Autorisations : how to live with 0BI_ALL and other analysis object ?

Question

Hello
we have an annoying question.
We went live with 0bi_all in all profiles. Now we are in a production phase where our new users have restrictions (for example 0COST_ELMNT in the finance area).
What should we do ?
- suppress 0BI_ALL and add our new object
- cumulate 0BI_ALL and our new object
Does anyone know how this work ?
We haven't been able to find the right documentation.
Thank you
Fabrice Rigaux

Answer 1

Hi Fabrice,
To answer your question, you will need to suppress 0BI_ALL and add the new object.
It works as follows:
For the same infoobject, the authorisations are considered a union. But for the whole of the authorisation, it's an intersection.
an example to make more sense of this:
AUTH1:
- 0COST_ELEMT = 123456
- 0TCAIPROV = *  (always need this one)
- 0TCAACTVT = 03 (always need this one)
- 0TCAVALID = * (always need this one)
AUTH2:
- 0COST_ELEMT = *
- 0TCAIPROV = CUBE1 
- 0TCAACTVT = 03
- 0TCAVALID = *
You run a query on CUBE1 -> you will have access for all cost elements.
You run a query on CUBE2 -> you will only have access to cost element 123456.
Because 0BI_ALL has * for all infoobjects it will always overrule any other authorisations you assign.
Important note: if you are goning to set up your authorisation for 0COST_ELMNT to be valid for all infocubes, you will also need to add all authorisation-relevant infoobjects in your authorisation definition.
Best way to get the hang of it is to play around with it. In transaction RSECADMIN, you now have a very useful option "Execute as", which allows you to run queries as a testuser and gives you a log of all authorisations checked.
Regards,
Pieter