BW Analysis Authorization Problem when no selection is done

Question

Hi Everybody,
I am facing the following problem with the implemented authorization concept.
We have marked 2 IOs as Authorization relevant: company and costcenter. We have defined an authorization object where the values are assigned through two variables $ZCompany and $ZCostcenter. The values are picked up from 2 Ztables where the User/Usergroup/Values assignement is done. Eveything seems to work fine.
We have a problem when using an optional variable built on Company or Costcenter in our queries and no selection is done.
If no selection is done, the variables ZCompay and ZCostcenter both are given values equals *. It si the same as every value. Since the user ZTESTUSER is authorized only for some comapnies and some costcenters,  the match between the * selection and the authorization set is not sucessful and the user doesn´t get any authorization. this is what we can when executing the display error log:
Following Set Is Checked  Comparison with Following Authorized Set  Result  Remaining Set 
Characteristic  Content in SQL Format 
0TCAACTVT
ZIFCM004
ZIFCM014
0TCAACTVT = '03'
AND ZIFCM004 LIKE *
AND ZIFCM014 LIKE *
Characteristic  Content in SQL Format 
0TCAACTVT  I EQ 03
ZIFCM004  I EQ $Z1PME009
ZIFCM014  I EQ $Z1PME004
Partially or Fully Authorized (Intersection)   Characteristic  Content in SQL Format 
0TCAACTVT
ZIFCM004
ZIFCM014
NOT ZIFCM004 IN ('0012','0015')
AND 0TCAACTVT = '03'
OR ZIFCM004 IN ('0012','0015')
AND NOT ZIFCM014 IN ('00000000000000012100','00000000000000012300')
AND 0TCAACTVT = '03'
Value selection partially authorized. Check of remainder at end
Following Set Is Checked  Comparison with Following Authorized Set  Result  Remaining Set 
Characteristic  Content in SQL Format 
0TCAACTVT
ZIFCM004
ZIFCM014
NOT ZIFCM004 IN ('0012','0015')
AND 0TCAACTVT = '03'
OR ZIFCM004 IN ('0012','0015')
AND NOT ZIFCM014 IN ('00000000000000012100','00000000000000012300')
AND 0TCAACTVT = '03'
Characteristic  Content in SQL Format 
0TCAACTVT  I EQ 03
ZIFCM004  I EQ $Z1PME009
ZIFCM014  I EQ $Z1PME004
Not Authorized   
What i don´t really understand is why the user doesn´t get any authorization only for the values subset for which he is authorized for. Is that normal according to your experience?
How can we get rid of it obtaining that for such selection the user gets authorizations for the subset?
Thanks in advance
Best regards
Enrico
Edited by: Dottblabla on May 3, 2010 12:13 PM

Answer 1

Hi,
thank you both for the answers.
Since the user is authorized for some certain values rappresenting a subset of * (all values) I dont really understand why he receives an error message as if he hasn´t any authorization at all. According to my logic, a partial dispaly of the data should be possible.. according to my logic, I repeat
Using a mandatory variable would force the user to give a value. The problem is that we have users who are authorized for a large number of costcenters. In this case the best solution would be to define the mandatory variable as a selection option, allowing the user to define intervals of values as well. BUT in this case we would have the same problem described above as soon as the user pick up an interval of values containing also single costcenters for which he has no authorization. I hope, it is clear what i mean.
Using an Authorization variable has the only charme that we get a kind of preselection of values. If the user wants to modify the selection and to define an interval, then we face the same issue again.
It seems to me that BW Authorization concept doesn´t work with "subset" of values. Am i right? Any suggestion?
Best regards
Enrico