Authorizations & Roles in ISA

Question

Hi,
FIRST PART - USER ADMINISTRATION
     I have a requirement where in I have to add a new authoization (fo providing "User is approver" role) . What are all the necessary things to be done to add a new role/authorization to pop up in role list while creating a new user?
What is to be added in Customizingr3.xml and INITCUST.xml.
Does ISA_USER_CREATE or any other RFC call which is made while creating a user validates these customized role?
If Yes, then i will be thrown some backend exception which i am anticipating !!
If NO, what is that i need to do or ask ABAP folks here to check in backend and to implement some kind of validation on all the Roles that are getting assigned while creating a user.
SECOND PART - B2B Shopping Site
Once a newly created User logs into Shopping site, from where are these roles/authorizations of that user being accessed?
I mean to say, how can i check for User specific settings(permissions,auth,role). Please advise me with the RFC / BusinessObjects used to find User specific data.

Answer 1

Hi Dev,
            We are trying to build a B2B solution using ISA. I may be very dumb in my questions, but please please try to make some point out of my questions.
We are trying to look at all the files under R3 and not using anything from CRM (in terms of folder structure and files from OOB code of ISA). so i think we are using SAP-ERP as per your previous reply. I hope i make some sense. We are building application on version 7.0
Now coming to procedure of creating a user from User Administration, i do have the idea of what is being mentioned in your steps.
Now in the "Assigned Roles" table displayed in "Create New User" screen, i need to add a new role (like Can Approve Orders - means user is an approver). Now in order to create a new role with new description (in addition to Full b2b, view only orders et.,) what are all the necessary things i need to do?
By modifying the CustomizingR3.xml and INITCUST.xml, i was able to get another new row for role/description in "Customizing" link. When i add some new role/description, they get populated in the "create new user" screen. Now when i save all the details assigning the new role, a new user is created with new role assigned.
But if we observe, Full B2B authorization for instance, when we assign them, in the backend, few sub roles like :
SAP_ISA_B2B_FULL     SAP_ISA_SUB_BILLING_VIEW
                                     SAP_ISA_SUB_CATDISPLAY
                                     SAP_ISA_SUB_CATPRICE
                                    SAP_ISA_SUB_CONTRACT_UI
                                     SAP_ISA_SUB_CUSTOMER_READ
                                     SAP_ISA_SUB_ORDER_MAINTAIN
                                     SAP_ISA_SUB_QUOTATION_UI
                                     SAP_ISA_SUB_QUOT_DISPLAY_UI
                                     SAP_ISA_SUB_RFC
                                      SAP_ISA_SUB_TEMPLATE_MAINTAIN
In similar fashion, i need to create new authorization SAP_ISA_B2B_APPROVE_ORDERS. so what is all that i need to do? just modifying the xmls, adding this auth in "customizing" link and assigning them in create user screen are enough?
If this process is enough, then i need to know, how can we validate such a new role in backend when a new user is created. Should i ask the ABAP folks here to create a new auth with same string and assign some SUB roles which in future will help me authenticate approval flow?
Finally, how are the roles visible in frontend while user creation and roles in sap backend validated/mapped against eachother?
I have put forward what all i could. Please do guide me.
Thanks,
Abhiram