Authorization for VAP2 in conflict with VD02 for F_KNA1_GRP

Hi experts,
Our sales people need create, change and display access for contact persons (VAP1-2-3) of all customer account groups (F_KNA1_GRP). Meanwhile they also need to be able to create, change and display prospects (account group 0005). For changing prospects, you need access to S_TCODE VD02, but the users should not have access to other customer account groups (eg sold-to or ship-to parties) while using VD02. Can this be done?
Regards,
Suzy

> Put these two roles in the a Composite role which you can assign to the user.
You dont need composite roles to achieve that. Combining two "tasks" in single roles into a composite "job" is suboptimal because the "singles" (I prefer the term "real" roles...) will bring in all other access as well...
You end up shooting yourself in the foot because it is not scalable...
If there is a navigation option to the second task, your next best option is to maintain SE97 for the tcode "couples".
Trick is to find the most suitable tcode (if not the original one) which will allow you to do this.
Some tcodes will allow you to access them, but not use them.
But I think the answer to this is using account groups and a carefull choice of transactions which the user can enter with. If the transaction does not check granular authority (such as some "Enjoy" transactions are designed to do) then this requirement cannot be fullfulled by it.
Sometimes you need to forefeight usability... (might also include using older transactions or creating your own for the standard scenario without the tcode context using BAPI's).
See transaction BAPI.
Cheers,
Julius
Edited by: Julius Bussche on May 9, 2009 10:48 PM

Similar Messages

Problem with Authorization for Planning folder

Hi an having a problem with providing authorization for a planning folder
i am getting the following error when i test it with test user
Error while calling up RFC
Message no. UPC202
Diagnosis
You have selected a function, to execute this the system must set up an RFC connection to another SAP System. However, setting up this connection was not successful. The following internal error message was generated:
"You do not have authorization for InfoCube ZT_MR_T "
Procedure
Inform the system administrator.
we are not pulling the data from any other server, all the data is on the sif any one has faced the same issue let me know.
Regards,
Abraham

Calling Thru Trans code: BPS0 in ECC 6
getting this error:
Error while calling up RFC
Message No. UPC202
Diagnosis
You have selected a function, to execute this the system must set up an RFC connection to another SAP System. However, setting up this connection was not successful. The following internal error message was generated:
"An error occurred during the receipt of a complex parameter."
after i check in bw trans code:st22
Following this error message:
Category                   Internal Kernel Error
Runtime Errors         PARAMETER_CONVERSION_ERROR
Application Component BC-MID-RFC
Short text
    An error occurred during the receipt of a complex parameter.
What happened?
    During a remote function call, an error occurred while converting
    a complex parameter.
What can you do?
    Note which actions and input led to the error.
    For further help in handling the problem, contact your SAP administrator
    You can use the ABAP dump analysis transaction ST22 to view and manage
    termination messages, in particular for long term reference.
Error analysis
    An error occurred during the conversion of a complex parameter.

Problem with Authorization for BW BPS planning Folder

Hi an having a problem with providing authorization for a planning folder
i am getting the following error when i test it with test user
Error while calling up RFC
Message no. UPC202
Diagnosis
You have selected a function, to execute this the system must set up an RFC connection to another SAP System. However, setting up this connection was not successful. The following internal error message was generated:
"You do not have authorization for InfoCube ZT_MR_T "
Procedure
Inform the system administrator.
if any one has faced the same issue let me know.
Regards,
Abraham

HI ,
I Checked it out we dont have that cube in our system.
Regards,
Abraham

Need to Install Safari 6.0.2 on a white Intel core duo iMac. Had to throw out 6.0.3 because of conflict with required software. Downloaded wrong version that was for Mountain lion (I am running 10.7.5). It installs but won't open.

Need to Install Safari 6.0.2 on a white Intel core duo iMac. Had to throw out 6.0.3 because of conflict with required software. Downloaded wrong version that was for Mountain lion (I am running 10.7.5). It installs but won't open, says it is for Mountian Lion.
Of course I can't throw it away since I get a message it's part of the sytem. I can show package contents and throw those away, but evidently not a good idea!!

Need to Install Safari 6.0.2 on a white Intel core duo iMac. Had to throw out 6.0.3 because of conflict with required software. Downloaded wrong version that was for Mountain lion (I am running 10.7.5). It installs but won't open, says it is for Mountian Lion.
Of course I can't throw it away since I get a message it's part of the sytem. I can show package contents and throw those away, but evidently not a good idea!!

What happends when you give 2 groups with some of the same members different authorizations for a document

Hello,
I'm doing my internship at a litte Telekom company. I'm investigating how they can use MS SharePoint as their central place to put projectinformation. Now i've been thinking what happends when i do the following:
Make one document library
Add 2 groups to the Active Directory, group "A" with all the employees and group "B" with only four people working on a project. When i add a document to the document library and set the authorizations for the document as
follows:
Group B: Read/Write
Group A: Read
Does the people from group B still be able to edit the document, because they are also in group A?
I don't have a test environment to test this myself.
Why i want to know this? The company want's one place to place all their documents with projectinformation. This information is about different projects. You only wan't that people can change the specific document when they are working on the specific project
where the document belongs to.

You get the union of permissions, so if one group allows access and the other not, you will get the union of both and therefore access. Of course, you can break security settings per library/folder or document, and specify new settings,
if you need too.
Kind regards,
Margriet Bruggeman
Lois & Clark IT Services
web site: http://www.loisandclark.eu
blog: http://www.sharepointdragons.com

Type conflict with ASSIGN in BADI for Virtual Key Figures

We get the below error dump in ST22 when executing BEx queries that contain virtual key figures.
error message - 'Type conflict with ASSIGN in
program "ZCL_IM_THR_RSR_OLAP_BADI======CP".'
We have a BADI implementation that calculates few virtual key figures included in some infocubes & multiproviders. The error would arise if we execute two queries (containing common Virtual Key figures) one after the other without closing the first query.
We found a note "Note 1237689 - Virtual chars. and key figures in input-ready querys" that could be relevant to our issue and wanted to apply this note but unfortunately the note is only applicable to SAPKW70016 to SAPKW70018 and we are support pack 15.
Can you please advise what the problem could be/suggest corrections for the same.

Hi Kulmohan,
Did you fix your issue? We are facing the same issue. Could you please let me know if you have any solution for this issue,
Thank you,
Mike

How to Control authorization for users with certain status for level 2 WBS Element

Dear All,
Is there any standard way or enhancement available to control authorization for users with certain status for WBS Element i.e. for example
Pre-requisite:
There is only 2 level of project i.e.
Lev_ WBSE_______Description
1___ 7-14.E_______summay outage controller
2___ 7-14.E.2310__ Plant/unit # 2310
2___ 7-14.E.2310__ Plant/unit # 2220
Project Controller (authorization role assigned "Z_PS_OP7_OTGCON_C") have all project level authorization
Plant/Unit Controller (authorization role assigned "Z_PS_OP7_PLNTOTG_C_2310") have only level 2 authorization with enhancement that we did in system by Z table.
User ID_ Plant #
123345_ 2310
122455_ 2220
Issue:
After System Status released and User Status approved the WBS basic date for Plant/Units should be restricted from updating/changing by Plant/Unit Controller level and only project controller should have this authority.
Solution required:
Can any one tell how to control this scenario either by standard or enhancement available to control authorization
BR
Saqib Usman

Hi,
Did you explore SAP Enhancement CNEX0002 Using Transaction CMOD?
Thank you and regards,
Varshal Kachole
The SCN Rules of Engagement

No authorization for this transaction with movement type 601

Dear All,
This is chandra i am getting this error in delivery level " No authorization for this transaction with movement type 601. If give the authorization for SAP ALL its working fine. If give the authorization for SAP SD T.Codes i am getting this error. Plz help me.
Thanks and regards
Chandra

Dear Chandra,
Check with -
T. Code: OMJJ
Select Movement Type: 601 and Double-Click: "Allowed Transaction" (From Left-hand side) .
Check whether the Transaction is allowed for Movement Type 601 or not
Note: if Transaction is not listed (i.e. not allowed) and you wanna allow this Transaction with Movement type 601, then -
Up-there, Tab: New Entry. Click on it.
Maintain entry as:
MovTy: 601
TCode: As reqd.
and Save.
Best Regards,
Amit

I have had a trial version of Acrobat X1 Pro - I have decided not to buy at this stage - for some time it has been conflicting with opening PDF docs after saving as from word 2007 - I uninstalled Pro X1 and now when I save as from word 2007 to PDF it will

Can anyone help with this - do I have to uninstall Reader and then reinstall?

I have had a trial version of Acrobat X1 Pro - I have decided not to buy at this stage - for some time it has been conflicting with opening PDF docs after "saving as" from word 2007 - I uninstalled Pro X1 and now when I "save as" PDF from word 2007 to PDF it will save the document as a PDF but will not open the document to display after publishing - I have to got to where the file has been saved to view the new PDF document - this is really annoying - do I have to delete adobe reader and reinstall it - adobe needs to look at this conflict with acrobat pro as I have even gone it to properties and tried to have adobe reader as the default PDF program - the main issue is that I cannot view the PDF after publishing it from word 2007

HT201363 I forgot I made an apple id years ago. I dont know the password nor can I remember the password for the email address I used years ago. Can anyone help me authorize my music I bought with my super old id?

I dont know the password nor can I remember the password for the email address I used years ago. Can anyone help me authorize my music I bought with my super old id?

See this -> Find My iPhone Activation Lock: Removing a device from a previous owner’s account
i just asked if someone knows the support mail, i don`t know how to someone from apple support
-> AppleID Support - Contact Support
Condolences to you and your family.

For some reason when I shut down my computer then turn it back on, it comes back directly into my account, bypassing having to enter a password to get into my account. This works in direct conflict with the parental controls I've got set up. Any ideas?

For some reason when I shut down my computer then turn it back on, it comes back directly into my account, bypassing having to enter a password to get into my account. This works in direct conflict with the parental controls I've got set up. Any ideas?

Thank you so much for the quick response to my question. I tested your directions and it works!! Thank you. I would never have figured that out. I knew I had to go into System Preferences but would not have guessed that I needed to have Automatic Login set to off.

Issue with authorizations for BPS

Hi Experts,
There was an issue with authorizations for BPS. We have a large number of agents that need to enter plan data via a layout. In order to control the necessary authorizations, we would like to filter via something similar to a user exit using a function module in order to avoid having to define authorization objects for each of the agents who have access to the systems. Right now, we are not sure if there is user exit concept available as it is for BW variables. Any body experienced similar issue may share their experience.
Regards,
Ankit

Hi,
In BPS, you can use user specific variables or you can set up a Variable of type exit. You can also have a variable of type authorization which uses the security / authorization of the BW system.
Hope it helps...
Cheers,
Tanish

Authorizations for user db2 sid after systemcopy with DB2 V9.7 on AIX

Hello,
I made a homogenous systemcopy from the system PRD to ENT with an redirected restore. I had the following system environment:
AIX 5.3 TL10 SP1
DB2 V9.7 (without any fixpack)
After the restore and the recovery were finished, I was able to start the database manager and to activate the database.
I tried to execute a script for cleanup some tables according to the systemcopy guide but I got the following SQL messages:
SQL0551N, SQL0552N for the user db2ent. I checked the authorization for this user and got the following information:
db2 => get authorizations
Administrative Authorizations for Current User
Direct SYSADM authority                    = NO
Direct SYSCTRL authority                   = NO
Direct SYSMAINT authority                  = NO
Direct DBADM authority                     = NO
Direct CREATETAB authority                 = NO
Direct BINDADD authority                   = NO
Direct CONNECT authority                   = NO
Direct CREATE_NOT_FENC authority           = NO
Direct IMPLICIT_SCHEMA authority           = NO
Direct LOAD authority                      = NO
Direct QUIESCE_CONNECT authority           = NO
Direct CREATE_EXTERNAL_ROUTINE authority   = NO
Direct SYSMON authority                    = NO
Indirect SYSADM authority                  = YES
Indirect SYSCTRL authority                 = NO
Indirect SYSMAINT authority                = NO
Indirect DBADM authority                   = NO
Indirect CREATETAB authority               = NO
Indirect BINDADD authority                 = NO
Indirect CONNECT authority                 = NO
Indirect CREATE_NOT_FENC authority         = NO
Indirect IMPLICIT_SCHEMA authority         = NO
Indirect LOAD authority                    = NO
Indirect QUIESCE_CONNECT authority         = NO
Indirect CREATE_EXTERNAL_ROUTINE authority = NO
Indirect SYSMON authority                  = NO
db2 =>
The user db2ent was/is in the group dbentadm and the group dbentadm is configured as SYSADM:
SYSADM group name                        (SYSADM_GROUP) = DBENTADM
SYSCTRL group name                      (SYSCTRL_GROUP) = DBENTCTL
SYSMAINT group name                    (SYSMAINT_GROUP) = DBENTMNT
The only solution was to grant the authorizations with an other user to db2ent.
For the restore I created an new instance with the following command (as user root):
/db2/ENT/db2_software/instance/db2icrt -a SERVER_ENCRYPT -s ESE -u db2ent db2ent
I set the correct DBM configuration and created an empty database as user db2ent with the following command
db2 create db ENT on /db2/ENT
The restore was executed with db2 -tvf restore_prd.clp as user db2ent.
Is there a bug in the db2 software or is there any other solution? I did not changed the environment for the user db2ent.
The authorization concept has been changed in DB2 V9.7
http://www-01.ibm.com/support/docview.wss?uid=swg21385801
Kind regards,
Christian

Hello All,
I finished restore using redirect method, but i did not know about this security issue.
Now I tried creating db2<oldsid> user and tried granting dbadm secadm priv.
but i get this error
db2 => GRANT DBADM to USER DB2P60
DB21034E The command was processed as an SQL statement because it was not a
valid Command Line Processor command. During SQL processing it returned:
SQL0707N The name "DBADM" cannot be used because the specified identifier is
reserved for system use. SQLSTATE=42939
Please help me.
I need a solution at the earliest possible.
Thanks,
Sree

No authorization for action: CRE with object: ADCP

Hi,
I encountered the following error when creating an index:
No authorization for action: CRE with object: ADCP
I was at transaction DB02 -> 'Checks' -> Database<->ABAP/4 Dictionary.
The checks indicate that there are some optional indexes that are not created.
The error is encountered when I select one of these indexes (eg. ADCP-I01) and try to create it using the 'Create in DB' button.
Do I have to assign some certain permission to my account? I am already holding the SAP_ALL and S_A.SYSTEM profiles.
Thanks for any help,
Tzyy Ming

Hello,
As i had expected DDIC userid did the needful.
to see whether the index is created, you need to do the following.
start transaction DB02
click on the refresh button
You would then get a new pop up with two different buttons.
now on this pop up click the 'perform database checks' button.
System might give you a warning 'This will take time' , click yes and wait for the system to refresh the data.
Once system has refreshed the database data, you should be able to see your newly created index.
Regards,
Siddhesh

Need authorization for business document services attachment list with user status in ps claim for clm2 and clm3

Dear Friends,
client wants to restrict the attachment list changing, deletion after the user status sets to close in PS Claims for transaction clm2 and clm3.
Currently any one can attach documents as GOS and delete even the claim is completed and status is closed.
How can we restrict all users even who created the claim can not change create and delete attachment list documents once the claim is completed and approved and user status sets to closed.

HI,
what is the claim creation transaction in that 01 is for creation 02 is for edit and 03 for display so with the help of basis consultant you can assigned transaction in user's assigned role accordingly.
But user who is authorize for create claim can not modified or edit once he save the job. this would be limitation.
Regards,
Sanjeev

Authorization for VAP2 in conflict with VD02 for F_KNA1_GRP

Similar Messages

Maybe you are looking for