Authorization checks for filter values

Hi,
I'd need to apply authorization checks to filter values in web reporting. The authorizations should be limited with an attribute of the characteristic, not the characteristic itself.
A practical example:
There are two companies A and B. The companies are not allowed to see any data from each other.
There is a report that displays sales orders. It is used by both companies. The selection of sales orders is limited with the characteristic 'distribution channel', so the initial display is fine.
customer sales order
cust1          so1
cust1          so2
cust2          so3
cust2          so4
Users should be able to filter the sales orders by customer. As filter values, the users should only be able to see and select customers from their own company.
Access to customers should be limited with an attribute of the customer, e.g. company code, because it would be impossible to maintain authorization profiles that contain lists of customers.
However, it seems that BEx and web reports don't care about the authorization restrictions applied to the company code. When a user from company A clicks on the characteristic 'customer' and selects filter values (e.g. with F4), he can choose from all customers.
So, how could we apply authorization checks to filter values?
Message was edited by: Arto Pihlaja

Hi Dirk,
and thanks for your tip!
Unfortunately I haven't yet been able to test it out. Meanwhile, I'll just review the theory and check that I've understood your idea.
Continuing with the customer & sales order example, the report could look something like this:
customer comp. sal.ord.
cust1......A......so1
cust1......A......so2
cust1......A......so3
cust2......A......so4
cust2......A......so5
cust3......A......so6
when a user from company A runs it.
What happens if there is a filter for the characteristic Customer, and the user changes the filter values? What values are displayed as possible filter values? Do you mean that BW limits the values of 'customer' based on authorizations to the attribute 'company'?
Message was edited by: Arto Pihlaja

Similar Messages

Authorization Check for Special Stock Indicator in IE02

Dear Gurus,
Would like to check with you if there is an authorization check for change in Special Stock Indicator in IE02-SerData Tab?
For example, the User will only be allowed to change the Special Stock Indicator only to "E" - Sales Order.
Would appreciate your help.
Thanks.

Hi,
This cannot be done by using standard auth object. Standard SAP doesnt support control via this field.
Take help of your ABAP team and create an customized authorization object "Z_OBJECT" with field SOBKZ and which check these field value in table EQBS. Assign this auth object to role and profile you want.
Use the user exit IEQM0003 Additional checks before equipment update. Give a logic to check auth object when while using equipment change tcode.

Multiple active implementations for filter value EXEC_METHODCALL_PPF

Hi,
I have created an implementation for the EXEC_METHODCALL_PPF badi which is triggered from an action in a transaction.It is working fine in the development system but while transporting it to the quality system I am getting the following error.
Multiple active implementations for filter value EXEC_METHODCALL_PPF definition
Errors occurred during post-handling AFTER_IMP_SXCI for SXCI L
AFTER_IMP_SXCI belongs to package SECE
The errors affect the following components:
BC-DWB-CEX (Customer Enhancements)
When i refer to the documentation of the error message it says....
Multiple active implementations for filter value EXEC_METHODCALL_PPF definition
Message no. ENHANCEMENT474
Diagnosis
There are multiple active implementations of the same business add-in definition, even though this is not allowed.
System Response
This is not correct and should not occur.
Procedure
Deactivate the implementations active for this BAdI definition one by one until there is only one active implementation left.
You should use transaction SE18 (Utilities -> Adjustment -> Multiple-use interfaces) to solve these conflicts systematically.
But I am apprehensive if deactivating all the standard implemenatations of the badi will create any problem.Please can any one suggest as to how to resolve this issue....
Any help would be highly appreciated.

Hello,
Please check the following suggestions
a) go to se18 -> enter your definition name and see if "Multiple" call check box is ticked in Quality
b)compare your transports since some objects in development may not have found it's way to the quality server
c)Please see if for the same definition,for different filter values...implementations are done...if so,is multiple checkbox marked? in quality also?if you have multiple implementations with the check box not marked..the message conveys u cannot have multiple implementations of the same badi....
d)also check if the filter being passed to the BADI is ok
Hope it was useful in some way
Reward if helpful
Regards
Byju

How add Authorization check for user with assigened role for t.code-MIR4

Hi All,
Regarding authorization how to check authorizations check for user whith assigned roles for the t.code MIR4 using ABAP.
In Detail:2) All users are allowed to go to MIR4(invoice number), But ONLY for users with role: MM_RELEASE_INVOICE can proceed to do the posting.
suggest me...
Thanks,
srii..

Hi Sri ,
first u need to find out in which user rules u are using this object , after that if u want to restrict users then remove create/change values from that object values .
make use of Tcode SUIM to find out all roles which are using this Object.
or
ask ur basis guy to remove authorizations to create/change....
regards
Prabhu

Set Up Authorization Check for G/L Accounts into PO creation

Dear friends !
How could I activate check to the access to certain accounts into PO creation ?
I know that is possible to activate this into Purchasing customizing under path
SPRO > Materials management > Purchasing > Purchase order > Set Up Authorization Check for G/L Accounts
But could I use it to give access only to certain GL Accounts by user ? Is this the purpose of this customizing ?
If yes what´s the object should I use to link with user account !?
best regards,
Ale

Hi ,
After you setup the configuration in transaction OMRP, please setup up
the authorisation group in the account code (FS02, the field is on the
"Control", technical name is BEGRU).
When a account assigned purchase order is created, the system checks for
object F_BKPF_BES with values from the BEGRU and activity 01.

Authorization check For T code

Hi everyone,
Can anybody guide to set a authorization check for a particular Tcode.
I have ztable where users are assigned particular numbers.
I want the users who are assigned some numbers should be able to use this particular t code
Thanks in advance

hi
chk this out
AUTHORITY-CHECK
Basic form
AUTHORITY-CHECK OBJECT object
    ID name1 FIELD f1
    ID name2 FIELD f2
    ID name10 FIELD f10.
Effect
Explanation of IDs:
object
Field which contains the name of the object for which the authorization is to be checked.
name1 ...
Fields which contain the names of the
name10
authorization fields defined in the object.
f1 ...
Fields which contain the values for which the
f10
authorization is to be checked.
AUTHORITY-CHECK checks for one object whether the user has an authorization that contains all values of f (see SAP authorization concept).
You must specify all authorizations for an object and a also a value for each ID (or DUMMY).
The system checks the values for the IDs by AND-ing them together, i.e. all values must be part of an authorization assigned to the user.
If a user has several authorizations for an object, the values are OR-ed together. This means that if the CHECK finds all the specified values in one authorization, the user can proceed. Only if none of the authorizations for a user contains all the required values is the user rejected.
If the return code value in SY-SUBRC is 0, the user has the required authorization and may continue.
The return code value changes according to the different error scenarios. The return code values have the following meaning:
4
User has no authorization in the SAP System for such an action. If necessary, change the user master record.
8
Too many parameters (fields, values). Maximum allowed is 10.
12
Specified object not maintained in the user master record.
16
No profile entered in the user master record.
24
The field names of the check call do not match those of an authorization. Either the authorization or the call is incorrect.
28
Incorrect structure for user master record.
32
Incorrect structure for user master record.
36
Incorrect structure for user master record.
If the return code value is 8 or 24, inform the person responsible for the program. If the return code value is 4, 12, 16 or 24, consult your system administrator if you think you should have the relevant authorization. In the case of errors 28 to 36, contact SAP because authorizations have probably been destroyed.
Individual authorizations are assigned to users in their respective user profiles, i.e. they are grouped together in profiles which are stored in the user master record.
Note
Instead of ID name FIELD f, you can also write ID name DUMMY. This means that no check is performed for the field concerned.
The check can only be performed on CHAR fields. All other field types result in 'unauthorized'.
Example
Check whether the user is authorized for a particular plant. In this case, the following authorization object applies:
Table OBJ: Definition of authorization object
M_EINF_WRK
   ACTVT
   WERKS
Here, M_EINF_WRK is the object name, whilst ACTVT and WERKS are authorization fields. For example, a user with the authorizations
M_EINF_WRK_BERECH1
   ACTVT 01-03
   WERKS 0001-0003 .
can display and change plants within the Purchasing and Materials Management areas.
Such a user would thus pass the checks
AUTHORITY-CHECK OBJECT 'M_EINF_WRK'
    ID 'WERKS' FIELD '0002'
    ID 'ACTVT' FIELD '02'.
AUTHORITY-CHECK OBJECT 'M_EINF_WRK'
    ID 'WERKS' DUMMY
    ID 'ACTVT' FIELD '01':
but would fail the check
AUTHORITY-CHECK OBJECT 'M_EINF_WRK'
    ID 'WERKS' FIELD '0005'
    ID 'ACTVT' FIELD '04'.
To suppress unnecessary authorization checks or to carry out checks before the user has entered all the values, use DUMMY - as in this example. You can confirm the authorization later with another AUTHORITY-CHECK

How can I remove this extra authorization check for dynamic parameters

Hello expert,
I created a new dynamic hirarchical parameters as " client-->policy" in crystal report. these parameter value are coming from a physical table. the other part of report extract data by a oracle procedure. when I ran this report in client, it is ok for everything. but when I schedule it or run it in infoview, I need extra authorization for access these dynamic parameter, eventhough this is not for accessing other parameters. How can I remove this extra authorization check for dynamic parameters?

Hi
Open the crystal designer  Edit the parameter In the prompt window at the existing option you can find the LOV name.
Open the Business view manager and find that prompt name in u201CRepository Exploreru201D window and select that parameter  right click that parameter  Select edit rights  provide rights for your user name in that window.
--Naga

How does APEX check for null values in Text Fields on the forms?

Hello all,
How does APEX check for null values in Text Fields on the forms? This might sound trivial but I have a problem with a PL/SQL Validation that I have written.
I have one select list (P108_CLUSTER_ID) and one Text field (P108_PRIVATE_IP). I made P108_CLUSTER_ID to return null value when nothing is selected and assumed P108_PRIVATE_IP to return null value too when nothign is entered in the text field.
All that I need is to validate if P108_PRIVATE_IP is entered when a P108_CLUSTER_ID is selected. i.e it is mandatory to enter Private IP when a cluster is seelcted and following is my Pl/SQL code
Declare
v_valid boolean;
Begin
IF :P108_CLUSTER_ID is NULL and :P108_PRIVATE_IP is NULL THEN
v_valid := TRUE;
ELSIF :P108_CLUSTER_ID is NOT NULL and :P108_PRIVATE_IP is NOT NULL THEN
v_valid := TRUE;
ELSIF :P108_CLUSTER_ID is NOT NULL and :P108_PRIVATE_IP is NULL THEN
v_valid := FALSE;
ELSIF :P108_CLUSTER_ID is NULL and :P108_PRIVATE_IP is NOT NULL THEN
v_valid := FALSE;
END IF;
return v_valid;
END;
My problem is it is returning FALSE for all the cases.It works fine in SQL Command though..When I tried to Debug and use Firebug, I found that Text fields are not stored a null by default but as empty strings "" . Now I tried modifying my PL/SQL to check Private_IP against an empty string. But doesn't help. Can someone please tell me how I need to proceed.
Thanks

See SQL report for LIKE SEARCH I have just explained how Select list return value works..
Cheers,
Hari

How to check for null values in bpel?? Please Help! very urgent!!!

Hello Guys,
I have a problem. I have an external webservice to which I have to post my request. My task is to create an Webservice and Service Assembly to which others would post request and get response. I have to create SA to deploy onto the bus.
The problem is that there are optional elements in the request and response xsd's. In the Response sometimes certain feilds may come or they may not. for Example:- my response could contain a tag like this <firstName></firstName>
I have to copy these feilds in my bpel process from one variable to another.(like in the mapper).
My Question is , Is there any way in BPEL process or BPEL mapper where I could Check for null values in the request or response???
Your inputs would be very helpful.
Thanks
Rajesh

Thanks for replying man :)
Ok I will be more clear.
Here is a snippet of one of the xsd's that I am using.
<xs:element name="returnUrl" nillable="false" minOccurs="0">
                    <xs:annotation>
                         <xs:documentation>Partner specifies the return URL to which responses need to be sent to, in case of
Async message model.
</xs:documentation>
                    </xs:annotation>
                    <xs:simpleType>
                         <xs:restriction base="xs:anyURI">
                              <xs:maxLength value="300"/>
                              <xs:whiteSpace value="collapse"/>
                         </xs:restriction>
                    </xs:simpleType>
               </xs:element>
This means that the return URL field can be there or it may not be there. But if it is there it cant be null because nillable=false. But the whole <returnURL> </returnURL> can be there or it may not be there because minOccurs=0.
My requirement is , if returnURL is there in the response with a value, then in my BPEL mapper I should map it else I should not map it.
Thats the issue.
and Yes kiran, the node be non-existant.
So can you please help me with this.
Thanks
Rajesh

Checking for null value in arraylist

Hi
i have an excel file which i i am reading into an arraylist row by row but not necesarrily that all columns in the row mite be filled. So how do i check for null values in the array list.
try
                    int cellCount = 0;
                    int emptyRow = 0;
                    HSSFWorkbook workbook = new HSSFWorkbook(new FileInputStream(file));
                    HSSFSheet sheet = workbook.getSheetAt(0);
                    Iterator rows = sheet.rowIterator();
                    myRow = new ArrayList();
                    int r = 1;
                         while (rows.hasNext())
                              System.out.println("Row # " + r);
                              HSSFRow row = (HSSFRow) rows.next();
                              Iterator cells = row.cellIterator();
                              cellCount = 0;
                              boolean isValid = false;
                              while (cells.hasNext())
                                   HSSFCell cell = (HSSFCell) cells.next();
                                   switch (cell.getCellType())
                                        case HSSFCell.CELL_TYPE_NUMERIC:
                                             double num = cell.getNumericCellValue();
                                             DecimalFormat pattern = new DecimalFormat("###,###,###,###");
                                             NumberFormat testNumberFormat = NumberFormat.getNumberInstance();
                                             String mob = testNumberFormat.format(num);
                                             Number n = null;
                                             try
                                                  n = pattern.parse(mob);
                                             catch ( ParseException e )
                                                  e.printStackTrace();
                                             System.out.println(n);
                                             myRow.add(n);
                                             //myRow.add(String.valueOf(cell.getNumericCellValue()).trim());
                                             //System.out.println("numeric: " +cell.getNumericCellValue());
                                             break;
                                        case HSSFCell.CELL_TYPE_STRING:
                                             myRow.add(cell.getStringCellValue().trim());
                                             System.out.println("string: " + cell.getStringCellValue().trim());
                                             break;
                                        case HSSFCell.CELL_TYPE_BLANK:
                                             myRow.add(" ");
                                             System.out.println("add empty:");
                                             break;
                                   } // end switch
                                   cellCount++;
                              } // end while
                              r++;
                         }// end while
               } myRow is the arrayList i am adding the cells of the excel file to. I have checked for blank spaces in my coding so please help with how to check for the black spaces that has been added to my arraylist.
I have tried checking by looping through the ArrayList and then checking for null values like this
if(myRow.get(i)!=null)
// do something
// i have tried this also
if(myRow.get(i)!="")
//do something
}Edited by: nb123 on Feb 3, 2008 11:23 PM

From your post I see you are using a 3rd party package to access the Excel SpreadSheets, you will have to look in your API for you 3rd party package and see if there is a method that will identify a blank row, if there is and it does not work, then you have to take that problem up with them. I know this is a pain, but it is the price we pay for 3rd party object use.
In the mean time, you can make a workaround by checking every column in your row and seeing if it is null, or perhaps even better: check and see if the trimmed value of each cell has a lenth of 0.

Authorization checks for PNP LDB

question : how to validate authorization checks for pnp logical database?
2 nd question: hr report
this report is basically for salary survey. in this i had so many fields can any body let me know how
can i form the internal tables. and i have to display overall 150 fields in csv file for that
how can i take in to the final internal table.
what is the logic behind this:
T71JPR09-JOBCODE
PA0000-PERNR
HRP1000-STEXT
P0006-PSTLZ
PA0008-ANSAL * 100 / PA0008-BSGRD
PA0015-BETRG
PA0761-LTEXT WHERE PA0761-CPLAN = LTI PLAN PSU YEAR 1
PA0761-GRADT WHERE PA0761-CPLAN = LTI PLAN PSU YEAR 1
PA0761-ZZGRANT WHERE PA0761-CPLAN = LTI PLAN PSU YEAR 1
PA0761-LTEXT WHERE PA0761-CPLAN = LTI PLAN esu YEAR 1
like that i had.
please give me the steps how can i proceed.

Hi,
The PNP database will take care of authorization check. It will not execute if used does not have authorizations.
Hope this helps.

Create authorization check for a report

Hi,
I need to create an authorization check for a report. It means that I need to restrict the usage of the report to couple of users ( 'USER1' and 'USER2' ). How can I do that? I did read through a lot of threads regarding this piece got a bit confused and stuck while creating the authorization object.
Say the report name is ZHR_TIMEABC.
Can anyone explain how to create an authorization object and how are they tied to the object and call them in the abap code?
Thanks in advance,
VG

Hi,
Thanks. Here is my understanding, S_C_FUNCT calls a system generated function module to make an authority check. So, if different users say USER1 and USER2 have different authroization levels, defined in their user profile, just adding this piece code will take care of authroization check for the program OR do I need to take care of something else?
If so, when do we need to create the authorization objects using SU20 and assign the group and follo this process? When do we use this approach ( lot of threads on authority check have mentioned this procedure)?
Your inputs will be helpful to understand this concept.
Thanks,
VG

Authorization check for a program/table

Hi ,
Can anyone help me out in
How to do authorization check for an abap program and also a table.
I have no idea about the authorizations.
My requirement is that I need to do the authorization check in such a manner that only users having a certain profile
1. should be able to execute the program
2. View of the entries of the table.
Thanks & Regards,
Keerthi

Hello Keerhi ,
I got you wrong at first!
If you want to have only certain users to be able to do certain operations, then you need to assign the appropriate roles to those users!
First find the role
second add the user in the role ( PFCG T code---> USers tab)
Raj

Authorization checks for bank account number in vendor master

I am trying to find a way to set up authorization checks for specific fields in the vendor master: LFBK-BANKL, LFBK-BANKN, LFBK-EBPP_ACCNAME and LFBK-EBPP_ACCNAME. I am tring to set ip up so that if you have access to transactions FK03 or XK03, you can view vendor master data except for the above fields.
Does anyone know of a way to accomplish this? Your help will be greatly appreciated.
Thanks
-Peru

HI Peru,
To supress a field in FK03 u will have to check
Financial Accounting (New)>Accounts Receivable and Accounts Payable>Vendor Accounts>Master Data>Preparations for Creating Vendor Master Data-->Define Screen Layout per Activity (Vendors)
in that Display Vendor (Accounting) for FK03 and Display vendor (centrally) for Xk03
But there bank account no is not there.
Moreover there r no authorization objects for all the fields that u gave.
So try creating screen variant/ transaction variant in SHD0.
Regards,
Kiran

How to turn off the authorization checks for a object in infoproviders?

Hi - how can I turn off the authorization check for an object (ex: 0orgunit) in infoproviders?
I have 0orgunit as an authorization-relevant object and is used in one of the cubes. When reports are run for this cube, this is causing authorization issues. The object is present in other cubes also but I have to remove or turn off the authorization check of this cube alone. How to do this? Please help.
Thanks,
Raj.

Hi Raj,
Srinivas, is right , however in BI7 the correct transaction is RSECADMIN and not RSADMIN.
In BW3.5, use RSSM transaction to do thins.
OR
Go to transaction RSECAUTH ---> Choose the authorization object that has been created for org unit(and has been assigned to the user). Go to change mode. Remove the cube from the dimension 0TCAIPROV
If you are using old authorization concept in 3.5 or in 7.0
Go to RSSM. In the checks for infoprovider, enter your infoprovider name. Choose change.Here you will see a checkbox to switch off the authorization.
Hope this helps you,
Best regards,
Sunmit.

Authorization checks for filter values

Similar Messages

Maybe you are looking for