BI Security Implementation and restrictions at Infocube levels

Question

Dear all,
I am trying to update myself on BI security and practical implementations. I read expert guide and other relevant documentation. We have BW security integrated with CRM and Portal.
Please explain or provide me some direction in understanding how BI security works at key figure level.
<b>Is it necessary to set the following InfoObjects as “authorization-relevant” . Is it MANDATORY to make the following settings as "Authorization-Relevant" before we start the BI Security
     0TCAACTVT
     0TCAIPROV
     0TCAVALID
     0TCAKYFNM</b>
and
     Add 0TCAIFAREA as an external hierarchy characteristic to 0INFOPROV
When I changed above infoobjects to Authorization relevant, BI Portal Users are complaining that they have Access issues. I have to change this setting back.
Can someone explain me the implication of making the above objects as Authorization Relevant. What making these objects, Do I need to complete some steps to make it work.
All users have 0BI_ALL object defined in S_RS_AUTH. I don't know how 0BI_ALL works for users.
I greatly appreciate if anyone can explain how I can achieve the following scenarios:-
1. How Can I restrict user access to all the Characteristics and Key Figures of Infocube ZEN_XXX1 except for Characteristic 0CRM_SALORG.
2. How can I restrict User access to all the Characteristics and Key Figures of Infocube ZEN_XXX1 except for Characteristic 0CRM_SALORG (Sales Organization CRM) and Key Figure ZVOLSU.
3. How can I restrict User Access to all Infocubes EXCEPT ZEN_T001 infocube.
I tried using PFCG but it does not work. 3rd scenario worked fine. I really need help in resolving scenario 1 and 2.
please eMail me if I need to go thru any other step-by-step procedure.
I am trying my best to resolve and at the same time reading other documentation and experimentation.
Waiting for a Positive Reply
Kumar

Answer 1

Hello Kumar,
<b>here are my statements:</b>> Is it necessary to set the following InfoObjects
> as “authorization-relevant” . Is it MANDATORY to make
> the following settings as "Authorization-Relevant"
> before we start the BI Security
>      0TCAACTVT
>      0TCAIPROV
>      0TCAVALID
>      0TCAKYFNM
<b>Be careful when checking 0TCAKYFNM. If you do so EVERY user will be influenced because reporting is based on key figures. But as you need to restrict to certain key figures you will have to check 0TCAKYFNM  authorization relevant. As a consequence every user will need key figure authorizations.</b>> 
> and
> Add 0TCAIFAREA as an external hierarchy
> characteristic to 0INFOPROV
<b>This is not mandatory but may be helpful if you want to restrict authorizations on InfoArea Level.</b>
> When I changed above infoobjects to Authorization
> relevant, BI Portal Users are complaining that they
> have Access issues. I have to change this setting
> back.
<b>They might complain because they do not have authorizations for any key figure.As I explained above checking this object has impact on every query because every query contains key figures and when you check 0TCAKYFNM users will need the authorizations for this object.</b> >
> Can someone explain me the implication of making the
> above objects as Authorization Relevant. What making
> these objects, Do I need to complete some steps to
> make it work.
>
> All users have 0BI_ALL object defined in S_RS_AUTH. I
> don't know how 0BI_ALL works for users.
<b>0BI_ALL is SAP_ALL on analysis level - you must not assign this to your reporting users!</b>>
> I greatly appreciate if anyone can explain how I can
> achieve the following scenarios:-
>
> 1. How Can I restrict user access to all the
> Characteristics and Key Figures of Infocube ZEN_XXX1
> except for Characteristic 0CRM_SALORG.
<b>Figure out if characteristic 0CRM_SALORG has to be marked as authorization relevant or not. If not - there's nothing to do. If yes - you will have to setup analysis authorizations.
Create an analysis authorization in RSECADMIN like:
ZEN_XXX1_ALL
0CRM_SALORG  = *
specify your other auth. relevant characteristics and enter ":" as values
0TCAIPROV = ZEN_XXX1
0TCAACTVT = 03
0TCAVALID = *
Do not forget to allow authorizations for these auth. relevant characteristics in your other infoproviders (where applicable).
Assign the authorization to the users in RSU01 or create a role containing S_RS_AUTH with the analysis auth. as value.
</b>
>
> 2. How can I restrict User access to all the
> Characteristics and Key Figures of Infocube ZEN_XXX1
> except for Characteristic 0CRM_SALORG (Sales
> Organization CRM) and Key Figure ZVOLSU.
<b>Create an analysis authorization in RSECADMIN like:
ZEN_XXX1_KEY
0CRM_SALORG  = CRM
specify your other auth. relevant characteristics and enter ":" as values
0TCAIPROV = ZEN_XXX1
0TCAACTVT = 03
0TCAVALID = *
0TCAKYFNM = ZVOLSU
And also do not forget to allow authorizations for these auth. relevant characteristics and all key figures in your other infoproviders.
Assign the authorization to the users in RSU01 or create a role containing S_RS_AUTH with the analysis auth. as value.</b>
> 3. How can I restrict User Access to all Infocubes
> EXCEPT ZEN_T001 infocube.
<b>Enter in auth object (PFCG) S_RS_COMP and S_RS_COMP1 your cube ZEN_T001 in field RSINFOCUBE,  RSZCOMPTP =  REP, ACTVT =  16
</b>
>
> I tried using PFCG but it does not work.
<b>Why? What was the problem? Keep in mind that you always will need the three special dimensions since BI 7.0</b>
3rd scenario
> worked fine. I really need help in resolving scenario
> 1 and 2.
>
> please eMail me if I need to go thru any other
> step-by-step procedure.
>
> I am trying my best to resolve and at the same time
> reading other documentation and experimentation.
>
> Waiting for a Positive Reply
>
> Kumar