Authorization values to auth object

Hi,
Please let me know how to find the possible authorization values for an custom authorization object..
thanks.

Hi,
the definition (and also display) of possible values for activity can be performed in SU21.Doubleclick on the object->there is then a button in the popup: 'Permitted activities'.
Depending on the values checked in the coding (statement 'authority_check') you can also maintain suggestions in SU24 for the corresponding transaction. So if you do not know any values at all, an analyze of the coding will be necessary.
b.rgds, Bernhard

Similar Messages

BW Authorizations/Report. Auth Object/KF's vs. Calc. KF's

We implemented a custom/reporting auth. object to protect key figures (1KYFNM) and it works well. The issue is that our user community never ceases to come up with new and even more creative requirements.
Let me illustrate the latest requirement:
I have locked-down access to certain key figures (let's call them 'KF A' and 'KF B') and therefore subsequently secure all combinations involving either one of the two meaning calc. KF D (KF A plus KF C) is locked down as well. I also need to mention that users are supposed to be able to create their own ad-hoc queries, which eliminates the option of limiting them to a query or set of queries that accomplish the following requirement.
There are certain totals, which are calc. KF's that the users are allowed/required to see even though they are not supposed to see what makes up these numbers (they should see calc. KF K which is made up of KF A, KF B, and KF H, etc. but not KF A and KF B).
Without the option of providing the users with rather static queries, I see another option as calculating 'KF K' (from the previous example) at the time of the load and just making it another key figure in the cube which then can be excluded from the auth. check previously mentioned based on the naming convention. The problem with that is that this will make reporting rather inflexible, increase load times as this calculation is rather complicated, and it will also create redundant information in an environment that is already experiencing substantial growth and volume.
Does anyone see any other solution?
Thanks,
Joerg

Jeorg,
I'm afraid that there's no special authorization handling for calculated key figures. To my best knowledge, the approach to create another key figure at data load time via transfer rules or update rules would be the only one can work. While this approach may not be flexible, but the load time should not increase significantly if you just add two key figure values into a new one.
If you find this is approach is unacceptable or it is a common requirement among BW community, you might consider submit such requirement through ASUG BI Group or via OSS development request.
Thank you for your question and patience.
Regards,
Amelia Lo
SAP NetWeaver RIG, US
SAP Labs, LLC

Can we give more than one value for an Authorization field in Auth-Check.

Hi all,
Can we give more than one value for an Authorization field in Auth-Check.
Ex: AUTHORITY-CHECK OBJECT 'S_TRVL_BKS'
ID 'ACTVT' FIELD '02'
ID 'CUSTTYPE' FIELD <Value 1> <Value 2> <Value 3>.
IF SY-SUBRC 0.
MESSAGE E...
ENDIF.
If yes, please help me with exact syntax.
Think it will be like
ID 'CUSTTYPE' FIELD: <Value 1>, <Value 2>, <Value 3>.

Hi,
yes we can give more than one field.
program an AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT <authorization object>
   ID <authority field 1> FIELD <field value 1>.
   ID <authority field 2> FIELD <field value 2>.
   ID <authority-field n> FIELD <field value n>.
The OBJECT parameter specifies the authorization object.
The ID parameter specifies an authorization field (in the authorization object).
The FIELD parameter specifies a value for the authorization field.
The authorization object and its fields have to be suitable for the transaction. In most cases you will be able to use the existing authorization objects to protect your data. But new developments may require that you define new authorization objects and fields.
please reward points, if it is useful.
satish.

Value of CLIIDMAINT in auth object: S_TABU_CLI

Hi,
In SAP documentation, value of 'X' means the user is authorized to maintain client-independent tables. What if you grant asterisk(*) or input both 'X' and '' for the field?
I would assume full access will NOT grant the authorization to users to maintain client-independent tables.
Is anyone able to confirm this?

I would recommend giving 'X' and not *.
Technically, granting * means that you not only grant 'X', but infact you also grant '' or other hidden values which SAP_ALL users are deprived of discovering...
A * value for an authorization field will let all authority checks pass against the range of possible values in the authority-check statement.
The permitted value ranges can also have permitted data types and permitted values as can be seen in this example (SE11 -> Domain -> CLIIDMAINT -> Display -> Value range.) There are 2 standard CHAR values, 'X' and (explicit) =''. Theoretically you can extend these ranges, for example if you coded an authority check against S_TABU_CLI field CLIIMAINT = 'Y' and only wanted to grant 'Y' and not 'X' or ''.
Also note that S_TABU_CLI = 'X' check is just an upfront all or nothing check for access to maintain client independent "system" tables at all, <edit> you should still need authorizations for the auth-group </edit>. Depending on the transaction codes etc which you grant the user they should be guided into a table maintenance view, and S_TABU_DIS with appropriate activities and table-auth-groups would (normally) still be required and dependent on the authorizations which the user has in that specific client they are logged onto.
Message was edited by: Julius Bussche

Do 2 same auth objects with different values bleed together?

If I had a user who had Auth object F_BKPF_BUK with Activity 01 and Company Code 1200 and also Auth Object F_BKPF_BUK with Activity 03 and Company Code 1300, would the user have 01 and 03 for both Company Code 1200 and 1300 or would the user be restricted to 01 for 1200 and 03 for 1300?

It depends on the object and how the result of the authority-check is "built".
For the result of a single authority-check Sanju is correct.
It would not make sense to attempt to display something (retrieving the value from the record) which has not been created yet (checking the value in the entry screen).
However the opposite can be true for authority-checks within arguments:
- IF weak_check_failed    "user is not authorized...
- THEN perform strong_check    "permit everything if passes...
- ELSE return_to_...     "Go back to list...
However, in many cases this weaker : stronger check is against different objects.
Other transactions will completely bypass the one object and only use a stronger one.
F_BKPF_BUK should be okay for transactions FB01 and FB03, for example.
Cheers,
Julius

Can we control Work center group links using auth object UIU_COMP

Hello All,
We are running into an issue while doing our PFCG role configuration.
I need to know if we can control Work center group links in a business role through auth object UIU_COMP.
We can control Workcenter's but not 'Work Center Group Links'.
Here is what we did:
- We have a business role Z_RA_DEFAULT.
- The Nav Bar Profile SRV-PRO for this business role has some work center group links that are checked in menu and visible.
- I'm trying to find the values in the auth object UIU_COMP to restrict Work center group links.
- Even though the values Work center group links are in menu and visible,
I want to remove these Work center group links from the screen using the auth object.
- If we remove the check from in menu and visible in the business role the Work center group links disapper from the screen.
Right now this is only way we are able to controle Work center group links.
Question:
- Can I use UIU_COMP to restrict Work center group links?
- any another auth object that controle Work center group links?
- any document/ website / info available which tells us what can we restrict with auth object UIU_COMP?
- or any other way of doing this... like code change, user exit, ....?
Really appreciate your help.
Thanks,
Nasir

I am not sure if I have understood the issue correctly, but still what stops you from actually creating a clone business role to your existing business role and deactivating the in menu visible work center group links. Use this new business role for users who need to be prevented from viewing the work center groups links in question.
If you are going to use authorization objects to control the visibility wont it impact all users (still defeating your original purpose?)
Again apologies in case I have got the question wrong.

Deletion of auth objects Corresponding to tcodes

Q1.
If a transaction is deleted from the menu wthr the Corresponding authorization objects are deleted.
Q2.Eg
What if the tcode MM02 is deleted from the role which has MM01/MM02/MM60/MM03 transaction codes, In this case some of the auth objects of MM02 are same as the other tcode auth objects, then how does deletion of MM02 from role ensure that only the corresponding object--> values are removed.?
Rakesh

Q1.
If a transaction is deleted from the menu wthr the Corresponding authorization objects are deleted.
It depends..
If the auth object's status is 'standard' and it is coming from only one t-code which is being removed, then it gets removed. If the status is 'changed', then it doesn't get removed.
Q2.Eg
What if the tcode MM02 is deleted from the role which has MM01/MM02/MM60/MM03 transaction codes, In this case some of the auth objects of MM02 are same as the other tcode auth objects, then how does deletion of MM02 from role ensure that only the corresponding object--> values are removed.?
No, the auth object won't get removed as that is coming from su24 from other t-codes also.
If different t-codes are bringing different field combination values, then the instance which is coming from MM02(if it is being deleted) will get removed, again assuming that the instance is standard and not changed.

Error "Inconsistancy in the auth object P_ORGIN"

Hello Gurus,
I have to add a tcode which involves auth object P_ORGIN. When I add the tcode and go to authorization tab then it gives the error as "Inconsistancy in the auth object P_Orgin"
Please let me know how should I add the tcode now. Thank you !
Regards,
MA

PLease provide tcode
The reason why the profile generator cannot correctly insert the
default values of these transactions is due to a data inconsistency in
table USOBT_C (default values for customers). The table does not
contain an entry for field BTRTL of authorization object P_Orgin.
You can immediately correct the incomplete data in your customer table
USOBT_C using the following steps:
Step 1 Execute transaction SU24
Step 2 Enter the transaction affected by this error ie XXXX
Step 3 "Change check indicator" (F6) in the application toolbar.
Step 4 With "Display field values" (F7) you check the default values of
P_Orgin. Please document the values.
Step 5 Go back to the previous screen and set the check indicator from
"Check/maintain" to "Check" for P_Orgin.
Step 6 Set the indicator for P_Orgin back to "Check/maintain".
Step 7 Choose the function "Change field values" (F6) and insert the
formerly documented values for AUTHC in object P_Orgin.
Now you see also the field BTRTL being presented.
Save the changes.
Repeat steps 3-7 for each of the transactions affected.
Hope you are clear with the steps.
Thanks,
Prasant
Edited by: Prasant K Paichha on Mar 3, 2010 3:01 PM

Custom TCODE-Auth Object Assignment

Hello All- I see a very weird thing with custom TCODE assignment, here is what I see:
1)We have Display role which has all functions tcodes in it, which goes to every one on PRD.
2)Usually we assign custom tcodes which are not critical to this role, and this custom tcode would have no auth objects assigned or checked during access.
3)When I assign custom tcode to test role, I see its not pulling auth objects in PFCG which is what I expected.
***4)However when I assign this custom tcode to 'Display role' which have many standard tcodes in it, I see many of the auth objects "lights turning in to Yellow" (as you know its asking me to maintain value)
5)I checked in SU24/SU22, to see if its pulling any auth objects...no objects are tied to this tcode.
I dont know why this is happening?
Again if I assign to test role, no objects is showing up in PFCG which is what I want!
Any suggestions of to handle this issue, I will really appreciate your thoughts.
Thanks,
AJ

AJ wrote:>
> Hello All- I see a very weird thing with custom TCODE assignment, here is what I see:
> ***4)However when I assign this custom tcode to 'Display role' which have many standard tcodes in it, I see many of the auth objects "lights turning in to Yellow" (as you know its asking me to maintain value)
> 5)I checked in SU24/SU22, to see if its pulling any auth objects...no objects are tied to this tcode.
>
> I dont know why this is happening?
>
> Again if I assign to test role, no objects is showing up in PFCG which is what I want!
>
This is happening not because of the Custom TCodes you have added. The reason are either of the following:
1. In previous cases when some other TCodes (SAP Standard) were added, the the profile regeneration was not carried out by entering Authorization data through "Expert Mode for Profile Generation" (or used with option "Edit Old Status" only). Instead, "Change Authorization Data" was used. And thus the Object proposals for New entries in Menu were not pulled into Profile Generator at that time. Now it's coming. Surely you entered with Expert Mode for Profile Generation --> Read Old status and Merge with New data.
2. Other option can be: Earlier some Objects were changed which were present there only with "Standard" status. It should have been done by copying the Object and change the copied one. Then make the standard one "Inactive".
3. The Inactive Object described in the 2nd point has been Deleted and the object with status "Changed" is left only. Now when you are entering with "Expert Mode for Profile Generation" it's pulling those standard proposals again.
Let me know if the probable reason of Yellow traffic lights are clear to you or need more details.
Regards,
Dipanjan

BI Role with Analysis Auth Object

Hi
How can i use Authorisation Object created in RECADMIN with all the list of Infoproviders in S_RS_COMP and S_RS_COMP1
So that user can perform mentioned action on the data providers mentioned in analysis authorization object.
As i need one place to list all the data targets user can access insted of maintaining in S_RS_COMP and S_RS_COMP1 and in Analysis Authorization object
Thanks in advance

Thanks Everybody for giving suggestions; I really appreciate alll your efforts.
I followed step by step book of kamaljeet and findout that , I was missing to add related info objects of the inforprovider .added those info objects to auth analysis object.
Now query is working fine without errors;
problem is i am not able to restict the query since it showing all the data ; i am trying to put only few values in "0wbs_elemt " .
I added 0wbs_elemt in my analysis auth object;
Clicked on 0wbs_elemt and kept values in value authorizations and also kept wbsh in hierarchy name , selected type 1, HI 0.
still i am unable to restrict the data;
Functinal consultants build WBSE set up on a hierarchy. like
18ICT-07/2011
      18ICT-07/2011-1
            18ICT-07/2011-1-AUDTM
                  18ICT-07/2011-1-AUDTM-01
            18ICT-07/2011-1-CETX_
                  18ICT-07/2011-1-CETX_-01
they want to restrict like if we are giving 181ct-07 then they want to access every thing under it;
same way like 181ct-08 etc etc..
looks like they want to restrict the date very granuler level like restriction on " Attribute Navigation   "
Can anybody please do let me know how can we achieve Navigation Restriction.
Thanks.

Job role design - transaction role and auth object role

Hi all, please kindly comment following job role design:
(1) transaction role:
Keep transactions in single job role to represent business processes in different application areas, e.g.MM: maintain PR, PO, OA. CO: maintain cost center, internal order HR: maintain org structure, personnel management.
The single job role will only keep role menu, object S_TCODE and inactivated all other application related authorization objects.
(2) authorization role
Keep application component related authorzation objects except S_TCODE in single job role by different application area, e.g. Objects of MM_B, MM_E, MM_G in MM role. Objects of K_CCA, K_CSKS_SET in CO role. Objects of HR in HR role.
Then maintain org level of MM, CO, HR roles for different companies, e.g. Company A MM role, company A CO role, company A HR role, company B MM role.;....
User will be assigned transaction role + auth object role. For example, user of company A to perform MM and CO functions will be assigned
with MM transaction role + company A MM role + company A CO role.
Please let me know the pros and cons of above design. Thanks.
Regards,
Donald
* I can see the disadvantage of this design is during SAP upgrade (SU25), revised of authorization object will not reflect in authorization role

Brent Van Dyck wrote:
Keep in mind the project was for an HCM implementation where there's already hardly any connection between tcodes and authorization values so it may have made more sense in that context than it would in a classic SD/MM.
That is correct - but it still exceeds "horrible" beyond imaginable boundaries if you try to split the fields of the objects into different roles and expect it to work or that there will be less roles.
In the case of HCM and also BW the auths admin needs to know more about the data and organization than what classic ERP auths admins can get away with. That is why they take longer to migrate away from manual profiles and have a greater tendency to have manual authorizations inserted into roles - which could however also be achieved by maintaining fields proposed without values and at least proposing those (such as activity type fields) which are known.
But splitting cube / characteristics / key figures or infotype / personel group / auth code into different roles can only go wrong.
Another mistake some "value role experts" sometimes make is that they don't want Su24 proposals in PFCG because they don't understand them. So what they do is that they clean out the SU24 tables completely... Well... the side affect of that is that all SU24 check indicators flagged as "no check" suddenly become alive in their system although there are mostly good reasons not to have the checks active.
Cheers,
Julius

Same Auth Objects CM in su24

Hi All
In SU24 for a Tcode SU01 in S_TCODE the following auth objects are CM.
S_USER_AGR
S_USER_AUT
S_USER_GRP
S_USER_PRO
S_USER_SAS
& for Tcode PFCG
S_USER_AGR
S_USER_AUT
S_USER_GRP
S_USER_PRO
S_USER_SAS
I am developing a role initially with SU01 Tcode. For the auth object S_USER_AGR, I am giving 01,02,03,06 field values.
Later I add PFCG Tcode for same role P_TCODE. For the auth object S_USER_AGR , I am giving 22,21 field values.
My question is if the role is assigned to a user
1.     will he be able to create, change, display, & delete roles using PFCG ????
2.     What is the best way to restrict the users in create, change, display, & delete???
3.     For PFCG Tcode none of the Auth. Objs (the objects that are added by adding SU01 or PFCG Tcode VIA MENU)are maintained in the role what would be the implication??
Thanks,
VJ

Hi,
1.What is the purpose behind the calling of multiple Tcodes thru a single T.code .I mean to say, suppose, i require a C.Code object to be associated with a T.code for doing that, why i am connecting it to C.Code object of some other T.codes.
Many tcodes are customized to limit the access / risk. The best example is with SM30. If an user want to maintain a table, you can create a custom transaction which skips the intial screen (user don't need to enter the table name) and allows the user to edit the right or only one table rather than many.
You can connect your custom authorization object to F-67, it will not affect FBV1. the settings from FBV1 can be overwritten with the entries in F-67. use transaction SE93 to see more details and customization in transaction F-67.
2.If i assign a C.Code (let say 1000)thru object F_BKPF_BUKRS to a user,does it mean that,i don't need to assign that C.code to user again for access related to C.code 1000 in the accounting document area.Or is there anything like that, the C.Code access will be coded globally for that user for all C.code related access for FI, MM and SD.
Once you assign the authorization to a company code 1000 it means user has access to this company code across modules. This is subject to the transactions and thier authorization objects attached to them in other modules. Note that all the transactions doesn't perform authorization check for Company code.
3.Is there any T.code,from where i can associate a authorization object with a T.code.
You can use SU24 itself.
Hope it clarifies your queries.
Regards,
Gowrinadh

Field value(s) for object S_SERVICE were not entered

Hi
Whenever I try to generate a profile in PFCG I get an error, that is saying;
... field value(s) for object S_SERVICE were not entered
Number of values could be different but message text is always the same.
The problem is in CRM2007 IDES.
It is regardless if I try to generate for existing role (like SAP_CRM_UIU_MKT_PROFESSIONAL) or for own role
Does anybody know how to solve such issue ?
regards
Rafal

Dear Rafal,
kindly check documentation of customizing node
SAP Customizing Implementation Guide
    Customer Relationship Management
      UI Framework
       Business Roles
         Define Authorization Role
"Make sure that the authorization object S_SERVICE is set to inactive.
An active authorization object S_SERVICE could interrupt the profile
generation."
You have to deactivate the S_SERVICE authorization object in PFCG to
solve the error.
Hope this helps,
Gerhard

How can I limit/control the addition of auth. objects to security roles?

Checking the authorization object S_USER_VAL it seemed that it grants the ability to limit the addition of authorization objects, but I tried using a test ID in sandbox along with a test role, removing the object, creating ranges in order to limit to a certaing type of auth. objects and didn't work. S_USER_AGR will give me access to limit which type of roles I can modify, but I'm looking to restrict the addition of specific security objects to security roles. If anyone knows the answer to this please share! Thanks in advance for your help!!!!
Edited by: Armando Salas on Nov 29, 2011 7:41 PM

Hi Armando,
Try with auth.obj. S_USER_AUT. A suggestion. Search this objects with tcode SU24, for instance, for tcode PFCG and it gives a list with objects.
I hope this helps you
Regards
Eduardo

Table that stores Analysis authorization values

Hi all,
       We generated analysis authorizations for users on Profit centers. In RSECADMIN for each user we see an automatic authorization object being assigned with a name like RSR_000234 so on. We can see the values (profit centers) for this object when we double click on it. I would like to create a list of all users and the assigned profit centers. Can you please tell me if a table is available to get this list.
Thanks,
Ram.

Chetan,
         We are loading authorizations values to 0PROFIT_CTR from ECC and flatfile into the Authorization DSO's and generating authorizations to assing the profit centers to users. I would like to see the profit centers assigned to a user. For example suppose if a user is assigned a particular region. I would like to see all the values of the profit centers assigned to the user from a table rather than going to the hierarchy and getting the list for each region.
        The tables that you specified give the userid and the technical name of the authorization(RSR_000234..) but I would like to see the actual values in the authorization.
      Hope I am clear. Thank you for your assistance.
Ram.

Authorization values to auth object

Similar Messages

Maybe you are looking for