as " and get no errors back.
    Note: I didn't use "generation" to create the new authorization in Rsecadmin
    Thank you very much for any answers!
    Haifeng

    I guess i have found the reason why my authorization dosen't work. I don't activate infoObjects 0TCA* and 0TCT* and infoCubes 0TCA* as well. But another thing I am confused about is :
    Should I activate HR and CO businees content for authorizations 0TCA_DS02OTCA_DS05 and 0CCA_O010CCA_O03 before i get started? or should i run generation everytime i create a new authorization using Maintenance in Rsecadmin?
    Haifeng

  • Hierarchy Analysis Authorization in BW and BOBJ Webi Report

    Hello,
    We have a scenario wherein we have implemented Analysis Authorizations (Hierarchy) on Organizational Unit info object (0ORGUNIT) and need to report on BOBJ WEBI. Our scenario is as following
    ORGUNIT    - L0 (Overall Enterprise Level)     
    -     L1 (Enterprise - Continent Wise Split)
    -     L2 (Enterprise u2013 Country Wise Split)
    -     L3(Enterprise u2013 City Wise Split)
    E.G- 
          LO (Company ABC) MANAGER 0 will have access to the entire organization
               -L1 (ASIA) MANAGER1 will have access to ASIAN Subcontinent
                      -L2 (India) MANAGER 2 will have Access to country India
                                -L3 (New Delhi) MANAGER 2.1 will have access to city Delhi
                                -L3 (Mumbai) MANAGER 2.2 will have access to city Mumbai
                       -L2 (Malaysia) MANAGER 3 will have access to Country Malaysia
                                  -L3 (Kuala Lampur)
                                  -L3 (pahang)
                 - L1 (Europe)
                                            u2026..
    The requirement is that the CEO of the company should be able to see the entire set of data ( L0-L4).We have continent managers who can see that data specific to their continent, similarly at L3 Level the city manageru2019s should see the data only for their specific city.
    In BI we have used analysis authorization based on hierarchies. We have created an authorization object say ZAUTH1 and have assigned the hierarchy L0 from RSECADMIN. Now, in Webi when we create a report a sample row comes as :
    L0 Org Unit     L1 Org Unit     L2 Org Unit     L3 Org Unit     SALES Key Figure
    Company ABC     Asia          India          Mumbai          1000
    Now, we have MANAGER 2.2 who has only access to the data specific to his city (Mumbai). There is an Analysis Authorization object created for him ZAUTH2, by ONLY assigning the org unit hierarchy L3 (for Mumbai). When we run the bex report with the user MANAGER 2.2 u2013 it correctly displays the result and the user is only able to see the data for L3 Org Unit (Mumbai). However when you bring this data to Webi u2013 the report comes in the below format:
    L0 Org Unit     L1 Org Unit     L2 Org Unit     L3 Org Unit     SALES Key Figure
    Mumbai                                           1000
    The L3 org unit has now got assigned to L0 Org unit , as this is the only org unit assigned to the MANAGER 2.2 user .
    In such a case we are not able to write any generic formulae for the report. Is there a way to correct this issue? u2018Mumbaiu2019 should either get assigned to the L3 OrgUnit column is webi report , or is there a workaround that is possible ?
    Thanks and Best Regards,
    Vj

    Hi Vijay,
    The problem you speak of is known and comes from the fact that the hierachy is flattened in the process of delivering it to WebI. Therefore there is no real 'solution' to the problem, just some work-arounds you can think of...
    1)
    Create a report variable that starts looking at the lowest level, if it is empty check one up, and so on until you found what you were looking for (the lowest leaf available), which by definition must be there (even if it is top level).
    Using similar logic you can also get a 'number of levels avaible' and so fill in the complete tree (duplicating the highest level).
    This is difficult to explain when end users create their own reports, though you could provide a template report with these variables in there already.
    2)
    Extend the hierarchy with duplicates below the lowest level.
    So i.e. L0 Company - L1 Continent - L2 Country - L3 City- L4 City - L5 City- L6 City.
    This will give back on the four levels for top authorization
    L0 Company - L1 Continent - L2 Country - L3 City
    For authorization on Continent:
    L0 Continent - L1 Country - L2 City- L3 City
    For autorization City
    L0 City- L1 City - L2 City- L3 City
    So in all situations the fourth level, the L3 Object will hold the City level.
    This you can then use in your report.
    Hope this helps,
    Marianne

  • Analysis Authorization not working - Empty demarcation

    Can someone help me on this Analysis Authorization? I read many threads in SDN, it seems that I followed the correct steps. The restriction on S_RS_COMP is working well but the restriction on the Analysis Authorization is not working. Surely I'm making some mistake, but can't find what's wrong.
    I'm a User (say USER_00) in a test system, assigned to a Role (say Z:BI_USER). This is a broad role:
    - S_RS_COMP and S_RS_COMP1 have full authorization (*) to all the fields,
    - S_RS_AUTH has the BIAUTH field with Name of Authorization = *.
    Also I have an InfoArea (ZIA_TEST) and an InfoCube (ZIC_TEST). The IC has some characteristics and key figures. The only authorization relevant characteristic is ZCA_CLI (client). The IC has only 5 lines, one for each client ("CLI_01" to "CLI_05").
    Also there's a query (ZQR_TEST) on this IC, with an Authorization Variable (VAR_AUTH_CLI) restricting the characteristic ZCA_CLI.
    I'm trying to create a new User and restrict him to this IC and only to the data of client "CLI_01". If it works I'll apply to a production system.
    What I did:
    1) With tcode SU01 created a new User (USER_01) with no Role neither Analysis Authorization.
    2) With tcode PFCG copied the Role Z:BI_USER as Z:ROLE_TEST then made some changes:
    a) S_RS_COMP
    - Activity = 03 and 16
    - InfoArea = ZIA_TEST
    - InfoCube = ZIC_TEST
    - Type of report component = *
    - Name of report component = *.
    b) S_RS_COMP1
    - Kept * to all fields.
    c) S_RS_AUTH
    - I inactivated and deleted this Authorization Object.
    (I don't want to keep characteristic values restriction inside the role. The idea is to associate different users to the same role, allowing them to see the same ICs and execute the same queries. And differentiate wich characteristic values each one can see by manually associating different analysis authorization to each one.).
    3) With tcode RSECAUTH I created an Analysis Authorization (Z_AA_CLI_01) to restrict access only to client "CLI_01":
    - ZCA_CLI = "CLI_01"
    - 0TCAACTVT = "03"
    - 0TCAIPROV = "ZIC_TEST"
    - 0TCAVALID = "*".
    4) With tcode PFCG I assigned User "USER_01" to the Role " Z:ROLE_TEST" and made Complete Comparison.
    5) With tcode RSU01 I manually assigned Analysis Authorization " Z_AA_CLI_01" to User "USER_01".
    It seems to me that these steps are enough. But:
    a) When I log as USER_00 and go to tcode RSRT2, searching by InfoAreas I can see all the InfoAreas and all the InfoCubes, select and execute the query. That's OK.
    b) When I log as USER_01 and go to RSRT2, searching by InfoAreas I can see only ZIA_TEST and under it I can see only ZIC_TEST. That's OK. Then I select and execute the query.
    Wich means that S_RS_COMP is OK and each user is assigned to the correct Role.
    c) The problem is that in both cases the query brings data from all Clients.
    Under Information and Variable Values (when I run with HTML display) the message is "Empty demarcation".
    I changed the variable to be Ready for Input, just to see wich values it brings. In both cases (as USER_00 and as USER_01) in the Variable Screen it brings all the 5 Clients from the IC and I can select and execute any value.
    So the problem is with the Analysis Authorization or with the Variable, but I can't find what's wrong.
    Any help will be very appreciated.
    César

    OK Marc, it worked.
    Sorry for not answering earlier, but I could get back to this front only some days ago, then began testing your suggestions.
    1) Security Concept
    Authorization Mode was set to "Obsolete Concept with RSR Authorization Objects" (it would never work with this setting).
    I changed to "Current Procedure with Analysis Authorizations".
    Anyway, what's the function of this setting? Do old Reporting Authorizations work with "Current Procedure with Analysis Authorizations" setting?
    2) Variable Representation
    With "Multiple Single Values" it really led to problems.
    With "Selection Option" it worked well.
    3) 0TCAKYFNM
    I don't understand why, but if the AA doesn't have the char/dimension 0TCAKYFNM, when the User tries to run the query (tcode RSRT2) it accuses "You do not have sufficient authorization".
    Info Cube ZIC_VE95 has two KFs (ZKF_QTL95 and ZKF_VLT95). These KFs are used only on this IC (also in the KF Catalog, but it doesn't impact). This IC is used only on Query ZQR_VE95 (also in Transformation and DTP, wich doesn't impact).
    Well, I inserted 0TCAKYFNM and it worked, either with CP, "*" or with EQ, the two KFs.
    4) Authorization Policy Definition
    The situation I'm working on is very typical. Ex.: Some users are Administrators, Managers, Operator 1, Operator 2 and so on. Each Role needs authorization to access some queries. At the same time, they can access information only of the Cost Centers to wich they are related.
    There are many ways to implement it (I tested some of them and they worked well). My point is to define a most practical way, easy to understand and to maintain.
    I'm now sympathetic to this way:
    a) Create functional Roles (ex.: "Administrator", "Manager", "Operator 1", "Operator 2" and so on) defining only the Queries (or Info Areas, Info Providers, etc) each Role needs. No S_RS_AUTH definition.
    b) Create Char Value Roles (ex.: "CC_100_to_199", "CC_200_to_299", etc), only with S_RS_AUTH definition, each one associated with a corresponding AA (ex.: AA for CC 100 to 199, AA for CC 200 to 299 and so on).
    c) Create Composite Roles associating functional and char value Roles. Ex. Composite Role "Administrator for CC 100 to 199", composed of the Roles "Administrator" and "CC_100_to_199".
    d) Associate Users to the Composite Roles.
    Anyway, I'd appreciate if you could indicate some literature (blogs, articles, etc) on this theme.
    Well, thank you very much for your answers. Now I can go on with my studies on this subject.
    César Menezes

  • Analysis Authorization and Query

    Hi everybody,
    while studying the new analysis authorization concept in BI7 I tested a little bit around. I was wondering how I can realize the following scenario:
    A user should see "0VERSION" "2" and "0DIVISION" "01" as well as "0VERSION" "5" and "0DIVISION" "02" while executing the query with BEx Analyzer.
    Am I right that I have to create two analysis authorizations?  How do I have to model the query? I always get the message that my testuser does not have enough authority.
    Thanks for your suggestions.

    Hi Anja,
    Did you ever get a resolution to the question you asked.  I am facing the same scenario now where i want to restrict a user to seeing seeing the following:
    user must see:
    Division = 001 and Area = A
    Division = 002 and Area = B
    But he must not see Division 001, Area B for example
    Creating the analysis authorizations is not a problem, the problem is modelling the query to return this result.  I always get no results due to lack of authorization as the authorization variables try to return All Division "001" and "002" and All "A" and "B"
    As i see it, you cannot model the query to return the required result.  What would be ideal is if the query would only return what the user is authorized to, rather than returning nothing and giving an auth error.
    Thanks
    Gavin

  • SAP BI 7.3 Analysis authorization transport log

    Hi,
       We have transported a Analysis authorization to production system, I would like to know the exact changes moved through this transport carrying a particular analysis authorization.
    The issue here is RSECVAL_CL has not recorded the changes done on this particular Analysis authorization in development system.
    So please suggest if there is any table where we can look to find the exact changes made by this transport request.
    Regards,
    Ananth
    Edited by: Anantharama Shivashankar on Oct 26, 2011 6:48 PM

    The issue here is RSECVAL_CL has not recorded the changes done on this particular Analysis authorization in development system
    I guess that is a problem and should be reported to SAP. However this table will give the value that has been deleted. New value to be checked in analysis authorization itself.
    EDITED : If the AA been transported before then might look their content and compare them.
    Regards,
    Arpan Paik
    Edited by: P Arpan on Oct 31, 2011 3:44 PM

  • Analysis Authorization : Selection screen not appearing for query

    Hi,
    I am facing an issue with analysis authorization. I have created the new roles and assigned to the users. For one user when I am executing the query, the selection screen is not coming up and it shows error message to specify the variables. Whereas its running for all other users.
    In S_RS_COMP I have selected Type of a reporting component as Query View, Query & Template structure. I also tried adding Variable in this field but that also did not help.
    Please let me know if you have faced similar issue.
    Regards,
    Manish

    Hi,
    Go to your query desinger opend your query and select your variable in that you have see first "Ready Input Query" Check box is selected or not. It's not selected you can select that check box.
    Your problem will be sloved.
    Thanks & Regards,
    venkat.

Maybe you are looking for