Analysis Authorizations on Infosets

Hi,
I just wonder if analaysis authorizations work on infosets in SAP BW(701) SP8.
I have got Infoobject A, which is authorization relevant. When I use this object in DSO/Cubes/Multiproviders then data level authorizations(analysis) are work fine.
But when I use this infoobject into an infoset then it has become F35_XXX. When I create authorization variable on F35 and restrict value of A to certain values in RSECADMIN(analysis Auth). then it is simply allowing user to all values of A instead of restricting access to values specific in RSECADMIN.
At the moment my analysis auth is restricted as follow:
0TCAACTVT = 03
0TCAIPROV = Infoset name
0TCAVALID = *
A = 100
Am I missing anything?
Regards,
Ramesh

Hi Ramesh,
Infoset authorization should also work for authorization relevant navigational attributes.
Navigation attribute has it's own setting for authorization relevant. It is set in RSD1 attribute tab.
Can you check whether it's set to authorization relevant there?
In addition, if a use has full authorization(*) for a certain characteristic (or navigation attribute), it might not be listed in the authorization log as detailed check does not need to be done for it.
Best regards,
Patricia

Similar Messages

  • Issues with Analysis Authorization on Infoset

    Hi all
    We are facing an issue with Analysis Authorization on Infoset, it doesnt seem to throw authorization error when we access a record that is outside the authorization. We tried to use the same authorization set up from the same user we try to access the a record that is outside the authorization it behaves correctly.
    Here is my setup
    0CRM_MKTELM__0CRMCAMPTYP = ZA11
    0TCAACTVT = *
    0TCAIPROV = *
    0TCAVALID = *
    When I tried to access ZA12 it should throw an authorization error but for infoset it doesnt seem to work. Is there anything that we should take note for Infoset?

    Hi Chee,
    I am getting similar issue.
    I believe navigational attribute was already a authorization relevant in your case.
    What and where did you set it as authorization relevant to make it work on infosets.
    Regards,
    Ramz

  • Analysis Authorizations - Aggregation Level ( ':' )

    Dear BW Gurus,
    Greetings!!!
    I have a scenario of migrating the Authorizations from BW 3.5 to BI 7.0 Analysis Authorizations.
    There is a report based on InfoSet. There are about 8 authorization relevant objects among which the user is authorized for 3 Authorization relevant characteristic fields. In the previous version, It was working fine when tested.
    In BI 7.0 Analysis Authorization Concept, I have created the Authorization Object with these 3 Auth relevant fields and assigned to the Role using S_RS_AUTH and then assigned it to a user. When I test the query with that particular user ID, the result was NO SUFFICIENT AUTHORIZATION.
    When I checked the log, there it displayed the other authorization relevant fields for Aggregation level. So, my question is whether I must include the other Authorization relevant fields and restrict them for aggregation level (Value ':') and is it mandatory?
    please guide me in this regard as early as possible.
    Best Regards,
    Priya

    Hello,
    Check st01 and su53 for missing objects then assign objects accordingly in the role or in analyse authorisation .
    Thanks.
    With regards,
    Anand Kumar

  • Authorization for InfoSets

    Hi All.
    I have a strange situation that only exists in my BW production environment (version 7.0).  Starting out of the blue a few days ago, all of my users are now recieving authorization errors trying to execute queries against any InfoSet.  Specifically, the error message is "You do not have authorization for InfoSet xxxx."  We have four other environements, sandbox, dev, quality, and training where there is no problem.  I've re-transported all of the user roles from Dev to production and compared them line-by-line with the other environements, but I don't see any problem.   Can anyone provide any guidance on where I might look to resolve this issue?  Below is my PFCG configuration.  All of the InfoSets and related cubes, DSO's are in the indicated InfoAreas.  Thanks in advance.
               Manually   Business Explorer - Components
                Manually   Business Explorer - Components
                  Activity                       Create or generate, Change, Display, Delete, Execute                  <...>
                  InfoArea                       ZCRM_CA, ZCRM_OPP, ZCRM_SALES_A, ZCRM_SALES_O, ZCUSTOM_DSO, ZELM, ZLEA<...>
                  InfoCube                       *
                  Name (ID) of a reporting compo *
                  Type of a reporting component  Calculated key figure, Query View, Query, Restricted key figure       <...>
               Manually   Business Explorer - Components: Enhancements to the Owner
               Manually   Data Warehousing Workbench - Hierarchy
               Manually   Data Warehousing Workbench - InfoCube
                Manually   Administrator Workbench - InfoCube
                  Activity                       Display
                  InfoCube Subobject             Data
                  InfoArea                       ZCRM_CA, ZCRM_OPP, ZCRM_SALES_A, ZCRM_SALES_O, ZCUSTOM_DSO, ZELM, ZLEA<...>
                  InfoCube                       *
               Manually   Data Warehousing Workbench - InfoSet
                Manually   Administrator Workbench - Infoset
                  Activity                       Display, Maintain
                  InfoArea                       ZCRM_CA, ZCRM_OPP, ZCRM_SALES_A, ZCRM_SALES_O, ZCUSTOM_DSO, ZELM, ZLEA<...>
                  InfoSet                        *
               Manually   Data Warehousing Workbench - DataStore Object
                Manually   Administrator Workbench - ODS Object
                  Activity                       Display
                  InfoArea                       ZCRM_CA, ZCRM_OPP, ZCRM_SALES_A, ZCRM_SALES_O, ZCUSTOM_DSO, ZELM, ZLEA<...>
                  DataStore Object               *
                  Subobject for ODS Object       Data

    Hi Casey,
    Have you tried what roles or authorization objects are missing thru SU53 t-code? Other posibility to see what is happeining is doing a trace.
    Go to ST01-> select the checkbox Authorization -> run trace.
    Then execute the query that gives your the authorization error.
    Stop the trace, and see the analysis, check those rows with RC = 8 or 4.
    Regards, Federico

  • BI analysis authorization - Same info provider- diffrent access ?

    Hi Gurus,
    Designation of roles:
    1. User is having two PFCG roles (A1 & B1) assigned.
    2. Role A1 contains query name ZQRYA1 & Role B1 contains query name ZQRYB1
    3. Role A1 is linked to analysis authrozation role AR1 and Role B1 is linked to analysis auth. role BR1 (thorugh S_RS_AUTH)
    4. AR1 is having access to Company code 1000 & info proivder is ZIC_COPA
    5. BR1 is having access to Company code 2000 & info provider is same ZIC_COPA.
    Requirement :
    When user is executing ZQRYA1, he should see only 1000 company code.
    Result:
    With above design user is able to see 1000 & 2000 company code data for ZQRYA1.
    My analysis:
    1. We should use Customer exit in the Query. (SAP note referred  668520).
      2. As per SAP note 1000004 (Merging and optimizing analysis authorizations), I understand that if same info provider is there then BI analysis auth. will merge the values.
    Please correct me if I understand something wrong. Also suggest how can implement role so that values will not merge.

    Hi experts,
    I am getting confused now.
    As pe rmy practical experience for same info-proivder BI AA will merge the values. Even i got same response in SDN forums.
    But when I raised this issue to SAP (OSS message), SAP says this issue should resolve by applying SAP notes through SNOTE..
    1138708     Unauthorized data is displayed: "Not assigned" (#)     
    1158432     Too many values authorized for hierarchy with intervals     
    1234334     Authorization error for query on InfoSet     
    1229602     Error when using hierarchies: Authorization error     
    1226163     Authorization variables in workbook     
    1000004      Merging and optimizing analysis authorizations
    1150754     Authorizations for InfoSet chars. ignored in input help     
    1235049     F4 help: Unauthorized data for referencing characteristic     
    I have gone through notes but did not find relevant, but still SAP replied it should resolve the issues.
    Please suggest.

  • Analysis Authorization in BO 4.0 Webi report

    Hi All,
    I am using BO 4.0 and creating connection from Information Design tool to a BW query using BICS client. This connection is then published to CMC.
    We are using SAP authentication and importing the roles from BW system. We have added profiles to this role and these profiles have Analysis Authorization set on Company Code. So one user can access data to one company code and vice versa. Now this works well in Bex Analyzer, but if I try to create a report in Webi, the analysis authorization fails. I went through the forum before posting this question and I found that is in 3.1 version and in most cases using SSO in universe connection solved the problem.
    However in 4.0 I am using BICS client and followed the same processes to create a connection but for some reason it doesn't work ? Is this suppose to work differently in 4.0 ?
    I have tried:
    1. To create connection in Information Design tool using SSO, selecting user ID and password. It doesn't work.
    2. Checked the Bex query and it already has Company code as a Characteristic restrictions (I have made it a mandatory variable).
    3. Publish the connection to CMC with my Enterprise and SAP ID and in both cases it doesn't work.
    Please let me know if anyone encountered a similar issue and what is the best method to resolve this.
    (BO 4.0 no service pack or fix pack installed on the system yet)
    Thanks - Appreciate your help !
    Prasad Rasam

    Ingo,
    1. To create connection in Information Design tool using SSO, selecting user ID and password. It doesn't work.
    >> Correct you need to setup you OLAP Connection with SSO.
    >>> What I meant was I created the connections using both the methods, Using SSO it allows me to create a connection. The ID which I am using to create a connection has Admin access to BOBJ system. When I login as a regular user to create a Webi report and select this new connection, it throws an error message 'The DSL Service returned an error: com.businessobjects.dsl.services.workspace.impl.QueryViewAnalyzer$CannotGetCubeFromConnectionException: Cannot get the cube from the connection'
    Using the other method to create a connection with User ID and password, I can create a connection and with the normal user login I can connect to the BW query but Analysis Authorization doesn't work.
    Ingo : Could you be more specific what you mean here with the different users ? When you say "regular" user are you referring to an SAP credentials or SAP BusinessObjects Enteprrise credentials ?
    2. Checked the Bex query and it already has Company code as a Characteristic restrictions (I have made it a mandatory variable).
    >> The variable in the BEx query needs to be an authorization variable.
    >>> This has already been set as Authorization variable. There is still a question here. If I select the variable as Authorization variable, I cannot set the other parameters in the query properties such as Mandatory variable (as this is greyed out).
    Ingo : What other parameters would you like to configure ? Could you perhaps describe the scenario with more details ?
    regards
    Ingo Hilgefort

  • Analysis Authorization Issue 7.3

    Hello Friends,
    System BW 7.3, Currently there are 80 odd analysis authorization objects
    We want to introduce a new info object (GL Account) to be authorization relevant, ( there are few objects in the system which are already authorization relevant in the system with proper analysis authorization objects and they are working fine)
    Things done, made the GL Account object authorization relevant in RSA1, Created 2 analysis authorization objects with GL Account and TCT objects and one with hierarchy restrictions and one open access.
    Added this object to the user in addition to its already existing authorization objects. Created authorization variable in BEx.
    Some how the authorization is not picked up and it gives us all the values in the report. But if I add the GL Account info object to the existing analysis authorization objects then it works fine.
    I do not want to change all the existing analysis authorization objects to add GL Account.
    Your inputs are most welcome.
    Thanks
    Ed.

    Gajesh- I have added the new analysis authorization object to the user in RSECadmin.
    Subhendu- Problem statement: What are the steps involved in making a new info object(GL Account) authorization relevant. Authorizations are given at hierarchy level. Can we create a new analysis authorization with  GL Account only or do we have to add it to every existing analysis authorization
    I have done the following steps
    1. Made the GL Account object authorization relevant in RSA1,
    2. Created 2 new analysis authorization objects with GL Account ( with hierarchy restrictions) and TCT objects and one with GL Account open access.
    3. Added this object ( which has restrictions) to the user in RSECADMIN, in addition to its already existing authorization objects.
    4. Created authorization variable in BEx.
    5. No existing analysis authorization objects have been changed.
    When I test the report, It does not restrict based on the hierarchy that I have given, it gives open access.
    But If I add GL Account with restrictions to the existing analysis authorization object, it works good.
    Guess I am missing some thing here.
    Do you need any other screen shots.
    Thanks
    Ed.

  • Analysis Authorization Issue

    Hi:
    I created an analysis authorization ZCO_CODE to trstrict it by a company code.
    I added following objects in authorization with values.
    0COMP_CODE = 1000
    0TCAACTVT = 03
    0TCAIFAREA = *
    0TCAIPROV = *
    0TCAVALID = *
    Then I created a role Z:00:BW_REPORT, where I added following authorization objects S_RS_AUTH and restricted it by value ZCO_CODE. Then I assigned this role to a user test01.
    When I execute a program RSEC_MIGRATION for this specific user, I do not see authorization object ZCO_CODE on 2nd step of this program. Any Idea Why? I think this object should show up as I want to migrate this specific object.
    Help will be appreciated.

    Hi Sachin:
    Okay here is my issue.
    I have a Reporting authorization Object created earlier which is ZCOCODE. I though I'll have to create a new Analysis authorization object e.g. ZCO_CODE and then restrict it with other chars. as mentioned in Marc Bernards presentation and then you have to migrate it.
    In selection list I can see old Reporting authorization object. If I select it and use option "Enhance existing profile" then It will update profile and not role? right....
    How can I see whether it has updated existing profile?????
    Do I need to create new Analysis Auth. for Company code or I can use old Reporting authorization for company code?
    For testing purpose, I created a test user and assigned all reporting roles but It will not show up in RSEC_MIGRATION step???

  • BW Analysis authorization issue on cost center range

    Hello BIW security experts
    I have a problem where I created an analysis authorization on a cost center range and it looks like the interval is not working. The report is just a list of cost centers (demo to users to prove that analysis authorizations work in order to skip 2 managerial cost centers.
    . Cost centers are numeric. Example:  2000100. In the drop down list they appear as such.
    . I want to have the following cost center range: 1000000 to 1000771, 1000773 to 2000771, 2000773 to 9999999.
    Thereofore 1000772  and 2000772 should not appear in the list.
    . In the analysis authorization I have put the 3 ranges above on 3 separate lines. 'BT' is the operator. The cost centers have been selected from the drop down list.
    Results:  I get only 1 record from the report....  2000772. (which is one I want to exclude..
    Steps tried to debug:
    . When I put a list of cost centers in the analysis authorization on separate line with the 'EQ' operator, then the report works.
    . I tried putting ' ' delimiters since cost center is a char field but it fails.
    . I tried adding leading and trailing zeros to fill up the char(10) but no luck.
    . I tried creating a hierarchy with the interval and put it in the hierachy auth. tab and it does not work either. It gives the same number of records than the first step.
    . A hierarchy with single values work.
    I do not know what else to try..
    Thanks.
    YB.

    Good morning
    Here it is from RSECVAL
    ZCC_TEST     0COSTCENTER                    I       BT        1000000                                                      1000771
    ZCC_TEST     0COSTCENTER                    I       BT        1000773                                                      2000771
    ZCC_TEST     0COSTCENTER                    I       BT        2000773                                                      9999999
    ZCC_TEST     0COSTCENTER                    I       EQ        #
    ZCC_TEST     0COSTCENTER                    I       EQ        :
    ZCC_TEST     0INFOPROV                         I       CP        *
    ZCC_TEST     0TCAACTVT                        I       EQ        03
    ZCC_TEST     0TCAIPROV                         I       CP        *
    ZCC_TEST     0TCAKYFNM                       I       CP        *
    Thank you for your help.

  • BW Analysis authorization issue... need help urgently....

    We have one BW query which is pulling data from Contract Division info-object. Now this report does not variable selection object so it is pulling data from all values of Contract Division. Values of  Contract Division are CNC, CNS, CNE and CNL.
    Now we have created an analysis auth. object called z_es_3 and added Contract division info-object. Now we have added that z_es_3 into role and given value to CNS. now when we are running report, we are getting No Authorization error. When we are giving * value in z_es_3, it is running fine.
    Now we have to restrict report to contract division. please help.
    Thanks in advance

    Are you running unrestricted search on Contract division in your queries? You should restrict it to value which is maintained in the authorization for the InfoObject.
    Also please run the analysis authorization trace from RSECADMIN. That will give you a clearer picture of what is wrong.

  • Analysis Authorization based on Hier node with multiple display hierarchies

    Hi guys - I've got a problem where s.o. might have an idea of how to switch on the light at the end of the tunnel, I am currently standing in:
    Requirement:
    Cost Center Authorization should be given through RSECADMIN, reporting should be possible for any hierarchy that exists for the authorization relevant info object.
    Preferred solution:
    The Cost Center Analysis Authorization should be given through RSECADMIN - Hierarchy node assignment.
    u2022     A dedicated Authorization Cost Center Hierarchy will be maintained in ECC6 as an alternative cost center hierarchy and extracted into BW.
    u2022     The RSECADMIN Hierarchy node assignment should be based on a particular node (Type 2).
    u2022     The display level will be specified as required (here: Level 7)
    u2022     The Authorization granted should be independent of hierarchy name and version (validity 3).
    Reporting Scenario and technical impact:
    As mentioned above, when designing and running a query the user should be able to freely select other (i.e. than the authorization) display hierarchies for the authorization relevant reporting object 'Cost Center' as well. The technical names of the semantically relevant hierarchy nodes could therefore vary. E.g. cost centers 1, 2 and 3, being assigned under hierarchy node u2018Au2019 of the RSECADMIN relevant authorization hierarchy, could be subsumed by hierarchy node u2018Bu2019 in another display hierarchy, which the user may want to display in accordance to his reporting needs. Ideally, the alternative display hierarchy should therefore display node u2018Bu2019.
    My findings so far (based on prototyping) turn out that this is not possible as long u2018Bu2019 (and its hierarchy) is not authorized in RSECADMIN. Can these findings be confirmed? And if not, would anyone have an idea of how to facilitate the reporting scenario?
    Would there be any other way to grant access, possibly based on RSECADMIN single values, and also enable the user to flexibly display hierarchies with only those hierarchy nodes whose single cost center values the user has been given access to?
    Thanks everyone for your input...
    Claus
    Edited by: Claus64 on Jul 13, 2009 4:10 AM

    HI CLause,
    On Jul 14 2009, you wrote in SDN and said:
    FYI: Found a solution...
    The hierarchy analysis authorization will be based on a navigational attribute of cost center.
    With analysis authorizations it is possible to declare the Auth object (e.g. 0COSTCENTER__RACCAUT0) as authorization relevant and leave the superior object 0COSTCENTER auth irrelevant.
    The auth will be given for 0COSTCENTER__RACCAUT0. This object will be placed as a filter of the query, being restricted by an Authorization variable for hierarchy nodes.
    Due to the concept of Analysis Authorizations, this variable will automatically pick up the nodes granted as part of RSECADMIN Hierarchy based Authorization.
    As mentioned above, 0COSTCENTER as the regular reporting characteristic remains auth irrelevant and can therefore take any hierarchy thatu2019s available. Reporting on single values will be possible, too. Only those nodes show up that hold the authorized cost centers in accordance to the authorization.
    If the auth relevant 0COSTCENTER__RACCAUT0 is not used in the query definition by either not taking it in as a filter or skipping the Auth variable, the query will launch the message that the authorization is missing. No data show up at all.
    Claus
    See this thread:
    Analysis Authorization based on Hier node with multiple display hierarchies
    I am also in the same situation as you and need to understadn your solution. I understand that you created a Nav Attr on 0COSTCENTER and made this auth relevant whilst ensuring that 0COSTCENTER is NOT auth relevant. This is all fine. The issue was you have multiple hierachies for 0COSTCENTER, how did the new Nav Attr help you solve your issue. When loading 0COSTCENTER what values did you load ino the new Nav Attribute and how did that link to the hierachies? Also, in RSECADMIN you created hiearchy nodes based on the Nav Attribute but I am confused as to what values you have in the Nav Attr.
    I appreciate if you can share your solution from the past in more details.
    many thanks

  • Web Intelligence Report + BI 7.0 Analysis Authorizations

    Hello Experts,
    I have created a report on a universe based in a SAP BW InfoCube that contains an authorization relevant InfoObject (Company Code).
    BW Analysis authorization have been set up for this cube in such way that the user should have access only to data containing one of the two values of Company Code (lets say for example that the user can access value "A").
    It seems to be working fine when testing them via a BEx Query or via rsecadmin (rsrt with detailed analysis authorization logs). When the test user tries to view the full contents of the specific cube gets an "access denied" message (this is normal), whereas if the user runs a report with a filter "A" on Company Code the report returns the results as it should have. So far so good.
    For testing use within Web Intelligence, I have created the following Single Sign On (SSO) universes: a)directly on the cube, b)via a "select all" query and finally c)via a filtered query (filtering the exact allowed values of analysis authorization of the test user). All of the above have unfortunately the exact same issues:
    When a test user with limited analysis authorization (i.e. a user that can only access value "A" of Company Code) tries to view a report on either of these universes, then the result is the following message when trying to execute the query "A database error occured. The database error text is: Error loading cube MyCube/MyQuery (catalog MyCube): Unknown error. (WIS 10901)"
    I have tried several settings on the universe (like filter working on LoV as well) but none helped.
    If we replace the user's analysis authorizations with full access on company code (values "A" and "B") the query runs as it should have.
    Any ideas?
    Best regards
    Giorgos

    Hi,
    has the Universe been created on the cube level or on the query level ?
    In case it is on the cube level it will fail because :
    Analysis authorizations are not based on authorization objects. Instead, you create authorizations that include a group of characteristics. You restrict the values for these characteristics.
    The authorizations can include any authorization-relevant characteristics, and treat single values, intervals, and hierarchy authorizations in the same way. Navigation attributes can also be flagged as authorization-relevant in the attribute maintenance for characteristics and can be added to authorizations as separate characteristics.
    You can then assign this authorization to one or more users.
    All characteristics flagged as authorization-relevant are checked when a query is executed.
    *A query always selects a set of data from the database. If authorization-relevant characteristics are part of this data, you have to make sure that the user who is executing the query has sufficient authorization for the complete selection. Otherwise, an error message is displayed indicating that the authorization is not sufficient. In principle, the authorizations do not work as filters. Very restricted exceptions to this rule are hierarchies in the drilldown and variables that are filled depending on authorizations. Hierarchies are mostly restricted to the authorized nodes, and variables that are filled depending on authorizations act like filters for the authorized values for the particular characteristic*
    Ingo

  • [BO over SAP BW] Web Intelligence Report + BI 7.0 Analysis Authorizations

    Hello Experts,
    I have created a report on a universe based in a SAP BW InfoCube that contains an authorization relevant InfoObject (Company Code).
    BW Analysis authorization have been set up for this cube in such way that the user should have access only to data containing one of the two values of Company Code (lets say for example that the user can access value "A").
    It seems to be working fine when testing them via a BEx Query or via rsecadmin (rsrt with detailed analysis authorization logs). When the test user tries to view the full contents of the specific cube gets an "access denied" message (this is normal), whereas if the user runs a report with a filter "A" on Company Code the report returns the results as it should have. So far so good.
    For testing use within Web Intelligence, I have created the following Single Sign On (SSO) universes: a)directly on the cube, b)via a "select all" query and finally c)via a filtered query (filtering the exact allowed values of analysis authorization of the test user). All of the above have unfortunately the exact same issues:
    When a test user with limited analysis authorization (i.e. a user that can only access value "A" of Company Code) tries to view a report on either of these universes, then the result is the following message when trying to execute the query "A database error occured. The database error text is: Error loading cube MyCube/MyQuery (catalog MyCube): Unknown error. (WIS 10901)"
    I have tried several settings on the universe (like filter working on LoV as well) but none helped.
    If we replace the user's analysis authorizations with full access on company code (values "A" and "B") the query runs as it should have.
    Any ideas?
    Best regards
    Giorgos

    Hi,
    has the Universe been created on the cube level or on the query level ?
    In case it is on the cube level it will fail because :
    Analysis authorizations are not based on authorization objects. Instead, you create authorizations that include a group of characteristics. You restrict the values for these characteristics.
    The authorizations can include any authorization-relevant characteristics, and treat single values, intervals, and hierarchy authorizations in the same way. Navigation attributes can also be flagged as authorization-relevant in the attribute maintenance for characteristics and can be added to authorizations as separate characteristics.
    You can then assign this authorization to one or more users.
    All characteristics flagged as authorization-relevant are checked when a query is executed.
    *A query always selects a set of data from the database. If authorization-relevant characteristics are part of this data, you have to make sure that the user who is executing the query has sufficient authorization for the complete selection. Otherwise, an error message is displayed indicating that the authorization is not sufficient. In principle, the authorizations do not work as filters. Very restricted exceptions to this rule are hierarchies in the drilldown and variables that are filled depending on authorizations. Hierarchies are mostly restricted to the authorized nodes, and variables that are filled depending on authorizations act like filters for the authorized values for the particular characteristic*
    Ingo

  • Need analysis authorization help

    Hello Gurus,
    Could someone please help me out with my Analysis Authorization issue?
    We have a BW query and workbook outputting "Tcode usage" like the following:
    UserGroup| Username| Tcodename| Frequency
    This one has been running long time without any problems in reporting authorization, but now We want to get it restricted and only allow data associated group HR to display using new Analysis authorization. The scenario for this report is as follows:
    1. Rsecadmin >Maintenance> Create New authorization "Group" which consists of 4 characteristics: 0TCAACTVT, 0TCAIPROV, 0TCAVALID and 0TCTUSRGRP(which is the characteristic about group name and already authorizatio relevant). Set 0TCTUSRGRP "EQ HR".
    2.Assigned this authorization to a role using PFCG through the S_RS_AUTH. Other authorization objects in this role are:   S_BDS_D, S_BDS_DS, S_RS_MPRO, S_RSEC, S_RS_COMP, S_RS_COMP1, S_RS_HIER, S_RS_ICUBE, S_RS_ODSO.
    3.In BEx analyzer, set type: Characteristic Values and Variable filled from authorization and value "Selection Option". Unselected "ready for input". Put the characteristic associated with group name to filter windown on the top righ hand side of the Query Designer. Also compare users in PFCG.
    The question is the I still get all data about all groups. Looks like the authorization group doesn't work. I  used the "execute as " and get no errors back.
    Note: I didn't use "generation" to create the new authorization in Rsecadmin
    Thank you very much for any answers!
    Haifeng

    I guess i have found the reason why my authorization dosen't work. I don't activate infoObjects 0TCA* and 0TCT* and infoCubes 0TCA* as well. But another thing I am confused about is :
    Should I activate HR and CO businees content for authorizations 0TCA_DS02OTCA_DS05 and 0CCA_O010CCA_O03 before i get started? or should i run generation everytime i create a new authorization using Maintenance in Rsecadmin?
    Haifeng

  • BI 7.0 Analysis Authorization issue: some reports displaying a blank page.

    Hi All,
    This is regarding BI 7.0 Analysis Authorization issue.
    Overview:
    we have restricted some queries at infoobject level.
    Issue:
    a. For some of the queries, we can see the selection screen but when we try to execute the query by clicking on the execute button (Queries WAD) we get a blank page, meaning nothing is displayed on the output (white/Blank screen).
    b. When we execute the same query through RSRT, we get a message which says "Disconnecting from BW server..".
    c. Let me explain further on this. Basically we are doing this in order to have limited access to Auditors at the client side. At the same time normal users should not get impacted due to this, hence we created two roles. One for normal users and other for Auditors.
    d.  Now the thing is that we execute the same report with normal user ID's the report executes properly and displays the output. it does not show the blank page.
    e. But when we execute the same report with Auditors ID then we get a blank page.
    Any idea why this is so?

    Hi Neha,
    I tried the below also,
    GL Acnt
    I EQ 0000134010
    I EQ :
    but still it didn't work.
    No Infoobject is missing in Authorization Object.
    For your point, "rsecadmin - > analysis -> execute as -> check for the desired user & analyze the log" it didnu2019t allow me to analyze, since as soon as click on execute button a pop-up comes up saying "Disconnecting from the BW server..."
    As mentioned earlier also it is giving me the below message,
    ""I>> Row: 103 Inc: AUTHORITY_02 Prog: CL_RSR_RRK0_AUTHORIZATION                                                                       RS_EXCEPTION        301CL_RSR_RRK0_AUTHORIZATION                         AUTHORITY_02"
    Kindly suggest, since this is a show-stopper for us!
    Thanks,
    Ishdeep Kohli.

Maybe you are looking for