Authorization check during logon

hi,
please help me to find out the answer.. which authorization object is checked first when a user log in to a sap system?

Hi Adri,
While logging no authorization are checked against your ID,but your Authorization are copied in user buffer.
When you execute tcode authorization are check from this buffer.
If you don't assign any authorization i.e role to user, user is able to login but cannot execute any tcode.
This justified it.
Try it out.
Hope this helps

Similar Messages

How to check during logon if an SAP ECC6.0 (ABAP) user is in Microsoft ADS

Hello
How to check during logon if an SAP ECC6.0 (ABAP) user is in Microsoft Active Directory Services.
I would like to prevent logon to ABAP system for users not present in Microsoft Active Directory Services
Thank you in advance

Have you looked at setting the SNC functionality for lookups against AD? Here's a link that might be helpful: [Secure Network Communications |http://help.sap.com/saphelp_nw70ehp1/helpdata/en/e6/56f466e99a11d1a5b00000e835363f/frameset.htm]
[Configuring SNC on AS ABAP |http://help.sap.com/saphelp_nw70ehp1/helpdata/en/e6/56f466e99a11d1a5b00000e835363f/frameset.htm]
Hope that is helpful.
J. Haynes

Authorization Check during PR creation

Hi,
I would like to put authorization check in PR creation,particularly
in the account assignment category. I have created a customized authorization object ZX with the field activity and knttp. My problem now is what userexit i can put this authorization check during PR creation/change...
i have 2 kind of user, 1st is have access to all and 2nd user is create/change/display to kntpp = K. how can i accomplish this?
appreciate all the help.points will be given. thanks
she

thanks. at the moment, we dont have abaper to work on the coding and to check userexit..so i was hitting this by all the help i can get from this forum. anyone had tried or worked with the same requirement? appreciate if i can have the abap coding at the same time the userexit being used.
the requirement is to restrict user to create/edit PR to a certain account assignment KNTTP.
i have created the customized auth object (knttp -( actvy, knttp)..the customized auth object is maintained to each user role.
Eg. user1 - knttp (acvtyt =*, knttp=KNTTP)
user2- knttp(actvt = *, knttp=K)
so if user2 try to create/change PR with account assigment not equal to K - cost center.
error message will be trigger during authorization check.
appreciate all the help.. thanks in advance.

Authorization Check when logon into SAP via ITS

Hello
We have implemented Authorization Check after user have logged on to SAP via ITS in this User Exit SUSR0001. It was working fine in 46C version, but after upgrade to ERP 2005, when user logs on into SAP via ITS, this user exits is ignored, while logging normally via SAP GUI; authorization check is performed as before?
Did anyone else have experienced the same problem?

From what I understand something on that line changed. We are still hanging on to our external ITS 6.20 so I am afraid I can not go into details.

Cost Centre authorization check during PR creation

Hi all,
Just want to know whether the standard SAP do check the cost centre authorization during PR creation with account assignment.
Please note that no user exit is used.
I am looking at standard system check on the authorization object thru the user profile.
Thanks.
Tom

Hi Steve,
I found the solution. The control must be from the authorization object that assigned to the user.
For example, M_BEST_EKO authorization object. The display activity "09" (Display Price) should not be assigned to this authorization object.
Hence, the user would not be able to see the price info in the standard report.
Cheers.
Tom

No Authorization check for MultiProvide (S_RS_MPRO)

Hello Every body
We have a problem regarding the authorization check for MultiProviders. We have assigned the auth. object S_RS_MPRO to a user for one specific MultiProvider. We have also turned on the settings for "MultiProvider" and "MultiPro. (Query) in IMG.
Unfortunately the user has access to all the MultiProviders. We have traced the user and have found out, that there is no authorization check for the MultiProviders.
We have tried to remove the settings mentioned above and use InfoCube (Query) setting instead in conjunction with S_RS_ICUBE. No luck here neither.
One thing that could be important to mention is that the Settings for "MultiProvider" and "MultiPro. (Query) in IMG has been implemented before the object has been assigned to a user.
For that We removed the settings from all Roles, and then we assigned the object to a user, and at last we activated the settings for "MultiProvider" and "MultiPro. (Query) in IMG. No luck here neither.
Bottom line is that the system does not check for S_RS_MPRO
Any kind of suggestion would be appreciated
/FZA
SAP_BW 350
SP 12
BI_CONT 353
PI_BASIS 2004_1_640

0.820 BW-BEX-OT-OLAP-AUT 619778 No check of S_RS_ICUBE for Multiprovider 16.10.2003
2. 0.800 BW-WHM-DST-AUT 626385 Multiprovider: Authorization in query fails 07.10.2003
3. 0.790 BW-BEX-OT-OLAP-AUT 662617 Activity is 'Change', but only 'Display' is checked 07.01.2004
4. 0.760 BW-WHM-DST-AUT 626574 MultiProvider authorization check during query 17.10.2003
5. 0.760 BW-WHM-DBA-MPRO 520588 New authorization object S_RS_MPRO 05.11.2003
6. 0.750 BW-WHM-DST-AUT 736996 Authorization check performed on S_RS_MPRO 28.06.2004
7. 0.700 BW 693363 SAPBWNews BW SP03 NW'04 Stack 03 RIN 22.04.2005
8. 0.690 BW 692636 SAPBWNews BW SP02 NW'04 Stack 02 RIN
hallo
Please have allok at the mentioned OSS note
Mike

Query hangs during Authorization Check (Event ID 4500)

I have a BI7 query when executed by developer role (no security) the query runs within seconds. When executing under end user id, it runs for 5 minutes +. Aggregates are built and the long runtime ONLY occurs when it is an end user role with specific CC's.
I tested the query via RSRT, Cache off and Display Statistics and it is clear the query gets stuck for 4.5 minutes under Event ID 4500, Authorization Check.
This delay does not occur when the query is initially executed. It only occurs AFTER the variable prompt and when query variables are entered and query is executed.
Q1) Can anyone explain a transaction or place to understand why the Authorization Check takes so long?
Q2) I would also like to understand the execution order for queries... for example how does the filters or data in the rows get executed?

Hi Anurag
i read again this documentation i'd get in another form ("howTo..." Guide on Help.sap.com) :
I create newsample from scratch and it works !
Reason of my problem :
I created 2 authorization objects (given to users) :
- first with IO 0CUSTOMER,value '*', without 0TCTAUTHH
- second with IO OCUSTOMER, valeur ' ' (blank), with 0TCTAUTH with required node value.
=> First authorization grants * for 0CUSTOMER (all) and present the entire hierarchy during selection node in query. By deleting it, it works.
Thank's a lot.
Etienne

An internal error occurred during the authorization check.

Hi,
Need help,
While deleting chain in order to create Meta chain.I am getting this Error message.
Thanks

Hi,
I am creating a meta chain.When i am trying to add local chain in it.Through general services tab >> start process.A dialog box appears asking me to delete one of the chain and the other one will act as both.When i am clicking yes then i am getting this msg.
An internal error occurred during the authorization check.
Edited by: Niraj Sharma on Aug 12, 2009 11:19 AM

Authorization check when searching for transactions

Hi all,
We have a requirement to show only those activities for which a user is authorized. A custom authorization object has been maintained and the check in CRMD_ORDER has been extended accordingly. When opening an activity, the check is executed correctly, but when searching for activities, ALL activities are still shown, so the check is not performed at that particular moment. I have tested with standard authorization objects as well, but none of them are taken into account. Does anyone of you know how we can have the authorization check executed before or during the search, so that only those activities are shown, that the user may maintain as well.
Thanks in advance!
Regards,
Joost

Hello Joost,
Check if BADI CRM_ORDER_INDEX_BADI could not map your requirement.
Regards,
Frédéric

No authorization Check..in CRM_ORDER_MAINTAIN.

hello Experts,
I have a business Partner Wherein i need to add new partners to a business activity. So i used the FM : 'CRM_ORDER_MAINTAIN'.
I have written the Followin Code, but during the execution of code i am getting an error ' 'An authorization check could not be executed '.
METHOD if_ex_order_save~change_before_update.
LOOP AT it_bp INTO wa_bp1.
    wa_bp2-REF_GUID = wa_orderadm_h-GUID.
    wa_bp2-ref_handle = '0000000001'.
    wa_bp2-ref_kind = 'A'.
    wa_bp2-ref_partner_handle = '0002'.
    wa_bp2-kind_of_entry = 'C'.
    wa_bp2-partner_no = wa_bp1-partner.
    wa_bp2-partner_fct = 'Z0000011'.
    wa_bp2-display_type = 'BP'.
    wa_bp2-no_type = 'BP'.
    wa_bp2-mainpartner = 'X'.
    APPEND wa_bp2 TO it_bp2.
    wa_field_line-fieldname = 'DISPLAY_TYPE'.
    wa_field_line-CHANGEABLE = 'X'."space.
    APPEND wa_field_line TO it_field_line.
    wa_field_line-fieldname = 'KIND_OF_ENTRY'.
    wa_field_line-CHANGEABLE = 'X'."space.
    APPEND wa_field_line TO it_field_line.
    wa_field_line-fieldname = 'NO_TYPE'.
    wa_field_line-CHANGEABLE = 'X'."space.
    APPEND wa_field_line TO it_field_line.
    wa_field_line-fieldname = 'PARTNER_FCT'.
    wa_field_line-CHANGEABLE = 'X'."space.
    APPEND wa_field_line TO it_field_line.
    wa_field_line-fieldname = 'PARTNER_NO'.
    wa_field_line-CHANGEABLE = 'X'."space.
    APPEND wa_field_line TO it_field_line.
    wa_input-logical_key = wa_bp2-ref_partner_handle.
    wa_input-ref_handle = '0000000001'.
    wa_input-ref_kind = 'A'.
    wa_input-objectname = 'PARTNER'.
    wa_input-field_names = it_field_line.
    APPEND wa_input TO it_input.
READ TABLE lt_orderadm_h INTO wa_orderadm_h
with key process_type = 'ZDOR'.
wa_order-GUID = wa_orderadm_h-GUID.
wa_order-MODE = 'A'.
wa_order-process_type = 'ZDOR'.
APPEND wa_order to it_order.
    CALL FUNCTION 'CRM_ORDER_MAINTAIN'
     EXPORTING
       it_partner                    = it_bp2
* IMPORTING
*   ET_EXCEPTION                  = it_ex
     CHANGING
   CT_ORDERADM_H                 = it_order
       ct_input_fields               = it_input
     EXCEPTIONS
       error_occurred                = 1
       document_locked               = 2
       no_change_allowed             = 3
       no_authority                  = 4
       OTHERS                        = 5
    IF sy-subrc <> 0.
      MESSAGE ID sy-msgid TYPE sy-msgty NUMBER sy-msgno
              WITH sy-msgv1 sy-msgv2 sy-msgv3 sy-msgv4.
    ENDIF.
    wa_save = wa_orderadm_h-guid.
    INSERT wa_save INTO it_save.
    CALL FUNCTION 'CRM_ORDER_SAVE'
      EXPORTING
        it_objects_to_save         = it_save
*   IV_UPDATE_TASK_LOCAL       = FALSE
*   IV_SAVE_FRAME_LOG          = FALSE
*   IV_NO_BDOC_SEND            = FALSE
*   IT_ACTIVE_SWITCH           =
* IMPORTING
*   ET_SAVED_OBJECTS           =
*   ET_EXCEPTION               =
*   ET_OBJECTS_NOT_SAVED       =
* CHANGING
*   CV_LOG_HANDLE              =
* EXCEPTIONS
*   DOCUMENT_NOT_SAVED         = 1
*   OTHERS                     = 2
    IF sy-subrc <> 0.
* MESSAGE ID SY-MSGID TYPE SY-MSGTY NUMBER SY-MSGNO
*         WITH SY-MSGV1 SY-MSGV2 SY-MSGV3 SY-MSGV4.
    ENDIF.
CALL FUNCTION 'BAPI_TRANSACTION_COMMIT'
* EXPORTING
*   WAIT          =
* IMPORTING
*   RETURN        =
ENDLOOP.
ENDMETHOD.
Please Help.
Thank You.
Edited by: akshayruia on Apr 11, 2011 5:45 AM

hi, have edited the method as per the suggestion i am not getting the error any more, but i am also not able to add the partner in activity..the code is as follows :
LOOP AT it_bp INTO wa_bp1."it_partner into wa_partner."
    ADD 1 TO counter.
    wa_bp2-ref_guid = wa_orderadm_h-guid.
    wa_bp2-ref_handle = '0000000000'."wa_partner-REF_HANDLE."
    wa_bp2-ref_kind = 'A'."wa_partner-REF_KIND."
    wa_bp2-ref_partner_handle = counter.                    "'0002'.
    wa_bp2-kind_of_entry = 'C'.
    wa_bp2-partner_no = wa_bp1-partner.
    wa_bp2-partner_fct = 'Z0000011'.
    wa_bp2-display_type = 'BP'.
    wa_bp2-no_type = 'BP'.
    wa_bp2-mainpartner = 'X'.
    INSERT wa_bp2 INTO TABLE it_bp2.
   MOVE-CORRESPONDING wa_bp2 to ls_logical_key.
    wa_field_line-fieldname = 'DISPLAY_TYPE'.
    wa_field_line-changeable = space. "'X'."
    INSERT wa_field_line INTO TABLE it_field_line.
    wa_field_line-fieldname = 'KIND_OF_ENTRY'.
    wa_field_line-changeable = space."'X'."
    INSERT wa_field_line INTO TABLE it_field_line.
    wa_field_line-fieldname = 'NO_TYPE'.
    wa_field_line-changeable = space."'X'."
    INSERT wa_field_line INTO TABLE it_field_line.
    wa_field_line-fieldname = 'PARTNER_FCT'.
    wa_field_line-changeable = space."'X'."
    INSERT wa_field_line INTO TABLE it_field_line.
    wa_field_line-fieldname = 'PARTNER_NO'.
    wa_field_line-changeable = space."'X'."
    INSERT wa_field_line INTO TABLE it_field_line.
wa_input-ref_guid = wa_orderadm_h-guid."guid.
   wa_input-logical_key = ls_logical_key."wa_bp2-ref_partner_handle.
    wa_input-ref_handle = '0000000000'.
    wa_input-ref_kind = 'A'.
    wa_input-objectname = 'PARTNER'.
    wa_input-field_names = it_field_line.
    INSERT wa_input INTO TABLE it_input.
    READ TABLE lt_orderadm_h INTO wa_orderadm_h
    WITH KEY process_type = 'ZDOR'.
    wa_order-guid = wa_orderadm_h-guid.
    wa_order-mode = 'A'.
    wa_order-process_type = 'ZDOR'.
    INSERT wa_order INTO TABLE it_order.
ENDLOOP.
CALL FUNCTION 'CRM_ORDER_MAINTAIN'
       EXPORTING
         it_partner                    = it_bp2
IMPORTING
ET_EXCEPTION                  = it_ex
       CHANGING
         ct_orderadm_h                 = it_order
         ct_input_fields               = it_input
       EXCEPTIONS
         error_occurred                = 1
         document_locked               = 2
         no_change_allowed             = 3
         no_authority                  = 4
         OTHERS                        = 5
IF sy-subrc <> 0.
    MESSAGE ID sy-msgid TYPE sy-msgty NUMBER sy-msgno
            WITH sy-msgv1 sy-msgv2 sy-msgv3 sy-msgv4.
ENDIF.
CALL FUNCTION 'BAPI_TRANSACTION_COMMIT'
(code)

Authorization checked for infoObjects even though not relevant to report

Hello guys,
I am facing a problem in BI 7.0 authorization checks.
For a given report the BI team has placed a restriction in the query only for infoObject 0Comp_code (company code) and 0SOLD_TO (sold to party). Accordingly i have created authorization in RSECADMIN and assigned to role--> user.
But when the user runs the report, he gets as authorization error and during analysis in RSECADMIN i see that "list of Authorization relevant charecteristics(infoObjects) for info provider xxxx" contain other infoObjects as well.
Is it a case where infoObjects can be made authorization relevant for the whole info provider eg-ZSD_M42" (where this is a multi provider)apart from being checked for specific reports eg- ZSD_M42_Q0001?
How do i get around this problem?
Regards,
Prashant

Hi Prashanth,
What Zaheer said was exactly correct.Make sure all the Auth relevant Chaaracteristics of an Infoprovider are properly authorized through your Analysis Authorization.Suppose if you don't need security on other Characteristics of an InfoProvider give * in your AA which will byepass check on that particular Auth relevant Characteristics..
More over,See to that all the key figures are properly authorized as all the keyfigures are by default auth relevant in BI.
Cheers,,
Ramkumar C

Shipment cost with authorization check

Dear Expert,
I have a problem about shipment cost, my requirement would like to check authorize by transport planning point
during transaction
VI01
VI02
VI03
VI04
but Standard shipment cost check only "Shipment Cost Type"
there is the user exit to check authorize in stage VI01 VI02 and also in VI03 VI04
or what should I do
Thank you very much for suggestion

Dear Expert,
I try to activate "Transport planning point" for checking authorize in VI01
also I check authorize object by "ST01"
there is no authorize check about "Transport planning point" (only have shipment cost type)
then i debug on VI01
1. put shipment number
2. debug
3. enter
in this area there is no transport planning point in variable that sent to check authorization
Please Helps me find out this solution
thank you very much

How to deactivate authorization check?

hi ,
how to deactivate Authorization check?
thanks.
reddy.

Use switch T77S0 to control the use of an authorization object during the authorization check.
If value is 0 authorization check is inactive, if value is 1 inactive. See example below.
AUTSW     ADAYS            15     HR: tolerance time for authorization check
AUTSW     APPRO     0     HR: Test procedures
AUTSW     DFCON     1     HR: Default Position (Context)
AUTSW     INCON     0     HR: Master Data (Context)
AUTSW     NNCON     0     HR:Customer-Specific Authorization Check (Context)
AUTSW     NNNNN     0     HR: Customer-specific authorization check
AUTSW     ORGIN     1     HR: Master data
AUTSW     ORGPD     0     HR: Structural authorization check
AUTSW     ORGXX     0     HR: Master data - Extended check
AUTSW     PERNR     1     HR: Master data - Personnel number check
AUTSW     VACAU          Activate Auths for Maintaining Vacancies (PBAY)
AUTSW     XXCON     0     HR: Master Data - Enhanced Check (Context)
http://help.sap.com/saphelp_erp60_sp/helpdata/EN/84/49ba3b3bf00152e10000000a114084/frameset.htm
Regards,
David

Authorization check by Cost centers

Hello all,
I developed a report in Report Painter and the requirement is that the users be able to run it only for their own CCtrs - challenge is that we are trying to not use variants, custom transactions and also modifying / checking authorization at at SU01 level.
Is there any other way to do this and if yes can you pls provide some details.
Thanks,
Richa

hi richa,
Authorizations with Variables
Definition
Instead of using a single value or interval, you can also use variables in authorizations. The Customer Exit is called up for these variables while the authorization check is running. The call is carried out with I_STEP = 0. The intervals of characteristic values or hierarchies for which the user is authorized can be returned here. By doing this, the maintenance load for authorizations and profiles can be reduced significantly.
Every cost center manager should only be allowed to evaluate data for his/her cost center. Within the SAP authorization standard, a role or a profile with the authorization for the InfoObject 0COSTCENTER equal to XXXX (XXXX stands for the particular cost center) would have to be made for every cost center manager X. This then has to be entered in the user master record for the cost center manager.
Using variables reduces the authorization maintenance workload with the InfoObject 0COSTCENTER equal to $VARCOST, as well as with the role or the profile, which is maintained for all cost center managers. The value of the variable VARCOST is then set for runtime during the authorization check by the CUSTOMER-EXIT RSR00001.
Maintaining the authorizations restricts the entries for the values to the length of the existing InfoObject. It is possible, however, to use both limits of the interval. In the example 0COSTCENTER with 4 spaces, the variable VARCOST is, therefore, entered as $VAR COST.
There is a buffer for these variables. If this buffer is switched on, the customer exit is only called up once for a variable with the authorization check. In doing so, you avoid calling up the customer exit for variables over and over, as well as decreasing performance. If you want to call up the customer exit each time, you have to deactivate this buffer in the Setting Up Reporting Authorizations. To do this, go to the main menu and choose Extras ® Compatibility ® Buffer for Variables (Customer-Exit) ® Deactivate..
You can also call up the customer exit for authorizations for hierarchies. There are two ways to do this:
       1.      Enter the variable in the authorization for characteristic 0TCTAUTHH. The customer exit is then called up while the authorization check is running. In the LOW fields of the return table E_T_RANGE, the system anticipates the technical name for the hierarchy authorization that you specified in the authorization maintenance (transaction RSSM).
As a result, all parameters are available for such an authorization. Nevertheless, you must also create a new definition for each node.
       2.      Where many authorizations differ from an authorization for a hierarchy only in respect to the nodes and not to the other authorizations, we suggest the following solution: Different users can be authorized for a specific hierarchy area (subtree). The highest node is different for each user.
Do this by creating an authorization for a hierarchy in the transaction RSSM and enter this in the authorization or role. Instead of specifying a particular node, you specify the variable in the authorization maintenance (transaction RSSM). The customer exit is then called up for the node while the authorization check is running. The return table E_T_RANGE must be filled according to the customer exit documentation (nodes in the LOW field, InfoObject of the node in the HIGH field
Setting Up Reporting Authorizations
Use
Before you are able to set up reporting authorizations, you have to create authorization objects.
As soon as an authorization object is saved, it can be checked when a query is run. The user may not have the appropriate authorizations if he or she has not yet been assigned this authorization object.
Only when the user has been assigned the appropriate authorizations can he/she define and execute a query or navigate in an existing query.
If in the query a characteristic value or a node is excluded, a complete authorization check * is required.
Procedure
Creating an authorization object
       1.      In the SAP Easy Access initial screen of the SAP Business Information Warehouse, choose the path SAP Menu ® Business Explorer ® Authorizations ® Reporting Authorization Objects.
       2.      Choose Authorization Object ® Create. Give the authorization object a technical name and a regular name. Save your entries.
       3.      On the right-hand side of the screen, an overview of all the InfoObjects that are authorization-relevant is displayed.
Only those characteristics that have been flagged as authorization-relevant previously in the InfoObject maintenance screen can be assigned as fields for an authorization object. See also: Creating InfoObjects: Characteristics
       4.      Assign the InfoObject fields to the authorization object:
¡        Select the characteristics for which you want an authorization check of the selection conditions to be carried out.
¡        Select the InfoObject key figure (1KYFNM) if you want to restrict the authorization to a single key figure.
¡        Select the InfoObject (0TCTAUTHH) if you want to check authorizations for a hierarchy.
¡        Include the authorization field activity (ACTVT) in the authorization object if you want to check authorizations for documents.
       5.      Save your entries.
       6.      Go back to the initial screen of the authorization maintenance.
       7.      Choose Check for InfoProviders ® Display to get a list of the InfoProviders that contain the InfoObjects that you selected and are therefore subject to an authorization check (where-used list). In the change mode you can exclude individual InfoProviders from the authorization check for this authorization object by removing the flag.
Authorization object:           S_RSRSAREA
Name:                   Sales area
Fields:                         DIVISION, CUSTGROUP, 1KYFNM
Creating authorizations
Authorizations are created and maintained in the role maintenance screens.
       1.      Choose Authorizations ® Roles ® Change.
       2.      Specify the roles that you want to change and choose Change. This takes you to the role maintenance screen.
       3.      On the Authorizations tabstrip, choose the Expert mode for generating profiles option.
       4.      Choose the Enter Authorization Objects Manually option, and specify the objects that you require. Choose Enter. The authorization object is added to the role.
       5.      Choose Generate.
For more information, see Changing and Assigning Roles.
Result
The user is now able to work with queries
Authorizations to Work with a Query
Use
Authorizations to work with a query are first checked in the dialog box to open a query.
Furthermore, when a query is opened, the authorizations for the individual objects are checked.
See also: Authorization Check When Executing a Query..
Structure
Check in the Open Dialog Box:
When you open a query, you will see four buttons in the dialog box. The History, Favorites and Roles buttons only display your own queries and those queries intended for you per role definition.
The InfoAreas button enables you to look at all queries for which the user has display authorization. If this display authorization is not restricted to queries, the user will see all available queries in the system here. It is possible to hide the InfoAreas button if you do not want the user to see all queries in the system. The authorization object S_RS_FOLD with the field SUP_FOLDER can be used here. In order to hide the InfoArea button, set this field to X when authorizing, otherwise leave the field blank or set it to * (asterisk all authorizations).. The button will be displayed if the authorization check fails.
Authorizations by User
It is also possible to make queries from particular users (= OWNER = query creator) available to other users (= USER) for display or processing. The authorization object S_RS_COMP1 with four fields (COMPID, COMPTYPE, OWNER, ACTVT) is used here.
You can grant this authorization to a particular team or use the variable $USER to give all users the authorization for queries that they created themselves. $USER is replaced by the corresponding user name during the authorization check.
See also the Example for Reporting Authorizations.
Authorizations for the BEx Broadcaster
Using the authorization object S_RS_BCS, you can determine which user is allowed to register broadcasting settings for execution and in which way.
Note:
·        The only authorization necessary for the online execution of broadcasting settings is the authorization for the execution of the underlying reporting objects (for example, the Web template).
·        Every user that has authorization to create background jobs also has authorization for direct scheduling in the background.
·        If you need to work under the name of another user to execute broadcast settings (for example with user-specific precalculations), the authorization object S_BTCH_NAM for background scheduling is also required for the other user. For more information, see Authorizations for Background Processing and Definition of Users for Background Processing
Authorizations for Selection Criteria
Definition
The selection criteria of a query determine which data can be displayed after you have entered it in a workbook.
An authorization check for certain InfoObjects only takes place if an authorization object with this InfoObject was already created in the authorization object class Business Information Warehouse.
As soon as an authorization object is created, only authorized users can select query data.
Use
To decide whether a user should be authorized to work with a query, you should check whether authorization has been given to him/her for all selection criteria.
Essential to the authorization of selection criteria is the authorization object S_RS_ICUBE.
Definitions of authorizations for working with certain InfoCubes must be transported separately.
See: Transporting Additional Information
In general, it is not sufficient to give authorizations for individual InfoObjects (characteristics and key figures), or to check them separately from one another. It more usual that specific authorizations should be given for combinations of characteristics and key figures.
It is therefore feasible that a "Sales Manager" is allowed to view the respective total sales figures for all sales areas, but is only authorized to break down "his/her" area (0001) according to the individual sales personnel. In this case, the following authorizations, which are grouped together, would be created and assigned.
Sales area = *
Sales personnel = :
Key figure = Sales figures
(: represents the authorization to view the values aggregated with the characteristic.
Sales area = 0001
Sales personnel = *
Key figure = Sales figures
The user frequently uses these "multidimensional" authorities in companies that are regional as well as product-oriented (matrix organization). In this way, you could arrange for the person responsible for the combination of a certain division and a certain sales area to have the exact authorization for the output of the relevant values, without him/her necessarily also having access to the data for the whole division or the whole sales area.
Authorizations for the Query Definition
Authorizations can be granted for the following objects for the query definition in the Business Explorer:
The entire query
Structures
Calculated key figures
Restricted key figures
Variables
The activities for the query definition are specified in the authorization object S_RS_COMP (Business Explorer - components). The authorization object has the following fields: InfoArea, InfoCube, component type, component name and activity.
The following values are possible for the component type:
REP: Entire query
STR: Structure
CKF: Calculated key figure
RKF: Restricted key figure
VAR: Variables
By specifying an InfoArea or an InfoCube, you can further restrict the component types. By specifying a component name, you can specify the authorization for individual components in more detail. Components that begin with 0 are delivered by SAP and cannot be changed. Components that are within the customer name range must begin with a letter of the alphabet.
Valid activities are:
01 (create)
02 (change)
03 (display)
06 (delete)
At the moment, activities 16 (Execute) and 22 (Save for Reuse) are not checked for the query definition.
User A is allowed to create, change or delete queries beginning with A1 and A6 within InfoArea 0001 in InfoCube 0002. In addition, the user is allowed to change the calculated key figures and structures (templates) already defined in this InfoProvider.
Related authorizations for user A:
InfoArea: 0001
InfoProvider: 0002
Component type: REP
Component Name: A1, A6
Activity: 01, 02, 06
InfoArea: *
InfoProvider: 0002*
Component type: STR, CKF
Component name: *
Activity: 02
Authorizations for Display Attributes
Definition
Authorization-relevant display attributes are hidden in the query if the user does not have sufficient authorization to view them.
Use
For characteristics:
The user needs to have complete authorization (*) to see the display attribute in the query.
For the characteristic 0EMPLOYEE, the 0EMPLSTATUS attribute is authorization-relevant. Only users with authorization "*" for 0EMPLSTATUS can display the attribute in the query.
For key figures:
Key figures cannot be marked as authorization-relevant. To use this function nonetheless for key figure attributes, the system checks against meta object 1KYFNM. For this, the user requires authorization for the field 1KYFNM in the authorization object.
The key figure attribute 0ANSALARY is contained in the 0EMPLOYEE characteristic.
If the user has the 1KYFNM field in his or her authorization object, and authorization "*", he or she can display all key figure attributes.
If the user has the 1KYFNM field in the authorization object and the 0ANSALARY key figure as a value of the authorization, he or she can only see this key figure attribute. If the user is not supposed to see this attribute, do not give the authorization "*" but only assign the key figures for authorization that are to be displayed.
Authorizations for Navigation Attributes
Use
During authorization checks for navigation attributes, it is always the characteristic that is being used as a navigation attribute that is checked.
Integration
If referencing characteristics are used as navigation attributes, authorization for the basic characteristic is checked. You should, however, change this logic so that the referencing characteristic is checked for instead. In the maintenance screen for reporting authorizations, choose the following path from the main menu Extras ® Compatibility ® Navigation Attributes ® Switch Off.
This function exists for reasons of compatibility. The authorization logic of referencing characteristics worked differently with the beginning of Release BW 2.0. From BW 2.0, Support Package 20 and in all of the releases that follow, for referencing characteristics as well, the authorization for exactly this characteristic (and not the basic characteristic, as was the case previously) is checked.
Example
In the query, you use characteristic A with the navigation attributes A__B and A__R. Characteristic R references characteristic B. For these navigation attributes, authorization for the basic characteristic B is checked. If you switch off the compatibility for navigation attributes option, B is checked for A__B, and R is check for A__R.
Maintaining Authorizations for Hierarchies
Use
Authorizations for hierarchies determine up to which subarea of a hierarchy a user may drilldown.
Prerequisites
Before you can set authorizations for hierarchies, you must first transfer and activate the InfoObject 0TCTAUTHH from the Business Content. Make sure that the indicator Relevant for Authorization is set. You must also create an authorization object for which you want to set the authorization.
Authorization for a hierarchy on the Profit Center characteristic (0PROFIT_CTR):
Define an authorization object with 0PROFIT_CTR and 0TCTAUTHH.
Example: You define a hierarchy for the basic characteristic B. For characteristic B there is a referencing characteristic R. If you use this hierarchy for characteristic R in the query, authorization for the basic characteristic B is checked. However, you can change this logic so that characteristic R is checked for instead. In the maintenance screen for reporting authorizations, choose the following path from the main menu Extras ® Compatibility ® Ref. Characteristics with Hierarchy ® Switch Off.
You need the characteristic 0TCTAUTHH to specify the hierarchy in the authorization. If you add this characteristic to an authorization object, you can specify authorizations for hierarchies for all InfoObjects in the authorization object.
Procedure
       1.      In the SAP Easy Access initial screen of the SAP Business Information Warehouse, choose SAP Menu ® Business Explorer ®Reporting Authorization Objects.
       2.      Choose Authorizations ® Authorization Definition for Hierarchies ® Change.
       3.      In the Definition, select the InfoObject, hierarchy and node.
If there are several users who are authorized to work with just one part of a hierarchy (subtree) but the top node is different for each, you have the option of specifying a variable instead of a node.
See also: Variable Types
Instead of selecting a node, you can also set the Top of hierarchy indicator. This enables you to ensure that a user is authorized to use a hierarchy from the top node down to a determined level.
You can select the top node here. However, if the hierarchy is being used in a query without a filter on this node, the user will not be able to execute the query.
This is because the top-most visible node does not represent the actual top of the hierarchy. As, for example, there are other Remaining Leaves, there should always be exactly one internal node at the top of the hierarchy. Therefore, there is one internal node above the top-most visible node. If the hierarchy is used in a query without the top-most node being determined, it is compared with this unseen, internal node. So that the user has the correct authorizations, select the internal top of the hierarchy for this option.
       4.      Select the authorization type:
¡        0 for the node
¡        1 for a subtree below the node
¡        2 for a subtree below the node up to and including a level (absolute)
You must define a level for this type. A typical example of an absolute level is data protection with regard to the degree of detail of the data (works council ruling: no reports at employee level only at more summarized levels).
¡        3 for the entire hierarchy
¡        4 for a subtree below the node up to and including a level (relative)
You must specify a level that is defined relative to the node for this type. It makes sense to specify a relative distance if an employee may only expand the hierarchy to a certain depth below his or her initial node, but this node moves to another level when the hierarchy is restructured.
       5.      For types 2 and 4 you can specify, in Hierarchy Level, the level to which the user can expand the hierarchy.
¡        With authorization type 2 (up to and including a level, absolute) the level refers to the absolute number of the level in the hierarchy where the top-most node of the hierarchy is level 1.
¡        With authorization type 4 (up to and including a level, relative) the level number refers to the number of levels starting from the selected node itself which is level 1.
       6.      In the Validity Area you specify in exactly which ways a hierarchy authorization has to match a selected display hierarchy for it to be included in the authorization check.
¡        Type 0 (very high) : The name, version and key date of the hierarchy on which the hierarchy authorization is based have to agree with the selected display hierarchy.
¡        Type 1: The name and version of the hierarchy on which the hierarchy authorization is based have to agree with the selected display hierarchy.
¡        Type 2: The name of the hierarchy on which the hierarchy authorization is based has to agree with the display hierarchy.
¡        Type 3 (lowest) : None of the characteristics have to match.
Note that in some circumstances, setting a check level that is too low may lead to more nodes being selected using hierarchy node variables that are filled from authorizations, than actually exist in the display hierarchy for the query. This can cause an error message.
As a general rule, select the highest possible level for the check.
       7.      If you set the Node variable default value indicator, this definition of an authorization for a hierarchy is used as the default value for node variables.
If more than several authorizations are assigned to a user for different subareas of the same hierarchy, one of these authorizations has to be defined as the default value. Only one node can be selected for a node variable on the variable screen of a query. So that this variable can be filled from the authorizations, the correct variable type has to be selected and an authorization has to be determined as the default value.
       8.      Specify a technical name for this definition. If you do not enter a value, a unique ID is set.
       9.      Now create an authorization for the new authorization object. To do this, enter the technical name of the definition as a characteristic value for the characteristic 0TCTAUTHH. Hierarchy authorizations and authorizations for characteristic values are added:
¡        Specify the value (a blank character) as a characteristic value if only hierarchy authorizations are to be in effect. If you specify more values these are authorized additionally.
¡        Specify the value : (a colon) when queries are also allowed without this characteristic.
The value ' (all characteristic values) is not supported for the characteristic 0TCTAUTHH. Nevertheless, if you specify the value a : is automatically generated instead because no other valid value is found.
If you would like the user to be able to see all values and hierarchies for a characteristic, use the value '*' for this characteristic.
If you use a drilldown hierarchy in the query, you restrict the highest node by a fixed node or a node variable.
Definitions of authorizations for hierarchies must be transported separately. See: Transporting Additional Information
Alternative Procedure:
Manually Maintaining Reporting Authorizations
Use
You usually maintain authorizations in the role maintenance. However, in exceptional cases it could be more practical to create authorizations manually. This is the case if you have to assign every user his/her own role.
Prerequisites
Reporting authorization objects have been created.
Procedure
Assign Authorization Objects
       1.      In the SAP Easy Access initial screen of the SAP Business Information Warehouse, choose SAP Menu ® Business Explorer ® Authorizations ® Reporting Authorization Objects.
       2.      Choose Authorizations ® Authorizations for Several Users. Enter an interval and choose Change.
       3.      Select a characteristic from the left side of the screen. You can then display master data as a list or as a hierarchy. The right side of the screen shows you a list of all the selected users with the authorization profiles and roles you assigned.
       4.      You can now use Drag&Drop to assign additional authorization objects to the user.
       5.      Choose Generate authorizations. The system creates the authorizations and assigns them to the users.
Assigning Authorizations for Hierarchies
You can also make authorizations for hierarchies in the same transaction.
       1.      Select a characteristic.
       2.      You can use the context menu on the authorization object to determine up to which hierarchy level the authorization should apply.
You can currently select exactly 1 level for each hierarchy and user.
       3.      Choose Generate authorizations. The system creates the authorizations and assigns them to the user.
Result
The system has created individual authorization profiles.
thanks
karthik
reward me ipoints if the above is usefull to you

Serial number authorization check

Hello!
I want to create an authorization check for serial number creation tcode IQ01.
So when a user selects a material that he is not authorized to, he will not be able to enter into the screen of sn creation.
Can i customize iq01 in order it to open automatically the general tab of equipment view???
Thank you

You have to configure the serial number profile & assign it to Material master. In the configuration profile of serial number, you have to check the check box for serial number required for processing & set the Goods movement transaction where you want to automatically create the serial number or create the serial number for the material using Tcode IQ01.
During Serial Number profile in Serializing Procedure you have to maintained the following settings:
MMSL - Maintain goods receipt and issue doc. 03 02
SDLS - Maintain delivery 03 02
SDRE - Maintain returns delivery 03 02
In Serialization profile, there is an checkbox for (Existing required) uncheck that check box & then test your transaction. You will get an button "Create new in serial number" in selection screen during goods receipts...Create new serial number for material there & then make goods receipt.

Authorization check during logon

Similar Messages

Maybe you are looking for