Authorization check for cost centre

Hi ,
Im creating a zprogram ,in which i give bukrs,kostl,kokrs,lednr,...etc in the select options..Can somebody tell , how to create restricted access for individuals who are able to view other cost centres that they are not normally responsible for..
Thanks...

Hi,
You can handle this by AUTHORITY CHECK functionality. Get all the cost centers from selection screen and do the Authority check. If user does not have authorization, you can display error message. To get Cost center Authorization objects, check transaction SU20 and SU21.
for more details see this thread -
Authority check
Hope this helps.
ashish

Similar Messages

  • Authorization Check for profit centres in SO level.....

    Dear Experts,
    Plant                 Profit Centre
    1                       400000010
    2                       400000020
    3                       400000030
    My client is having 1 sales org and 3 plants , 3 profit centres in different locations. While creating SO in Plant one user is able to create SO for Plant two , Materilas are common for all the plants and are extended. My requirement is when user is creating SO from Plant one , automatically , Plant1, profit centre 400000010must be greayed out mode . system must not allow the user to change the plant.
    Currently system is allowing me to take Customers from plant2 while i am creating a SO from plant 1.. system is also allowing me to change from Plant 1 to Plant 2.
    Kindly do the needful

    In the program MV45AFZZ use exit USEREXIT_FIELD_MODIFICATION to change the profit center to display mode so that no changes are possible and it always flows from material master irrespective of user ID.
    You can also use transaction variant SHD0 to make the profit center field as display.
    Regards,
    GSL.

  • Authorisations for cost centres

    Hi there,
    I have a question.
    My client wants to give access to users only for few cost centres.
    Can we use "authorisations" to fulfill the requirement?
    As far as my knowledge goes we can set up authorisation for amount. e.g. person A should be able to post transactions to GL up to INR 7500 , person B can post up to 10000.
    Can we do it for cost centres???? e.g. person A should not be able to post cost centre 1000 ot should be able to use cost centre 2000 only.
    please let me know if we can use autorisations if not then what can be done to fulfill the requirement.
    Thank you,
    V

    You can define Validation with a user exit and a Ztable
    What I am envisaging is you maintain a Z table with all the authorizations and the amount limits,
    Based on this table you can define a validation with a user exit that checks this table while doing this posting.
    Let me know if oyu need more details like tcodes etc
    BR Naveen

  • Expenditure / Overhead planning for Cost Centre

    Hi.
    Pl provide any document on planning of expenditure / overheads for cost centre for preparing my BBP with full information to the extent possible.
    Regards.
    Srini

    Hi
    Check the below for the documentation in
    http://help.sap.com/bestpractices/BBLibrary/html/J64_PP&DM_EN_IN.htm
    http://help.sap.com/bestpractices/BBLibrary/html/J08_COPA_EN_IN.htm
    VVR

  • GL Account is blocked for Cost Centre

    Hi All,
    I try to post amount to G/L account, But SAP throwing this error. GL Account 672800 is blocked for Cost Centre 3330.
    I tried to post to another account 678200 which has the same functionality as 672800 but i done get any error . 
    Any Advice pls.
    Cheers
    VM.

    Hi,
    What i feel U r using some validation for this pls check the same because we can't restrict any GL for posting to particular cost center.
    Regards,
    Meenakshi

  • Authorization check by Cost centers

    Hello all,
    I developed a report in Report Painter and the requirement is that the users be able to run it only for their own CCtrs - challenge is that we are trying to not use variants, custom transactions and also modifying / checking authorization at at SU01 level.
    Is there any other way to do this and if yes can you pls provide some details.
    Thanks,
    Richa

    hi richa,
    Authorizations with Variables
    Definition
    Instead of using a single value or interval, you can also use variables in authorizations. The Customer Exit is called up for these variables while the authorization check is running. The call is carried out with I_STEP = 0. The intervals of characteristic values or hierarchies for which the user is authorized can be returned here. By doing this, the maintenance load for authorizations and profiles can be reduced significantly.
    Every cost center manager should only be allowed to evaluate data for his/her cost center. Within the SAP authorization standard, a role or a profile with the authorization for the InfoObject 0COSTCENTER equal to ‘XXXX’ (XXXX stands for the particular cost center) would have to be made for every cost center manager X. This then has to be entered in the user master record for the cost center manager.
    Using variables reduces the authorization maintenance workload with the InfoObject 0COSTCENTER equal to ‘$VARCOST’, as well as with the role or the profile, which is maintained for all cost center managers. The value of the variable ‘VARCOST’ is then set for runtime during the authorization check by the CUSTOMER-EXIT ‘RSR00001’.
    Maintaining the authorizations restricts the entries for the values to the length of the existing InfoObject. It is possible, however, to use both limits of the interval. In the example 0COSTCENTER with 4 spaces, the variable ‘VARCOST’ is, therefore, entered as ‘$VAR’ – ‘COST’.
    There is a buffer for these variables. If this buffer is switched on, the customer exit is only called up once for a variable with the authorization check. In doing so, you avoid calling up the customer exit for variables over and over, as well as decreasing performance. If you want to call up the customer exit each time, you have to deactivate this buffer in the Setting Up Reporting Authorizations. To do this, go to the main menu and choose Extras  ® Compatibility  ® Buffer for Variables (Customer-Exit)  ® Deactivate..
    You can also call up the customer exit for authorizations for hierarchies. There are two ways to do this:
           1.      Enter the variable in the authorization for characteristic 0TCTAUTHH. The customer exit is then called up while the authorization check is running. In the LOW fields of the return table E_T_RANGE, the system anticipates the technical name for the hierarchy authorization that you specified in the authorization maintenance (transaction RSSM).
    As a result, all parameters are available for such an authorization. Nevertheless, you must also create a new definition for each node.                                    
           2.      Where many authorizations differ from an authorization for a hierarchy only in respect to the nodes and not to the other authorizations, we suggest the following solution: Different users can be authorized for a specific hierarchy area (subtree). The highest node is different for each user.                                          
    Do this by creating an authorization for a hierarchy in the transaction RSSM and enter this in the authorization or role. Instead of specifying a particular node, you specify the variable in the authorization maintenance (transaction RSSM). The customer exit is then called up for the node while the authorization check is running. The return table E_T_RANGE must be filled according to the customer exit documentation (nodes in the LOW field, InfoObject of the node in the HIGH field
    Setting Up Reporting Authorizations
    Use
    Before you are able to set up reporting authorizations, you have to create authorization objects.
    As soon as an authorization object is saved, it can be checked when a query is run. The user may not have the appropriate authorizations if he or she has not yet been assigned this authorization object.
    Only when the user has been assigned the appropriate authorizations can he/she define and execute a query or navigate in an existing query.
    If in the query a characteristic value or a node is excluded, a complete authorization check “*” is required.
    Procedure
    Creating an authorization object
           1.      In the SAP Easy Access initial screen of the SAP Business Information Warehouse, choose the path SAP Menu ® Business Explorer ® Authorizations ® Reporting Authorization Objects.
           2.      Choose Authorization Object ® Create. Give the authorization object a technical name and a regular name. Save your entries.
           3.      On the right-hand side of the screen, an overview of all the InfoObjects that are authorization-relevant is displayed.
    Only those characteristics that have been flagged as authorization-relevant previously in the InfoObject maintenance screen can be assigned as fields for an authorization object. See also: Creating InfoObjects: Characteristics
           4.      Assign the InfoObject fields to the authorization object:
    ¡        Select the characteristics for which you want an authorization check of the selection conditions to be carried out.
    ¡        Select the InfoObject key figure (1KYFNM) if you want to restrict the authorization to a single key figure.
    ¡        Select the InfoObject (0TCTAUTHH) if you want to check authorizations for a hierarchy.
    ¡        Include the authorization field activity (ACTVT) in the authorization object if you want to check authorizations for documents.
           5.      Save your entries.
           6.      Go back to the initial screen of the authorization maintenance.
           7.      Choose Check for InfoProviders ® Display to get a list of the InfoProviders that contain the InfoObjects that you selected and are therefore subject to an authorization check (where-used list). In the change mode you can exclude individual InfoProviders from the authorization check for this authorization object by removing the flag.
    Authorization object:           S_RSRSAREA
    Name:                   Sales area
    Fields:                         DIVISION, CUSTGROUP, 1KYFNM
    Creating authorizations
    Authorizations are created and maintained in the role maintenance screens.
           1.      Choose Authorizations ® Roles ® Change.
           2.      Specify the roles that you want to change and choose Change. This takes you to the role maintenance screen.
           3.      On the Authorizations tabstrip, choose the Expert mode for generating profiles option.
           4.      Choose the Enter Authorization Objects Manually option, and specify the objects that you require. Choose Enter. The authorization object is added to the role.
           5.      Choose Generate.
    For more information, see Changing and Assigning Roles.
    Result
    The user is now able to work with queries
    Authorizations to Work with a Query
    Use
    Authorizations to work with a query are first checked in the dialog box to open a query.
    Furthermore, when a query is opened, the authorizations for the individual objects are checked.
    See also: Authorization Check When Executing a Query..
    Structure
    Check in the Open Dialog Box:
    When you open a query, you will see four buttons in the dialog box. The History, Favorites and Roles buttons only display your own queries and those queries intended for you per role definition.
    The InfoAreas button enables you to look at all queries for which the user has display authorization. If this display authorization is not restricted to queries, the user will see all available queries in the system here. It is possible to hide the InfoAreas button if you do not want the user to see all queries in the system. The authorization object S_RS_FOLD with the field SUP_FOLDER can be used here. In order to hide the InfoArea button, set this field to X when authorizing, otherwise leave the field blank “ “ or set it to * (asterisk – all authorizations).. The button will be displayed if the authorization check fails.
    Authorizations by User
    It is also possible to make queries from particular users (= OWNER = query creator) available to other users (= USER) for display or processing. The authorization object S_RS_COMP1 with four fields (COMPID, COMPTYPE, OWNER, ACTVT) is used here.
    You can grant this authorization to a particular team or use the variable $USER to give all users the authorization for queries that they created themselves. $USER is replaced by the corresponding user name during the authorization check.
    See also the Example for Reporting Authorizations.
    Authorizations for the BEx Broadcaster
    Using the authorization object S_RS_BCS, you can determine which user is allowed to register broadcasting settings for execution and in which way.
    Note:
    ·        The only authorization necessary for the online execution of broadcasting settings is the authorization for the execution of the underlying reporting objects (for example, the Web template).
    ·        Every user that has authorization to create background jobs also has authorization for direct scheduling in the background.
    ·        If you need to work under the name of another user to execute broadcast settings (for example with user-specific precalculations), the authorization object S_BTCH_NAM for background scheduling is also required for the other user. For more information, see Authorizations for Background Processing and Definition of Users for Background Processing
    Authorizations for Selection Criteria
    Definition
    The selection criteria of a query determine which data can be displayed after you have entered it in a workbook.
    An authorization check for certain InfoObjects only takes place if an authorization object with this InfoObject was already created in the authorization object class Business Information Warehouse.
    As soon as an authorization object is created, only authorized users can select query data.
    Use
    To decide whether a user should be authorized to work with a query, you should check whether authorization has been given to him/her for all selection criteria.
    Essential to the authorization of selection criteria is the authorization object S_RS_ICUBE.
    Definitions of authorizations for working with certain InfoCubes must be transported separately.
    See: Transporting Additional Information
    In general, it is not sufficient to give authorizations for individual InfoObjects (characteristics and key figures), or to check them separately from one another. It more usual that specific authorizations should be given for combinations of characteristics and key figures.
    It is therefore feasible that a "Sales Manager" is allowed to view the respective total sales figures for all sales areas, but is only authorized to break down "his/her" area (0001) according to the individual sales personnel. In this case, the following authorizations, which are grouped together, would be created and assigned.
    Sales area = *
    Sales personnel = :
    Key figure = Sales figures
    (‘:’ represents the authorization to view the values aggregated with the characteristic.
    Sales area = 0001
    Sales personnel = *
    Key figure = Sales figures
    The user frequently uses these "multidimensional" authorities in companies that are regional as well as product-oriented (matrix organization). In this way, you could arrange for the person responsible for the combination of a certain division and a certain sales area to have the exact authorization for the output of the relevant values, without him/her necessarily also having access to the data for the whole division or the whole sales area.
    Authorizations for the Query Definition
    Authorizations can be granted for the following objects for the query definition in the Business Explorer:
    The entire query
    Structures
    Calculated key figures
    Restricted key figures
    Variables
    The activities for the query definition are specified in the authorization object S_RS_COMP (Business Explorer - components). The authorization object has the following fields: InfoArea, InfoCube, component type, component name and activity.
    The following values are possible for the component type:
    REP: Entire query
    STR: Structure
    CKF: Calculated key figure
    RKF: Restricted key figure
    VAR: Variables
    By specifying an InfoArea or an InfoCube, you can further restrict the component types. By specifying a component name, you can specify the authorization for individual components in more detail. Components that begin with 0 are delivered by SAP and cannot be changed. Components that are within the customer name range must begin with a letter of the alphabet.
    Valid activities are:
    01 (create)
    02 (change)
    03 (display)
    06 (delete)
    At the moment, activities 16 (Execute) and 22 (Save for Reuse) are not checked for the query definition.
    User A is allowed to create, change or delete queries beginning with A1 and A6 within InfoArea 0001 in InfoCube 0002. In addition, the user is allowed to change the calculated key figures and structures (templates) already defined in this InfoProvider.
    Related authorizations for user A:
    InfoArea: ‘0001’
    InfoProvider: ‘0002’
    Component type: ‘REP’
    Component Name: ‘A1’, ‘A6’
    Activity: ‘01’, ‘02’, ‘06’
    InfoArea: ‘*’
    InfoProvider: ‘0002*’
    Component type: ‘STR’, ‘CKF’
    Component name: ‘*’
    Activity: ‘02’
    Authorizations for Display Attributes
    Definition
    Authorization-relevant display attributes are hidden in the query if the user does not have sufficient authorization to view them.
    Use
    For characteristics:
    The user needs to have complete authorization (*) to see the display attribute in the query.
    For the characteristic 0EMPLOYEE, the 0EMPLSTATUS attribute is authorization-relevant. Only users with authorization "*" for 0EMPLSTATUS can display the attribute in the query.
    For key figures:
    Key figures cannot be marked as authorization-relevant. To use this function nonetheless for key figure attributes, the system checks against meta object 1KYFNM. For this, the user requires authorization for the field 1KYFNM in the authorization object.
    The key figure attribute 0ANSALARY is contained in the 0EMPLOYEE characteristic.
    If the user has the 1KYFNM field in his or her authorization object, and authorization "*", he or she can display all key figure attributes.
    If the user has the 1KYFNM field in the authorization object and the 0ANSALARY key figure as a value of the authorization, he or she can only see this key figure attribute. If the user is not supposed to see this attribute, do not give the authorization "*" but only assign the key figures for authorization that are to be displayed.
    Authorizations for Navigation Attributes
    Use
    During authorization checks for navigation attributes, it is always the characteristic that is being used as a navigation attribute that is checked.
    Integration
    If referencing characteristics are used as navigation attributes, authorization for the basic characteristic is checked. You should, however, change this logic so that the referencing characteristic is checked for instead. In the maintenance screen for reporting authorizations, choose the following path from the main menu Extras  ® Compatibility  ® Navigation Attributes ® Switch Off.
    This function exists for reasons of compatibility. The authorization logic of referencing characteristics worked differently with the beginning of Release BW 2.0. From BW 2.0, Support Package 20 and in all of the releases that follow, for referencing characteristics as well, the authorization for exactly this characteristic (and not the basic characteristic, as was the case previously) is checked.
    Example
    In the query, you use characteristic A with the navigation attributes A__B and A__R. Characteristic R references characteristic B. For these navigation attributes, authorization for the basic characteristic B is checked. If you switch off the compatibility for navigation attributes option, B is checked for A__B, and R is check for A__R.
    Maintaining Authorizations for Hierarchies
    Use
    Authorizations for hierarchies determine up to which subarea of a hierarchy a user may drilldown.
    Prerequisites
    Before you can set authorizations for hierarchies, you must first transfer and activate the InfoObject 0TCTAUTHH from the Business Content. Make sure that the indicator Relevant for Authorization is set. You must also create an authorization object for which you want to set the authorization.
    Authorization for a hierarchy on the Profit Center characteristic (0PROFIT_CTR):
    Define an authorization object with 0PROFIT_CTR and 0TCTAUTHH.
    Example: You define a hierarchy for the basic characteristic B. For characteristic B there is a referencing characteristic R. If you use this hierarchy for characteristic R in the query, authorization for the basic characteristic B is checked. However, you can change this logic so that characteristic R is checked for instead. In the maintenance screen for reporting authorizations, choose the following path from the main menu Extras ® Compatibility ® Ref. Characteristics with Hierarchy ® Switch Off.
    You need the characteristic 0TCTAUTHH to specify the hierarchy in the authorization. If you add this characteristic to an authorization object, you can specify authorizations for hierarchies for all InfoObjects in the authorization object.
    Procedure
           1.      In the SAP Easy Access initial screen of the SAP Business Information Warehouse, choose SAP Menu ® Business Explorer ®Reporting Authorization Objects.
           2.      Choose Authorizations ® Authorization Definition for Hierarchies ® Change.
           3.      In the Definition, select the InfoObject, hierarchy and node.
    If there are several users who are authorized to work with just one part of a hierarchy (subtree) but the top node is different for each, you have the option of specifying a variable instead of a node.
    See also: Variable Types
    Instead of selecting a node, you can also set the Top of hierarchy indicator. This enables you to ensure that a user is authorized to use a hierarchy from the top node down to a determined level.
    You can select the top node here. However, if the hierarchy is being used in a query without a filter on this node, the user will not be able to execute the query.
    This is because the top-most visible node does not represent the actual top of the hierarchy. As, for example, there are other Remaining Leaves, there should always be exactly one internal node at the top of the hierarchy. Therefore, there is one internal node above the top-most visible node. If the hierarchy is used in a query without the top-most node being determined, it is compared with this unseen, internal node. So that the user has the correct authorizations, select the internal top of the hierarchy for this option.
           4.      Select the authorization type:
    ¡        0 for the node
    ¡        1 for a subtree below the node
    ¡        2 for a subtree below the node up to and including a level (absolute)
    You must define a level for this type. A typical example of an absolute level is data protection with regard to the degree of detail of the data (works council ruling: no reports at employee level only at more summarized levels).
    ¡        3 for the entire hierarchy
    ¡        4 for a subtree below the node up to and including a level (relative)
    You must specify a level that is defined relative to the node for this type. It makes sense to specify a relative distance if an employee may only expand the hierarchy to a certain depth below his or her initial node, but this node moves to another level when the hierarchy is restructured.
           5.      For types 2 and 4 you can specify, in Hierarchy Level, the level to which the user can expand the hierarchy.
    ¡        With authorization type 2 (up to and including a level, absolute) the level refers to the absolute number of the level in the hierarchy where the top-most node of the hierarchy is level 1.
    ¡        With authorization type 4 (up to and including a level, relative) the level number refers to the number of levels starting from the selected node itself which is level 1.
           6.      In the Validity Area you specify in exactly which ways a hierarchy authorization has to match a selected display hierarchy for it to be included in the authorization check.
    ¡        Type 0 (very high) : The name, version and key date of the hierarchy on which the hierarchy authorization is based have to agree with the selected display hierarchy.
    ¡        Type 1: The name and version of the hierarchy on which the hierarchy authorization is based have to agree with the selected display hierarchy.
    ¡        Type 2: The name of the hierarchy on which the hierarchy authorization is based has to agree with the display hierarchy.
    ¡        Type 3 (lowest) : None of the characteristics have to match.
    Note that in some circumstances, setting a check level that is too low may lead to more nodes being selected using hierarchy node variables that are filled from authorizations, than actually exist in the display hierarchy for the query. This can cause an error message.
    As a general rule, select the highest possible level for the check.
           7.      If you set the Node variable default value indicator, this definition of an authorization for a hierarchy is used as the default value for node variables.
    If more than several authorizations are assigned to a user for different subareas of the same hierarchy, one of these authorizations has to be defined as the default value. Only one node can be selected for a node variable on the variable screen of a query. So that this variable can be filled from the authorizations, the correct variable type has to be selected and an authorization has to be determined as the default value.
           8.      Specify a technical name for this definition. If you do not enter a value, a unique ID is set.
           9.      Now create an authorization for the new authorization object. To do this, enter the technical name of the definition as a characteristic value for the characteristic 0TCTAUTHH. Hierarchy authorizations and authorizations for characteristic values are added:
    ¡        Specify the value ‘ ‘ (a blank character) as a characteristic value if only hierarchy authorizations are to be in effect. If you specify more values these are authorized additionally.
    ¡        Specify the value “:” (a colon) when queries are also allowed without this characteristic.
    The value '’ (all characteristic values) is not supported for the characteristic 0TCTAUTHH. Nevertheless, if you specify the value ‚’ a ‚:’ is automatically generated instead because no other valid value is found.
    If you would like the user to be able to see all values and hierarchies for a characteristic, use the value '*' for this characteristic.
    If you use a drilldown hierarchy in the query, you restrict the highest node by a fixed node or a node variable.
    Definitions of authorizations for hierarchies must be transported separately. See: Transporting Additional Information
    Alternative Procedure:
    Manually Maintaining Reporting Authorizations
    Use
    You usually maintain authorizations in the role maintenance. However, in exceptional cases it could be more practical to create authorizations manually. This is the case if you have to assign every user his/her own role.
    Prerequisites
    Reporting authorization objects have been created.
    Procedure
    Assign Authorization Objects
           1.      In the SAP Easy Access initial screen of the SAP Business Information Warehouse, choose SAP Menu ® Business Explorer ® Authorizations ® Reporting Authorization Objects.
           2.      Choose Authorizations ® Authorizations for Several Users. Enter an interval and choose Change.
           3.      Select a characteristic from the left side of the screen. You can then display master data as a list or as a hierarchy. The right side of the screen shows you a list of all the selected users with the authorization profiles and roles you assigned.
           4.      You can now use Drag&Drop to assign additional authorization objects to the user.
           5.      Choose Generate authorizations. The system creates the authorizations and assigns them to the users.
    Assigning Authorizations for Hierarchies
    You can also make authorizations for hierarchies in the same transaction.
           1.      Select a characteristic.
           2.      You can use the context menu on the authorization object to determine up to which hierarchy level the authorization should apply.
    You can currently select exactly 1 level for each hierarchy and user.
           3.      Choose Generate authorizations. The system creates the authorizations and assigns them to the user.
    Result
    The system has created individual authorization profiles.
    thanks
    karthik
    reward me ipoints if the above is usefull to you

  • Authorization check for production order settlement

    Hi All,
    Production order settlement currently can be done by any user of any company code. there is a high risk involved in the same since unauthorized postings may happen. Hence we need to add authorization check for production order settlement. Can we maintain the same at the plant or the company code level?
    Waiting for your replies. Thanks in advance!
    Regards,
    Aman Goel

    hi
    What venki has told abt the exit, its absolutely correct.Even i have used the same exit
    •     From table CAUFV pick Material(PLNBEZ),Basic Start Date(GLTRP),Plant(WERKS) .
    •     Pass parameter Material(PLNBEZ) and Plant(Werks) in table MBEW in respective fields i.e. Material(MATNR) and Plant(WERKS).
    •     Pick the latest record for the current period(LFMON) and year(LFGJA).
    •     Pick Product Cost Estimate number(KALN1) from the record and pass it to table KEKO.
    •     Check if Production Order Basic Start Date(GLTRP)<= BIDAT, if NO post Error Message.
    This is the FS for EXit PPco0007
    Reward if useful
    Amit

  • Authorization checks for PNP LDB

    question    : how to validate authorization checks for pnp logical database?
    2 nd question: hr report
    this report is basically for salary survey. in this i had so many fields can any body let me know how
    can i form the internal tables. and i have to display overall 150 fields in csv file for that
    how can i take in to the final internal table.
    what is the logic behind this:
    T71JPR09-JOBCODE
    PA0000-PERNR
    HRP1000-STEXT
    P0006-PSTLZ
    PA0008-ANSAL * 100 / PA0008-BSGRD
    PA0015-BETRG
    PA0761-LTEXT  WHERE PA0761-CPLAN = LTI PLAN PSU YEAR 1
    PA0761-GRADT  WHERE PA0761-CPLAN = LTI PLAN PSU YEAR 1
    PA0761-ZZGRANT WHERE PA0761-CPLAN = LTI PLAN PSU YEAR 1
    PA0761-LTEXT WHERE PA0761-CPLAN = LTI PLAN esu YEAR 1
    like that i had.
    please give me the steps how can i proceed.

    Hi,
    The PNP database will take care of authorization check. It will not execute if used does not have authorizations.
    Hope this helps.

  • Create authorization check for a report

    Hi,
    I need to create an authorization check for a report. It means that I need to restrict the usage of the report to couple of users ( 'USER1' and 'USER2' ). How can I do that? I did read through a lot of threads regarding this piece got a bit confused and stuck while creating the authorization object.
    Say the report name is ZHR_TIMEABC.
    Can anyone explain how to create an authorization object and how are they tied to the object and call them in the abap code?
    Thanks in advance,
    VG

    Hi,
    Thanks. Here is my understanding, S_C_FUNCT calls a system generated function module to make an authority check. So, if different users say USER1 and USER2 have different authroization levels, defined in their user profile, just adding this piece code will take care of authroization check for the program OR do I need to take care of something else?
    If so, when do we need to create the authorization objects using SU20 and assign the group and follo this process? When do we use this approach ( lot of threads on authority check have mentioned this procedure)?
    Your inputs will be helpful to understand this concept.
    Thanks,
    VG

  • Authorization Check for Special Stock Indicator in IE02

    Dear Gurus,
    Would like to check with you if there is an authorization check for change in Special Stock Indicator in IE02-SerData Tab?
    For example, the User will only be allowed to change the Special Stock Indicator only to "E" - Sales Order.
    Would appreciate your help.
    Thanks.

    Hi,
    This cannot be done by using standard auth object. Standard SAP doesnt support control via this field.
    Take help of your ABAP team and create an customized authorization object "Z_OBJECT" with field SOBKZ and which check these field value in table EQBS. Assign this auth object to role and profile you want.
    Use the user exit IEQM0003 Additional checks before equipment update. Give a logic to check auth object when while using equipment change tcode.

  • G/L accounts for cost centre

    Hi
    How to know the G/L accounts for cost centre.
    Regards,
    rajan

    Hi Rajan,
    If i have understood correctly then you are asking for those GL accounts which are assigned to cost centers. Then you are talking about Automatic Account Assignment of cost centers to GLaccounts ( to be more specific Gl accounts created as cost elements).
    Please go to OKB9 where you assign cost center s to GL accounts. This would help the system to identify the cost ccenter to used when you make entries.
    Let me know if you have answered my question.
    Regds,
    Mallikarjuna G

  • PO FOR COST CENTRE

    if we create Purchase for Cost centre that is as acc assignt as K , If we made the GRN, Is the stock comes under our storage location or else It is  automatically consumed under the Cost centre . Please let me know clearly the overall aspect of the same.
    The best answer will be reawarded accordingly.

    hi ganesh,
    whenever u give a storage location in a PO,
    stock quantity is in that storage location,
    and the value of that quantity is in cost centre accounts,
    when you see the stock overview with MMBE the stock is at the storage location,
    cost centre is not a physical location,
    only values are maintained at itemcategories,
    regards
    lakshmi reddy

  • Authorization check for a program/table

    Hi ,
    Can anyone help me out in
       How to do authorization check for an abap program and also a table.
       I have no idea about the authorizations.
    My requirement is that I need to do the authorization check in such a manner that only users having a certain profile
    1. should be able to execute the program
    2. View of the entries of the table.
    Thanks & Regards,
    Keerthi

    Hello Keerhi ,
    I got you wrong at first!
    If you want to have only certain users to be able to do certain operations, then you need to assign the appropriate roles to those users!
    First find the role
    second add the user in the role ( PFCG T code---> USers tab)
    Raj

  • Authorization checks for bank account number in vendor master

    I am trying to find a way to set up authorization checks for specific fields in the vendor master: LFBK-BANKL, LFBK-BANKN, LFBK-EBPP_ACCNAME and LFBK-EBPP_ACCNAME. I am tring to set ip up so that if you have access to transactions FK03 or XK03, you can view vendor master data except for the above fields.
    Does anyone know of a way to accomplish this? Your help will be greatly appreciated.
    Thanks
    -Peru

    HI Peru,
    To supress a field in FK03 u will have to check
    Financial Accounting (New)>Accounts Receivable and Accounts Payable>Vendor Accounts>Master Data>Preparations for Creating Vendor Master Data-->Define Screen Layout per Activity (Vendors)
    in that Display Vendor (Accounting) for FK03 and Display vendor (centrally) for Xk03
    But there bank account no is not there.
    Moreover there r no authorization objects for all the fields that u gave.
    So try creating screen variant/ transaction variant in SHD0.
    Regards,
    Kiran

  • How to turn off the authorization checks for a object in infoproviders?

    Hi - how can I turn off the authorization check for an object (ex: 0orgunit) in infoproviders?
    I have 0orgunit as an authorization-relevant object and is used in one of the cubes. When reports are run for this cube, this is causing authorization issues. The object is present in other cubes also but I have to remove or turn off the authorization check of this cube alone. How to do this? Please help.
    Thanks,
    Raj.

    Hi Raj,
    Srinivas, is right , however in BI7 the correct transaction is RSECADMIN and not RSADMIN.
    In BW3.5, use RSSM transaction to do thins.
    OR
    Go to transaction RSECAUTH ---> Choose  the authorization object that has been created for org unit(and has been assigned to the user). Go to change mode. Remove the cube from the dimension 0TCAIPROV
    If you are using old authorization concept in 3.5 or in 7.0
    Go to RSSM. In the checks for infoprovider, enter your infoprovider name. Choose change.Here you will see a checkbox to switch off the authorization.
    Hope this helps you,
    Best regards,
    Sunmit.

Maybe you are looking for