Analysis Authorizations with two infoobjects in a infocube

Dear Experts,
I have a infoprovider which is
having two infoobjects Z1 and Z2 both are auth relavant
i have two queries Q1 and Q2, Q1 has Z1 only and Q2 has Z2 only.
if i have two sets of users, one group have access to only query Q1 and second group
has access to Q2.
my doubts
1. do i have to give both the group users authorization for two info objects Z1 and Z2 eventhough they both together
are not in one query but only one at a time in a query.Becuase all the queries are on th same infocube.
2 or else can i create one authorizatio and include both the info objects in it and then assign it two all the users irrespective of the group.
Thanks and Regards
Neel
Edited by: Neel Kamal on Apr 12, 2009 1:34 PM

Hi Neel,
Answers to your questions in bold.
1. do i have to give both the group users authorization for two info objects Z1 and Z2 eventhough they both together
are not in one query but only one at a time in a query.Becuase all the queries are on th same infocube.
Answer - Yes, I think you would need to give both user groups, authorization to both the infoobjects.
You may need to check in RSSM, that both authorization objects are marked for authorization check for infoprovider. If both have been checked, then I guess you need to give authorization for both infoobjects. In RSSM, in infoprovider , give the infocube name on which the query is created and check the authorization objects checked for this infoprovider. Check the definition of the authorization objects in the same transaction.
2 or else can i create one authorizatio and include both the info objects in it and then assign it two all the users irrespective of the group.
Answer - Yes, you could do it this way as well. But this means that all the users in the two user groups will be authorized to see the same authorized dataset.
Hope this helps,
Best regards,
Sunmit.

Similar Messages

  • Transport roles and analysis authorization with user assigned

    Hi expert,
    I face with this problem transport roles and analysis authorization with user assigned. When I have created a transport request to move the roles and analysis authorization from development system to test system. I couldnu2019t maintain the user assigned, after transport I have to assigned manually all of user or create a program to fill AGR_USER table or there are other way.
    Thanks for your time,
    Luis

    Hi,
    In role administration, you have the following options for transporting roles:
    You can download the roles from one system and upload them into another  
    You can import the role from a remote system using RFC  
    You can transport the roles with the transport function.
    Role upload loads all role data, including authorization data from a file into the SAP system. The user assignments for the role and the generated profiles for the role are exceptions in this case.
    Transporting Roles with the Role Transport Function
           1.      Start the role administration function by choosing Tools ® Administration ® User Maintenance ® Role Administration ® Roles (transaction PFCG).
           2.      Enter the role to be transported and choose Transport Role.
    The Mass Transport of Roles screen appears. You can control the default settings for the options Also transport single roles for composite roles and Also transport generated profiles for roles using Customizing switches (see Role Administration Functions in the section Functions of the Utilities Menu).
    You should not change the authorizations profiles of the role after you have included the role in a transport request. If you need to change the profiles or generate them for the first time, transport the entire role again afterwards.
    For more information go thrpugh the below link
    http://help.sap.com/saphelp_nw70/helpdata/EN/6d/7c8cfd410ea040aadf92e1f78107a4/content.htm
    Regards,
    Marasa.

  • Analysis Authorization with SEM-BPS

    Hi,
    We have performed technical upgrade from BW 3.5 to BI 7.0. We want to migrate to BI 7.0 functionality phase wise.
    We have SEM-BPS and now we want to migrate to Analysis Authorization of BI 7.0.
    Once we have igrated to Analysis Authorization, will there be any impact on SEM-BPS? Can we still use SEM-BPS with New Analysis Authorizations? We do not want to move to BI-IP in near future?.
    Please advise.
    Best Regards,
    UR

    Dear UR,
    Iu2019m going to try helping you,
    In difference of reporting functionality, in planning, the data of an InfoCube is not just read; it is also changed or created.
    There are two planning tools in BI: BW-BPS (Business Planning and Simulation), and BI Integrated Planning.
    There are two main tcode: BPS0 and RSPLAN
    There are three authorization objects to manage Integrated Planning:
    S_RS_PL_ADMIN - Planning Administrator
    S_RS_PL_PLANNER u2013 Planner
    S_RS_PL_PLANMOD_D u2013 Planning Modeler (Development System)
    The main object in the planning scenario is InfoCube real-time, where can available writing in small package that arrive in parallel. In some cases the security requirements for reporting and planning can be merging. In this case you need authorization object for checking planning, as authorization object above, and you need authorization object for using a query for planning requires as S_RS_COMP.
    In addition to authorization for displaying data, the authorizations for changing data you need analysis authorization (the analysis authorization focus in the InfoProvider, no in Aggregation Level).
    In your analysis authorization design for reporting stuff, you should use in 0TCAACTVT characteristic 03 value. In the planning stuff, you should use in 0TCAACTVT characteristic 03 and 02 values. As explain following:
    Using the characteristics 0TCAACTVT (activity), you can restrict the authorization to different activities. Read (03) is set as the default activity; you must also assign the activity Change (02) for integrated planning.
    http://help.sap.com/saphelp_nw70ehp1/helpdata/en/b1/0c9441b8972e7be10000000a1550b0/frameset.htm
    I hope this suggestion can help you answer question,
    Luis

  • Problem wih analysis authorization for two scenarios on same data provider

    Dear all,
    I am looking for a solution on the following authorization scenario (using the new analysis authorization). Unfortunately everything that I tried did not work out as expected:
    User A is allowed to manually access query 1 (based on cube A) with authorization on all sites A-Z
    The same user A shall get an email distribution automatically (derivation of the filter in the query out of the authorization) for query 2, which is as well based on cube A, but this time the authorization shall be limited only to site A.
    As both queries are based on the same infoobject (0PLANT) and the same infoprovider (0TCAIPROV) I always get the result for all sites A-Z. The 0TCAACTVT is in both cases 03 (display), so I have no chance to distinguish between reporting and email distribution.
    Probably the only chance would be to derive the values for the email distribution scenario not from the authorization directly, but using a customer exit to fill the filter - but I would prefer a "standard" solution...
    Any ideas??
    Thanks,
    Andreas

    Dear Andreas,
    Before give you an alternative for you problem, Iu2019d like to comment the combining authorization concept:
    http://help.sap.com/saphelp_nw70/helpdata/EN/46/98cd87f37d19ace10000000a11466f/frameset.htm
    For this reason I suggest you which combing restriction through authorization and query filter. For query 2 try to use in 0PLANT characteristic the single value u201Csite Au201D, this restriction give you only authorization for see this value.
    Otherwise, you have to use customer exit.
    I hope that alternative help you to find a solution,
    Luis

  • BW Analysis Authorization on two charcteristics issue

    I am familiar with analysis authorizations in BW 7.0 and worked on it.
    Today we have blanket authorization (RSECADMIN) for 0TAX_NUMB = *. Meaning user who has this auth/role can see values (from where ever 0TAX_NUMB is used, all company codes etc). And as you might know 0TAX_NUMB is used in 0VENDOR & 0CUSTOMER master data (as an attribute). This works well, because its easy
    Now, new requirement is to create more strict analysis authorizations for 0TAX_NUMB based on other characteristic values.
    Auth1 (should apply to 0TAX_NUMB used in 0VENDOR):
    0TAX_NUMB = all values and only for vendor account group = XXX
    Auth2 (should apply to 0TAX_NUMB used in 0VENDOR):
    0TAX_NUMB = all values and only for vendor account group = yyy
    Auth3 (should apply to 0TAX_NUMB used in 0VENDOR):
    0TAX_NUMB = all values and only for vendor account group = zzz
    Auth4 (should apply to 0TAX_NUMB used anywhere other than 0VENDOR, for example, as I said above its also used in 0CUSTOMER and may be used elsewhere in future):
    0TAX_NUMB = all values
    Do I also need to add 0CUSTOMER here? unable to visualize!!!
    Also, 0TAX_NUMB and Vendor account group will have colon authorization.
    So, at this time I am not sure how this will impact other queries with following scenario(s):
    User1 has auth1:
    Here, User1 can see tax_numb values for vendor act grp XXX, thats good, so far.
    But can user see query results where tax_numb is not used but would like to see all vendor account group related data (or other than value XXX)?
    User2 has auth4:
    Since this auth has blanket tax_numb, can user2 see all values for tax_numb used in 0CUSTOMER (which he/she should) and also in 0VENDOR (he/she should not)...
    And what about queries that do not have 0TAX_NUMB (but infoprovider has)? Colon auth on TAX_NUMB & Vendor act grp would resolve this?
    I appreciate your thoughts on this. We are BW 7.01 (Ehp1), SPS10.
    Regards
    -Bala
    Edited by: Bala Shetty on Dec 15, 2011 12:02 AM
    Edited by: Bala Shetty on Dec 15, 2011 12:04 AM
    Edited by: Bala Shetty on Dec 15, 2011 12:05 AM
    Edited by: Bala Shetty on Dec 15, 2011 12:09 AM

    Thank you Sushant.
    I am aware of these notes and provide basic information and also usage of value restrictions. I am looking for usage of different combinations for multiple characteristics (especially the attributes of master data)....
    Regards
    -Bala

  • Web Intelligence Report + BI 7.0 Analysis Authorizations

    Hello Experts,
    I have created a report on a universe based in a SAP BW InfoCube that contains an authorization relevant InfoObject (Company Code).
    BW Analysis authorization have been set up for this cube in such way that the user should have access only to data containing one of the two values of Company Code (lets say for example that the user can access value "A").
    It seems to be working fine when testing them via a BEx Query or via rsecadmin (rsrt with detailed analysis authorization logs). When the test user tries to view the full contents of the specific cube gets an "access denied" message (this is normal), whereas if the user runs a report with a filter "A" on Company Code the report returns the results as it should have. So far so good.
    For testing use within Web Intelligence, I have created the following Single Sign On (SSO) universes: a)directly on the cube, b)via a "select all" query and finally c)via a filtered query (filtering the exact allowed values of analysis authorization of the test user). All of the above have unfortunately the exact same issues:
    When a test user with limited analysis authorization (i.e. a user that can only access value "A" of Company Code) tries to view a report on either of these universes, then the result is the following message when trying to execute the query "A database error occured. The database error text is: Error loading cube MyCube/MyQuery (catalog MyCube): Unknown error. (WIS 10901)"
    I have tried several settings on the universe (like filter working on LoV as well) but none helped.
    If we replace the user's analysis authorizations with full access on company code (values "A" and "B") the query runs as it should have.
    Any ideas?
    Best regards
    Giorgos

    Hi,
    has the Universe been created on the cube level or on the query level ?
    In case it is on the cube level it will fail because :
    Analysis authorizations are not based on authorization objects. Instead, you create authorizations that include a group of characteristics. You restrict the values for these characteristics.
    The authorizations can include any authorization-relevant characteristics, and treat single values, intervals, and hierarchy authorizations in the same way. Navigation attributes can also be flagged as authorization-relevant in the attribute maintenance for characteristics and can be added to authorizations as separate characteristics.
    You can then assign this authorization to one or more users.
    All characteristics flagged as authorization-relevant are checked when a query is executed.
    *A query always selects a set of data from the database. If authorization-relevant characteristics are part of this data, you have to make sure that the user who is executing the query has sufficient authorization for the complete selection. Otherwise, an error message is displayed indicating that the authorization is not sufficient. In principle, the authorizations do not work as filters. Very restricted exceptions to this rule are hierarchies in the drilldown and variables that are filled depending on authorizations. Hierarchies are mostly restricted to the authorized nodes, and variables that are filled depending on authorizations act like filters for the authorized values for the particular characteristic*
    Ingo

  • [BO over SAP BW] Web Intelligence Report + BI 7.0 Analysis Authorizations

    Hello Experts,
    I have created a report on a universe based in a SAP BW InfoCube that contains an authorization relevant InfoObject (Company Code).
    BW Analysis authorization have been set up for this cube in such way that the user should have access only to data containing one of the two values of Company Code (lets say for example that the user can access value "A").
    It seems to be working fine when testing them via a BEx Query or via rsecadmin (rsrt with detailed analysis authorization logs). When the test user tries to view the full contents of the specific cube gets an "access denied" message (this is normal), whereas if the user runs a report with a filter "A" on Company Code the report returns the results as it should have. So far so good.
    For testing use within Web Intelligence, I have created the following Single Sign On (SSO) universes: a)directly on the cube, b)via a "select all" query and finally c)via a filtered query (filtering the exact allowed values of analysis authorization of the test user). All of the above have unfortunately the exact same issues:
    When a test user with limited analysis authorization (i.e. a user that can only access value "A" of Company Code) tries to view a report on either of these universes, then the result is the following message when trying to execute the query "A database error occured. The database error text is: Error loading cube MyCube/MyQuery (catalog MyCube): Unknown error. (WIS 10901)"
    I have tried several settings on the universe (like filter working on LoV as well) but none helped.
    If we replace the user's analysis authorizations with full access on company code (values "A" and "B") the query runs as it should have.
    Any ideas?
    Best regards
    Giorgos

    Hi,
    has the Universe been created on the cube level or on the query level ?
    In case it is on the cube level it will fail because :
    Analysis authorizations are not based on authorization objects. Instead, you create authorizations that include a group of characteristics. You restrict the values for these characteristics.
    The authorizations can include any authorization-relevant characteristics, and treat single values, intervals, and hierarchy authorizations in the same way. Navigation attributes can also be flagged as authorization-relevant in the attribute maintenance for characteristics and can be added to authorizations as separate characteristics.
    You can then assign this authorization to one or more users.
    All characteristics flagged as authorization-relevant are checked when a query is executed.
    *A query always selects a set of data from the database. If authorization-relevant characteristics are part of this data, you have to make sure that the user who is executing the query has sufficient authorization for the complete selection. Otherwise, an error message is displayed indicating that the authorization is not sufficient. In principle, the authorizations do not work as filters. Very restricted exceptions to this rule are hierarchies in the drilldown and variables that are filled depending on authorizations. Hierarchies are mostly restricted to the authorized nodes, and variables that are filled depending on authorizations act like filters for the authorized values for the particular characteristic*
    Ingo

  • Analysis Authorizations Issue (BI 7.0)

    Dear Colleagues,
    I have a question regarding BI 7.0 Authorizations. What happens when a cube is created from an Infoprovider in which Company Code (to use an example) is marked as authorizations relevant, but that infobject is not used. That is, the cube gets data from that Infoprovider, but the data retrieved has nothing to do with Company Code. When a query is created from this cube, will the user be required to have authorizations for the company code of the information he's retrieving or will she/he be able to see all the information?
    Thanks in advance for your help.
    Best regards,
    CMPT

    Hello,
    I think I understand your question?
    If you have characteristic company code marked as authorization relevant...
    You have two basic info cubes, one with company code A and one without company code B.
    You have a multi cube combining characteristics from both basic cubes (including company code).
    If you execute a query written against the multi cube but extracts data only from basic cube B (without company code), will you need to have an analysis authorization with company code defined?
    If this is your question, then Yes, you do need to define company code in the authorization (assigning value # should be sufficient).
    KR
    Andy

  • How to implement complex analysis authorizations in simple way

    Hi All,
    I need to create some analysis authorizations with long list of single values for a characteristics. For example, we have multiple set up of company codes (APAC, EAME, AMERICAS, etc) and each set contains 150 - 200 company codes in it. Now we have multiple combinations of company code set and geographies. In short, we will have multiple analysis authorizations and each will have one or two set of company codes and some geographies.
    I can create the analysis authorizations for the first time, by putting individual values in the respective characteristics. That would be a big task but can be done. But the problem is about ongoing maintenance. In future, if a new company code is added to lets say APAC companies, then we will have to update all analysis authorizations which contains APAC company code and that would be huge number of AAs due to the complexity of business architecture.
    Could anyone please suggest if it is possbile (and how) to do below or similar, or have any other better approach (using BW7.4)
    - We would create a group (or set) of company codes. Lets say would create a group APAC_Comp_Code and add all APAC related company codes in it. This would be repeated for all set of compant codes.
    - While creating analysis authorizatons, I would not assign any individual company code value in characteristic, instead put APA_Comp_Code inside the characteristic 0COMP_CODE.
    - If I need to put multiple set of company codes inside 0COMP_CODE, I will just put the corresponding group name, not the invidual values.
    The benefit would be that in future if I need to add a new company code to APAC, I would just have to update this group APAC_Comp_Code. I will not have to maintain the analysis authorizations.
    Please let me know if this is possible or if there is any other way to implement the requirement with simpler maintenance.
    Thanks
    Nitesh Gupta

    Hi Nitesh,
    From what you describe, this would be a good case to use variables in your analysis authorisations. You can specify a variable value for the BUKRS field and have a couple of options to populate the values which are picked up in the query execution.
    You will need to ensure that you activate the istep to read customer exit variables and have the query variable set as customer-exit. Once those are complete, you can create a custom table to maintain the mapping of groups to company codes, or to read the company codes directly from your ERP system (if you want to base authorisations on what the users can see in ERP) and populate the table with those values.
    However you populate the value to the variable, I think this approach will get you closer to minimal maintenance going forward. Enhancement RSR00001 should be implemented, some help documentation for this below
    http://help.sap.com/saphelp_nw70/helpdata/en/1d/ca10d858c2e949ba4a152c44f8128a/content.htm
    Hope this helps,
    Tom

  • How to Move Migrated Analysis Authorization across the landscape?

    Hi,
    we have migrated existing 3.x obsolete authorization concept to 7.x Analysis Authorization with the SAP delivered program RSEC_MIGRATION. Unit test is completed in the Development. What is the process to move the changes to quality.
    Any help is greatly appreciated.
    Thanks!

    Hi Tony,
    what about the roles that are updated during the migration process. How do I identify them and Do I need to collect them and transport too? Is there a way I can use the tables you mentioned in the above discussion for this.
    First you should decide on whether you wish to use direct AA assignment or use S_RS_AUTH authorization object (This is referred as indirect AA assignment).
    If you wish to assign AA directly, you doesn't require the roles to be transported and just need to transport the AA, since the AA works independently.
    If you with to implement indirect AA assignment, you should identify the roles (from the tables I've provided in my last post) and findout the roles based on query's. Further the AA that were related to the queries should be added using S_RS_AUTH and these roles require a transport.
    Hope this helps!!
    @Arpan - Those tables are required to quickly find out the roles Vs queries Vs InfoAreas/InfoCubes information to work on the AA.
    Regards,
    Raghu

  • Analysis Authorization Issue 7.3

    Hello Friends,
    System BW 7.3, Currently there are 80 odd analysis authorization objects
    We want to introduce a new info object (GL Account) to be authorization relevant, ( there are few objects in the system which are already authorization relevant in the system with proper analysis authorization objects and they are working fine)
    Things done, made the GL Account object authorization relevant in RSA1, Created 2 analysis authorization objects with GL Account and TCT objects and one with hierarchy restrictions and one open access.
    Added this object to the user in addition to its already existing authorization objects. Created authorization variable in BEx.
    Some how the authorization is not picked up and it gives us all the values in the report. But if I add the GL Account info object to the existing analysis authorization objects then it works fine.
    I do not want to change all the existing analysis authorization objects to add GL Account.
    Your inputs are most welcome.
    Thanks
    Ed.

    Gajesh- I have added the new analysis authorization object to the user in RSECadmin.
    Subhendu- Problem statement: What are the steps involved in making a new info object(GL Account) authorization relevant. Authorizations are given at hierarchy level. Can we create a new analysis authorization with  GL Account only or do we have to add it to every existing analysis authorization
    I have done the following steps
    1. Made the GL Account object authorization relevant in RSA1,
    2. Created 2 new analysis authorization objects with GL Account ( with hierarchy restrictions) and TCT objects and one with GL Account open access.
    3. Added this object ( which has restrictions) to the user in RSECADMIN, in addition to its already existing authorization objects.
    4. Created authorization variable in BEx.
    5. No existing analysis authorization objects have been changed.
    When I test the report, It does not restrict based on the hierarchy that I have given, it gives open access.
    But If I add GL Account with restrictions to the existing analysis authorization object, it works good.
    Guess I am missing some thing here.
    Do you need any other screen shots.
    Thanks
    Ed.

  • Analysis Authorization

    We have a need to restrict the majority of our users from seeing transactions of few business accounts.  The restricted accounts can be based on a specific gl account, fund range, or they can be a combination of a fund and cost center (or fund and fund center).  Until we become more familiar with this process, we are only concerned with 0FUND and it's restricted ranges, so below my question is just about 0FUND.. 
    We need to explore and understand what abilities analysis authorizations give us. I have done a lot of reading, but so far all of the pieces are not falling into place.  I am on the BW team and working with the security team to get this accomplished.  At this time whereever 0FUND is located in an existing authorization, it has a "*" to indicate the user gets all values.  We have already gone live; will every authorization currently in use with 0FUND have to be changed?  Is there a detailed How-To located somewhere?
    thank you in advance for your help.
    LLK

    Hi Linda,
    SUIM - User Information System is a TRANSACTION CODE. (Its not SUM)
    Execute SUIM and follow the path mentioned below:
    SUIM -> User -> Users by complex selection criteria -> Users by complex selection criteria. In the Authorization object field mention S_RS_AUTH and in the field mention the name of the analysis authorization which you want to search for.
    The output would be users who have access to the analysis authorization that you gave in the search criteria.
    Since in your case there would be a lot of analysis authorizations with * in 0FUND,  it would be better to identify the roles first and then the users assigned to these roles.
    You can identify the roles by browsing the table SE16. Just give the object name and all the analysis authorizations in the multiple selection on appropriate fields. Then use SUIM to identify the users who have access to these roles.
    SUIM -> User -> Users by complex selection criteria -> By Roles.
    You can also display the roles in this report by pressing the Roles button at the top. Apply filter to restrict the roles to your identified roles.
    Thats it !
    Regards
    Sachin

  • BW BEX Queries and Analysis Authorizations

    Hello....
    Have an opportunity with BW BEX queries and Analysis Authorization...would like to see if anyone has had the same experience and if so is there a answer....
    1) given a query....
    2) given a analysis authorization with a info-object that has intervals defined to be both single values and ranged values
    the following happens...
    after the query is fired the starter screen appears...the info-object in question appears with the defined single values only....if....the window is opened....again only the single values appear...the range values do not appear...once the query is executed the only results given are those for the single values...
    also if you re-fire the query and manually enter a valid value for the info-object that falls with-in any of the range values no result is given...even if there is data for it....the reponse given is no data found....
    NOW...if the single values, for the given info-object, are removed from the Analysis Authoriization then the range values appear and work....
    Is this a problem within in the query...or...is this a "feature" of the query...and thus must be "lived" with...
    Terry
    PS...this problem currently only happens if the window for the info-object allows for multi-selection....this problem does not occurr when the window only allows for one selection...

    Hi,
    This is a known problem with analysis authorization and multi selection IO selection criteria.
    When you define the analysis authorization with ranges and when you try to enter single values on the selection critera of the query, then the system shows zero data.
    You can run the query without entering any selection values for the IO in question only.
    I have tried several combinations and still encountering the same issue.
    Ravi

  • Analysis Authorization & its compaitbility with BW 3.5 Query

    Hi,
    We have technically upgrade our system from BW 3.5 to BI 7.0. Now we are planning to upgrade to Analysis Authorization.
    1. Is it necessary to Migrate BW 3.5 query to BI 7.0 so that it will work with Analysis Authorization? If not, then how Analysis auth will treat authorization variable defined in the query?
    2.What are pro & cons of two approach: Fresh Implementation of Analysis Authrization v/s Migration using tool ?
    Please advise.
    Best Regards,
    UR

    Dear UR,
    Iu2019m going to try helping you,
    In advance a give you some ideas about migration process regarding authorization system.
    Currently you can use the old concept of authorization (reporting authorization object) in the 7.0 2004s environment. You can set up in Tcode: RSCUSTV23 what authorization mode, you would like use. 
    When have you migrated whole queries but you keep the old concept, this doesnu2019t impact the authorization system functionality.
    When you change the authorization mode to current procedure with analysis authorizations, you need be careful with the attribute navigational. Because, in the old mode, the attribute navigational get setting of its characteristic. Example if you use 0COMP_CODE__0COSTCENTER, and de 0COSTCENTER is relevant authorization, all of attribute navigational com from 0COSTCENTER are relevant authorization. Otherwise, in current procedure with analysis authorizations, where each navigational attribute has the same level of a characteristic.
    When you migrate to analysis authorization, SAP best practice recommend keep in each reporting role all of reporting authorization object for a short period of the time.
    In my experience the main thing was list above.
    Try to get more information in:
    SAP BI - User Management & Authorizations
    OSS Note 923176
    I hope this suggestion can help you,
    Luis

  • [CUA] Compatibility with Analysis Authorizations (RSECADMIN)

    Hello,
    I have two questions for you, BI experts :
    1) Could someone please confirm that it is not possible to centrally maintain Analysis Authorizations (trx RSECADMIN) from the CUA ?
    2) Does it make sense to start a CUA project now with the Identity Management solution coming soon ? What are the pros & cons of each ?
    Thanks in advance.
    Best regards,
    Guillaume

    Hi,
    I had a look at the Roles and Profiles tables used by CUA.
    I found that it uses special tables such as :
    USRSYSACT     CUA: Roles in Distributed Systems
    USRSYSACTT     CUA: Roles in Distributed Systems
    USRSYSPRF     CUA: Profiles in Distributed Systems
    USRSYSPRFT     CUA: Profile Text in Distributed Systems
    USLA04          CUA: Assignment of Users to Local  Roles
    USL04          CUA: Assignment of Users to Local Profiles
    There is no analogous table for RSECADMIN tables such as :
    RSECAUTHGENERATD     BI AS Authorization Reporting: Generated Authorizations
    RSECLOG               Storage for Authorizations Logs xml
    RSECTXT               Authorization Texts
    RSECUSERAUTH          BI AS Authorizations: Assignment of User Auth
    RSECVAL               Authorization Value Status
    This, I conclude that it is not possible to maintain BI analysis authorizations from the CUA central system.
    This kind of authorizations has to be performed in the child system directly.
    Unless, SAP has something to draw out of its pocket soon... 
    I indeed read that some development was done on the CUA, parallel to the SAP NW Identity Management solution.
    Best regards,
    Guillaume

Maybe you are looking for