Authorization to display a template.

I have a project template for which the template responsible can maintain a list of users that shall be able to read it (tab "Authorizations").
However, this does not seem to be enough for a user to read a template.
If the user does not have any special profile, he/she is not able to read.
If he/she has a profile which includes the authorization object CPRO_DPT with activities 02 or 03, he/she is able to read ALL templates, also the templates for which they are not authorized.
So, CPRO_DPT seems to be too global. Is there any other profile/role that is needed?

Hi Matthias,
the authorization object for the project type was already in the same profile. It seems to work only for projects, not templates.
Furthermore, I did an auth-trace now.
It seems that only the authorization object CPRO_DPT with ACTVT=03 is checked (in my case with RC12 when not having the right profile).
The check is done in CL_DPR_AUTHORIZATION_SERVICES=>HAS_AUTHORITY_FOR_DPT.
This is strange: why am I maintaining authorizations on template level (inside the template in cPro), if they are not used for any checks? Are they only needed to copy them to projects?
It seems that a user can either see all templates (when having CPRO_DPT), or none.
Regards, Daniel

Similar Messages

Role or Profile with Full Authorization in DISPLAY MODE

Hi all,
Can anyone help me or tell me if there is any standard role or profile which has full authorization in display mode.
I wanted to assign this to all our support team for the PRD server who shud only have the display auths so that the pre-production client can be safe.
I have checked many places for this kind of activity, but found no threads on the same and also realted links.
Can anyone tell me how to get this task done....
I have also tried few possible ways which never helped me and all my efforts failed.
Waiting to hear from SDNs, for which i can assure REWARD POINTS.
Thanks to all in advance
Regards
Hari Haran

Hi,
By enabling the permission level as 'read', the authorized user/group/role can:
1. View the object in the Portal Catalog using the browse and search capabilities.
2. Open the object in its respective primary and secondary editors in read-only mode; the object cannot be modified.
3. Create instances (delta links and copies) from the object.
4. Gain access to and choose templates in the object creation wizards.
This permission level can be used to prevent portal administrators from editing a particular object, while still allowing them create an instance of the source and use the new instance in any way
Regards
Srinivasan T

Error: No authorization to display the message

Hello
Users are getting error : No authorization to display the message,
when they are trying to view the content of the message.
When checked in the error logs, I see teh below log:
Message: Failed (javax.management.MBeanPermission,*,DISPLAY)java.lang.reflect.InvocationTargetException
Category: com.sap.security.core.role.PermissionData
Location: com.sap.security.core.role.PermissionData.get(ClassLoader)
Application: sap.com/tclmitsamcouinwalocalnavigation~wd
Can you please advice , as what actions has to be added to user.

Where do you get this error? Basically user is not having proper credentials to view the message. Talk to Basis team.

Differences between authorization role display and display change document?

Dear All,
I want to know what are the differences between activity authorization between display and display document change?
Regards
Aishah

Dear Mr Robert,
thanks for replying me. actually, it is to prevent user from other dept to change the PO even print/message. when i check inside authorization the configuration is only for their own dept by putting dept code at pur org field of change. but still can change. it is because of the me22 layout screen?

Insufficient authorization to display object Message Mapping

Hi there
Every now and then when I try and open a message mapping object I get this error: Insufficient authorization to display object Message Mapping. I then restart my Integration Builder then it works again.
Any Idea how I would fix this?
Thanks,
Jan

hi,
apart from what was said you can try changing
com.sap.aii.ib.util.server.auth.activation
parameter in exchangeprofile to false
if you don't use any data-dependent authorizations
then you should never see this error
maybe this will help
but remember that if you want to use data-dependent authorizations
in the future you need to put it back to true again
Regards,
Michal Krawczyk

"No authorization to display partner in role".

Hi
We are in SRM4.0 SP12 and we have buyer completion workflow -after which the SC goes for cost center owner approval.
In case of goods SC the cost center owner carries out the approval process as desired. However, in case of service shopping cart when the approver tries to approve the SC he gets an error "No authorization to display partner in role".
Please note that this error is coming for Brazilian approvers only. We recently did Brazil specific configuration in our system.
For all other countries the approval is working fine for goods as well as service SCs.
Please proviide inputs to resolve the issue.
Regards
Ashish

Hi Sanjeev
Org. structure is correct ,attribute user_role is assigned and all other pointers you suggested are inline. Still the problem persists.
The surprising part is the approval is happening for limit shopping cart as well as goods shopping carts.Only for service sc we have an issue.
I managed to find the massage no. (R1-277) and there is a mention of function module BBP_BUPA_EVENT_AUTH1 in the where used tab. The code is commented in German. May be you have some pointers on this.
Awaiting reply.
Regards
Ashish

Personal ID : You have no authorization to display.

Hi,
we have EP 7.0 and have deployed ESS/ MSS 1.0 buisness package.
When i go to Personal IDs in Personal information workset of ESS. It gives me following error :-
You have no authorization to display
com.sap.pcuigp.xssfpm.java.FPMRuntimeException: You have no authorization to display
     at com.sap.pcuigp.xssfpm.java.MessageManager.raiseException(MessageManager.java:112)
     at com.sap.pcuigp.xssfpm.java.MessageManager.raiseException(MessageManager.java:122)
     at com.sap.xss.per.helpers.MessageHelper.raiseException(MessageHelper.java:43)
     at com.sap.xss.hr.per.in.pid.fc.FcPerPidIN.readRecord(FcPerPidIN.java:269)
     at com.sap.xss.hr.per.in.pid.fc.wdp.InternalFcPerPidIN.readRecord(InternalFcPerPidIN.java:535)
     at com.sap.xss.hr.per.in.pid.fc.FcPerPidINInterface.readRecord(FcPerPidINInterface.java:146
For some of the employee it is working, but for some its not working.. i tried giving them Administrator role still it shows same error.
I dont know what authorization i am missing..

Hi Supraja,
Thanks for replying...the link you provided talk about NWDI and CMS.....i am not importing my package into NWDI..
I get following error when an employee is trying to view his personal id from ESS role in portal..
i mean..when a user clicks on Personal ID link in portal..it gives me :-
You have no authorization to display.
Thanks and regards,
Jigar Oza

How do I display the template chooser window? It does not appear under the file menu any longer.

How do I display the template chooser menu? It no longer appears under the File menu. I can see it only in the help mode.

File > New... opens the template chooser.

Captivate Variables Only Display in Template--Not .CP File

Hi There,
I'm new to Captivate 4, but have been using Captivate for roughly four years or so. I have used the $$cpInfoCurrentSlide$$ variable in a template. When I use the Preview function in the template I can see the slide numbers as they should be displayed. However, when I create a Captivate file based on the template, the slide numbers don't display at all. Is this normal? I'm guessing I used the variable properly or it wouldn't even display in the template, but any light you could shed on this would be very helpful. BTW, I searched the knowledgebase as well as this forum and couldn't find any info on this issue, so please pardon me if the info is there and I didn't find it. I would be happy to send an individual contributor the template and .cp files if necessary, but am hesitant to post them here. Many thanks in advance for your help.
Jayney

Hi There,
I just posted a reply to the following:
http://forums.adobe.com/message/2293463
Unfortunately, the original poster's fix doesn't seem to be working for
me. I just wanted to bring this to your attention because I thought this
might be easy to miss. Many thanks for any help you can provide.
Jayney
Jayney Wallick
Instructional Designer/Manpower Professional
Remote phone (try this first): 206-286-6691
Office phone: 425-250-0233
[email protected]
Captiv8r <[email protected]>
09/28/2009 03:05 PM
Please respond to
[email protected]
To
Jayney WALLICK-ECON/USBVE01/TDE/non-AREVA-TD@ATD
cc
Subject
Captivate Variables Only Display in Template--Not .CP File
Hi there
I'd be happy to take a look for you.
rstone75 (at) kc (dot) rr (dot) com
Cheers... Rick
http://www.robowizard.com/pc.gif
Helpful and Handy Links
http://www.Adobe.com/cfusion/mmform/index.cfm?name=wishform&product=5
http://www.ShowMeSolutions.biz
http://sorcererstone.wordpress.com/
http://www.gooberguides.com

How to control the authorization as display only in ECC system?

Hi all,
I want to control the IT users' authorization as display only for each Authorization Object.
As i know, there are 177 Item of field "ACTVT" in ECC system, But i'm not ture which the value can limited the authoirzation as display only.
Im worry about IT users have not authorization for the work if just keep "03-display" in authorization object, I plan to remove below value of ACTVT:
01-create, 02-change, 05-Lock,06-Delete,07-Activate, generate
But i'm not sure whether should be removed for below values:
52-Change application start
60-Import
61-Export
62-Create automatic Ledger
63-Activate
64-Generate
70-Administer
75-Remove
C3-Maintenance of manual auth.
C4-Develope Payment Card
FP-Change customer field selectn
Could anyone can tell me, Which values of ACTVT can limited the authorization as display only. at the same time, it havent an effect on work of IT users.

Yep, I agree with Jurjen. It is not only limited to ACTVT, but rather fields of other objects as well which are "action" or "activity" related.
I would start the other way around - give them '03' only and investigate any transaction specific claims that it is not enough. There will be a few...
Cheers,
Julius

Authorization for display only in tx MIGO

Dear Guru's,
can we give an authorization for display (i.e.Display material document ) only in Tcode MIGO for particular user ,
if possible please let us know the authorization object for the same.
Thanks,
Ashish.

Hi,
Create a custom profile via tcode PFCG.
Add the required tcode 'MIGO' to the 'Menu' tab.
Then goto 'Authorizations' and open expert mode for authorization. Here you can control the field values for authorization object. Once done, generate the profile and assign user to role along with user master comparison run.
Regards,
Srikishan

Why "You do not have authorization to display company codes" ? Thanks

Hello,
Using the Tutorial BAPI which comes with the JCO Tutorial,I just wanna call the first function.
When I run the code, it display "You do not have authorization to display company codes".
Could any body please help me to explain why?
Thanks a lot
BELOW IS THE CODE:
package com.sap.slc.teamweb.test;
import com.sap.mw.jco.*;
public class TestBapi1 extends Object {
    JCO.Client mConnection;
    JCO.Repository mRepository;
    public TestBapi1() {
        try {
            // Change the logon information to your own system/user
            JCO.createClient("001", // SAP client
              "<userid>", // userid
              "****", // password
              null, // language
              "<hostname>", // application server host name
              "00"); // system number
            mConnection.connect();
            mRepository = new JCO.Repository("SAPJCO", mConnection);
        } catch (Exception ex) {
            ex.printStackTrace();
            System.exit(1);
        JCO.Function function = null;
        JCO.Table codes = null;
        try {
            function = this.createFunction("BAPI_COMPANYCODE_GETLIST");
            if (function == null) {
                System.out.println("BAPI_COMPANYCODE_GETLIST" + " not found in SAP.");
                System.exit(1);
            mConnection.execute(function);
            JCO.Structure returnStructure = function.getExportParameterList().getStructure("RETURN");
            if (!(returnStructure.getString("TYPE").equals("") || returnStructure.getString("TYPE").equals("S"))) {
                System.out.println(returnStructure.getString("MESSAGE"));
                System.exit(1);
            codes = function.getTableParameterList().getTable("COMPANYCODE_LIST");
            for (int i = 0; i < codes.getNumRows(); i++) {
                codes.setRow(i);
                System.out.println(codes.getString("COMP_CODE") + '\t' + codes.getString("COMP_NAME"));
        catch (Exception ex) {
            ex.printStackTrace();
            System.exit(1);
        try {
            codes.firstRow();
            for (int i = 0; i < codes.getNumRows(); i++, codes.nextRow()) {
                function = this.createFunction("BAPI_COMPANYCODE_GETDETAIL");
                if (function == null) {
                    System.out.println("BAPI_COMPANYCODE_GETDETAIL" + " not found in SAP.");
                    System.exit(1);
                function.getImportParameterList().
                setValue(codes.getString("COMP_CODE"), "COMPANYCODEID");
                function.getExportParameterList().
                setActive(false, "COMPANYCODE_ADDRESS");
                mConnection.execute(function);
                JCO.Structure returnStructure = function.getExportParameterList().getStructure("RETURN");
                if (!(returnStructure.getString("TYPE").equals("") ||
                returnStructure.getString("TYPE").equals("S") ||
                returnStructure.getString("TYPE").equals("W"))) {
                    System.out.println(returnStructure.getString("MESSAGE"));
                JCO.Structure detail =
                function.getExportParameterList().
                getStructure("COMPANYCODE_DETAIL");
                System.out.println(detail.getString("COMP_CODE") + '\t' +
                detail.getString("COUNTRY") + '\t' +
                detail.getString("CITY"));
        catch (Exception ex) {
            ex.printStackTrace();
            System.exit(1);
        mConnection.disconnect();
    public JCO.Function createFunction(String name) throws Exception {
        try {
            IFunctionTemplate ft = mRepository.getFunctionTemplate(name.toUpperCase());
            if (ft == null)
                return null;
            return ft.getFunction();
        catch (Exception ex) {
            throw new Exception("Problem retrieving JCO.Function object.");
    public static void main(String args[]) {
        TestBapi1 app = new TestBapi1();

Hi Mao,
R/3 comes with some predefined Company Codes and we also
can define our own Company Codes.
visit this link this may help you.
http://help.sap.com/saphelp_erp2004/helpdata/en/8e/1a5217171311d28e1d080009b6ab29/frameset.htm
Regards,
Narinder Hartala

Difference between Change Authorization Data / Display Authorization Data

Hello,
My question is wrt to implementation of "principle of treble control" i.e three SAP administrators i.e.
1. Authorization data administrator
2. Authorization profile administrator
3. User Administrator
I have created a role & added a transaction to it e.g. "FAGLL03" or "FF67".
No authorization data is displayed in the authorization tab unless I enter authorization tab with change button and provide inputs for org level field & generate profile. Even when I save the profile with the proposed name, it status still says "No authorization data exists". Since no authorization data is available, administrator 2 is unable to generate profile. If administrator 1 has to generate profile then why is administrator 2 required.
Definition of Administrator 1 is:
The authorization data administrator creates the roles, selects transactions and
maintains the authorization data. He or she simply saves the data in the Profile
Generator since he does not have the necessary authorization for generating the
profile. He or she accepts the proposed profile name T-.... The authorization data
administrator may not change users, nor generate profiles.
Definition of Administrator 2 is:
The authorization profile administrator starts transaction SUPC and chooses All
Roles. He or she then restricts his selection, for example by entering the ID of the
role to be edited. On the next screen, he or she chooses Display Profile to check
the data. If all the data is correct, he or she generates the authorization profile. The
authorization profile administrator may not change users, change the data for roles,
nor generate profiles containing authorization objects beginning with S_USER*.
Thanks.

Hasan Saeed Khan wrote:
Actually I started off my question with the "implementation of treble control" that SAP course AD940 suggests.
I had never heard of this treble control and the added value of splitting rolebuilding and profile generation doesn't make much sense to me but that's my personal opinion.
On the technical side of things: in your first post you state "No authorization data is displayed in the authorization tab unless I enter authorization tab with change button and provide inputs for org level field & generate profile."
It is also possible to change the data and save this but not generate the profile yet. I just tried this by doing the following:
Create role
Add transactions to menu
Edit profile, org levels & authroization data.
Hit 'save'.
Accept proposed profile name.
Go back to PFCG main screen and ignore message of profile not being generated. (Click 'continue')
And this leaves me with a role with yellow traffic light on the authorization tab an the profile status is: "Current version not generated"
So it should be possible to maintain roles and profiles separately.

IE won't display Dreamweaver template.

I did a quick site for a friend. "Quick" also meaning "free", in this instance. I use a Mac and had not looked at the site in IE until last weekend. Is there code you can stick into the template (twoColHybLtHdr) that will make it display the page correctly? I am asking here because the template is a Dreamweaver CS4 native template. I was told it may be float and margin properties. And no, I haven't "googled" anything because I don't know enough about code and incompatability issues to know what to ask. I rely on Dreamweaver because I am not a coder.
For PC/IE users, the site is: http://www.summerfunnationals.com/
css: http://www.summerfunnationals.com/summerFun3.css
For the most part, the css is "out of the box", with very minimal structure changes.
The issue is the masthead images extend past the content area AND the space/margins between the images and the edge of the "page" are almost nonexistent in IE.
Thanks for your help or where to go to learn about this. I'd prefer a not-all-the-way-fixed option over something that requires lots of research, if thats possible.
I don't want to have to bag Dreamweaver/html and use a CMS... or wait until Chrome overtakes IE.
A big thanks!!
Patty

The one error I don't know how to fix is the code for the onclick, to open a new window. This works but isn't correct.
<div align="center" style="cursor:pointer; cursor:hand;">
<a href onclick =
You have no value for the 'href' attribute! It should be this -
<a href="#" onclick="..."
or this -
<a href="javascript:;" onclick="..."
or this -
<a href="#" onclick="...;return false" (this would be the best practice)
I'm still working on centering my header images without using <center></center>...
<p style="text-align:center;"><img src="summerFun-art/masthead.jpg" alt="masthead" width="900"
height="332" border="0" usemap="#Map2" />
As far as the page not being a DW template "child page" I guess the more correct way to describe it is I used one of the DW layouts but didn't actually save it as a "template" when making the other pages. The functionality of the other pages needed to be independent enough that controlling it with a template wouldn't have been as streamlined at the time.
Sounds odd, but OK.

Where are the "Display As" templates?

I am using the Blue Grey theme on an application. On some forms there are fields that are not updateable and have the Display As set to "Text Disabled, ..."
In the Blue Tan theme fields that are set to Display As "Text Disabled, ..." are grayed out. I want to gray out the text or the boxes on the fields in the Blue Gray theme just like that.
I looked at the Blue Tan templates for the form Region and can not see what I should change... not even a clue. Doesn't look like it cares about the Display As property.
Where should I look?
Or, heaven help me, does this require changing the CSS file?
TIA,
Sam
Message was edited by:
slavanaway

Christina,
The themes are
2 is Blue and Tan
13 is Blue Gray
Let me see if I understand the problem correctly. When you set an item as either Text Field (Disabled, does not save state) or Text Field (Disabled, saves state) display type, this works in Blue Tan theme, but does not work in Blue Gray theme?
Close but not exactly.
In both themes the "Display As" property of Text Field (Disabled, ...) does disable the field from updates. In theme 2 (Blue and Tan) it also "grays" the text. This is common in many applications for identifying information that can not be updated. In theme 13 (Blue Gray) it does not change the text to gray but leaves it black.
If you go to Shared Components>Templates, you will find templates for "Labels" types (No Label, Optional Label, etc.). When you set the Label type in a Page Item, the template changes the way the Label is displayed and allows HTML coding.
I am looking for templates for the "Display As" type. It isn't on the templates page so I assume it is hidden somewhere in the bowels fo ApEx.
Sam

Authorization to display a template.

Similar Messages

Maybe you are looking for