Authorization Error while executing Workbooks,

Question

Dear ALL
We have authorization in place where users are restricted to execute Workbooks PLANT wise.
For this 0PLANT is kept authorization relevant.
0PLANT__0COMP_CODE  is Navigational Attribute of 0PLANT also marked as authorization relevant.
Till now all user were assigned the Analysis authorization A_PLNT_XX as  0PLANT = XX
But suddenly now the users are getting authorization error of NOT BEING AUTHORIZED .,
The error log is as shown below.
Relevant Characteristics for Detailed Authorization Check  
(Characteristics with Full Authorization Are Not Listed!)
  List of Effective Authorization-Relevant Characteristics for InfoProvider ZMMIMMP05:  
0PLANT 
0PLANT__0COMP_CODE 
0TCAACTVT 
Subselection (Technical SUBNR) 1  
Supplementation of Selection for Aggregated Characteristics
  Check Added for Aggregation Authorization:     0PLANT__0COMP_CODE  
  Authorizations missing for aggregation (":")  
Characteristic  1 
0PLANT__0COMP_CODE    Empty   
Entries marked with red do not have aggregation authorization
You can find more information about this here 1140831
  The authorization check stops here as this selection is no longer needed  
  Message EYE007: You do not have sufficient authorization  
  No Sufficient Authorization for This Subselection (SUBNR)  
Following CHANMIDs Are Affected:
51 ( 0PLANT )
  Authorization Check Complete  
Please let me know the reason for the same.
Also How can  i track these  changes to avoid such errors
Regards,
Ajit

Answer 1

Hi Ajit,
The authorization log has been improved constantly and try to make it easy to understand.
It says:
Authorizations missing for aggregation (":")
Characteristic 1
0PLANT__0COMP_CODE Empty
Entries marked with red do not have aggregation authorization
You can find more information about this here 1140831
So please click the "1140831" which is a hyperlink bringing you to OSS note 1140831.
The note says:
1140831  Colon authorization during query execution
Part 1:  Description of the authorization check
You require aggregation authorization ("colon authorization") to view
the values of an authorization-relevant characteristic in aggregated
form. What does this mean exactly?
Example:
The calendar year (0CALYEAR) characteristic is authorization-relevant
and is contained in the InfoProvider that is in use. You defined a query
as follows:
1.  0CALYEAR is in the free characteristics (not in the drilldown)
    without any selections
- or -
2.  0CALYEAR does not exist in the query at all.
In both cases, no 0CALYEAR values are displayed in the query. Also, the
query is not restricted to any 0CALYEAR values. A colon is required for
the authorization check in this situation.
The note contains some more detailed explanation. You could read through it to understand the concept.
Regards,
Patricia