BW authorizations based on assigned PPM users/roles + inherited roles

Dear experts,
We using PPM 5.0 SP7, and we are having trouble defining authorizations for BW reports.
We would like to use the same authorizations as in PPM business client, so that BI would use/check the authorization from business client.
This check would include:
- users or roles gain access from direct assignment to an item
- users or roles gain access that is inherited in the bucket structure, both structure and classification buckets.
Users would have access to BW reports, but they could see data only from the same structures/classifications or direct assignments that are given to them in PPM business client.
Can we utilize the same authorization methods, or do we need to create and maintain this in another place (BW)?
If needed, how to create similar authorization model to BW?
Kind regards,
Antti Forsell

Hello,
Please see these docs,
[Field Based Authorizations in BW BEx Queries|https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/4753ed83-0e01-0010-e186-f98413f868cb]
[An Expert Guide to new SAP BI Security Features|https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/659fa0a2-0a01-0010-b39c-8f92b19fbfea]
[Advanced Features of SAP BW Reporting Authorizations|https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/1b439590-0201-0010-ea8e-cba686f21f06]
Thanks
Chandran

Similar Messages

Assign mass users to a role by script/code

I want to assign hundreds (maybe thousands) users to a portal role. Is there a sample code/script so I can execute without using Portal UI (user administration)? We currently have WAS 6.4 and EP SPS14 (Java stack).
Thanks,
Yonghua Wang

Hi Yonghua,
you could, as Dominik stated implicitely, write some small portal app to reach your goal on the portal server. The UME API is quite intuitive, the "central" line would be for example
role.addUserMember(someUserOutOfThousands);
see https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/javadocs/nw04/sp12/user management engine - version 4.0/com/sap/security/api/irole.html#addusermember(java.lang.String) for details.
Hope it helps
Detlev

Assign user grop to Role

Hi all,
How can i assign the user group to Role.
Regards
ganesh

Hello Ganesh,
User groups cannot be directly assigned to a role. Only users can be asigned. If I understand correctly then you want to assign a role to a user belonging to a particular group. For this goto SU10 then to Authorization DATA. Give the user group in the filed Group for Authorization ane execute it. You wil get a list of all the users. Select all of them using SELECT ALL option and press the transfer pushbutton. Now you have the list of all users. Press the change button go to roles tab and add the role you want and then save the changes. I hope it solves the issue for you.
Please award points if the answer was useful.
Regards.
Ruchit.

Assign multiple users to a single role?

I have a process where I need to assign multiple users to a given role. In this case, I want one of the users to 'win', and take ownership of the process step. (Imagine the situation where one user is the primary processor, the other is a backup; if the primary is out of the office, i want the secondary to have the ability to pick up the request).
I've tried to assign multiple users to the same process role as follows:
rtm.addRuntimeDefinedUserToRole(prInstance, roleName, user, userContext );
but the process is only assigned to a single user - from my testing, it seems to be assigned to the first user specified using the above api call.
Is there a way to do this programatically?

Hi,
Can you please advice how you did this?
I am using Visual composer as my UI. But with looks like i am not able to pass a structure from VC so i can map it to "Assign Users to Process role" CO.
Per my understanding I need to write a program using GPI API which populates the User_List structure of the above CO. But after that i am not sure how to use this CO. Can anyone give me detailed instructions on how to use the "Assign Users to Process role" CO to assign multiple users to the role dynamicallly?
Regards,
Kumar.

EP Role assignment to User.

Hi,
I have recently installed EP. When i assigned a New role Created (role i created) to a new User, The Contents assigned to that role is not getting displayed. But, when i also assign a super admin role to the user, the content of new role is getting displayed along with the content of super admin role.
Infact, when i assign content administration role to the user, it is not geting displayed when i log in as a new user to which it is assigned. however, when i assign the super admin role to the user, the contents of content admin role is getting displayed.
Is there any Post EP Installation setting required to solve this issue.
Please help me in solving this issue?

Hello Shabir,
Initially all the contents can be viewed only if u have super_admin role. If u want to give access of any folder to a particular user, just open the permission editor of the folder and assign any particular role (say content_admin role) and select the end user checkbox.
Now assign the user the same role u have specified in the permission editor of the folder. Then the user can view that folder.
This will solve ur problem.
Regards
Deb
[Reward points for helpful answers]

EP role assignment to user id's deleted

Hi,
We have Windows Active directory server and the id's created there will be created in EP as well. (or both share the same db).
Our Portal team will assign the roles to the newly created userid's using IMPORT function.
1. Nearly we have 15k users. and today we have used the import functionality to assign roles to the 60 newly created users.
2. The role assignment for 14k users which share the same domain(LDAP1) deleted.
3. The role assignment for other users who use other domain(LDAP2) exists.
What would be the root cause of the problem?
Is it possible to take System log from EP system -> system admin ? or we need to ask the basis admin to retrieve issue log?
Thanks!
Dhiyu

Hello Shabir,
Initially all the contents can be viewed only if u have super_admin role. If u want to give access of any folder to a particular user, just open the permission editor of the folder and assign any particular role (say content_admin role) and select the end user checkbox.
Now assign the user the same role u have specified in the permission editor of the folder. Then the user can view that folder.
This will solve ur problem.
Regards
Deb
[Reward points for helpful answers]

Abap+java abap-user and portal-role PROBLEM?? help

We have the ABAP+java add-on install.
The UME is by default ABAP engine.
From Portal:
1 I create a portal user, it ALWAYS creates ABAP user in ABAP engine.
2. I create a portal role, it creates a role in the Portal.
3. When I assign the user this portal role,
having worksets and pages,
I get no pages or worksets shown in the portal page as soon
user logs in.
Can you help configure this so that I could see the pages and iviews inside this workset when user logs in.
Thanks a lot.

Hi Mike,
You did right,
Just check the Entry Point Property of your iView, page and workset to YES
there are two radio buttons yes and no select the yes one,
you can see your pages afte rlogin with the new user.
Regards
Abhimanyu L

GP: Assigning multiple users on one action

There is a need to appoint more than one user to one action. If one user is not answered, the process should not proceed to the next step.

Refer this.
/people/berndt.woerner/blog/2007/09/19/different-ways-to-model-dynamical-assignment-of-user-to-process-roles-using-composition-tool-guided-procedures--part-1
If you implement by parallel dynamic block way one action is assigned to multple users with different instances.
As it is in parallel dynamic block untill all the users did not complete the their own action, process will not move fwd. hemce this will solve your problem.
Regards,
Pratik khandelwal
Edited by: Pratik Khandelwal on May 19, 2009 9:22 AM

How to find workflow and assign a user to workflow

Hi Gurus,
How to find the existing workflows, and assign a user to a role.
<REMOVED BY MODERATOR>
B S B
Edited by: Alvaro Tejada Galindo on Jan 24, 2008 11:17 AM

Goto Tcode PFTC.
Select the task type as Workflow and serach.
Naveen.

How to create new user and How can i assign end user roles

Hi,
I am new to SAP, please explain how to create end users and their roles
Thanks
ravi

Hi,
Roles are decided by IT managers. Suppose if Persons who are working in shopfloor or production side
give authorization to Production order create , change and Confirm like that etc
1. In role maintenance (transaction PFCG), choose the Authorizations tab page.
2. To change the authorization data for the transactions assigned to the role, choose Change Authorization Data or Expert Mode for Profile Generation. Otherwise, a dialog box appears in expert mode (see Regenerating an Authorization Profile After Changes).
Please take telp from Basis person also refer this link,
http://help.sap.com/saphelp_46c/helpdata/EN/52/6714a9439b11d1896f0000e8322d00/frameset.htm
Thanks

Assign SQ03 Abap Query User Group to role

Please advise how to assign SQ03 Abap Query User Group to a role. Thanks.
Moderator message: please do more research before asking.
[Rules of engagement|http://wiki.sdn.sap.com/wiki/display/HOME/RulesofEngagement]
[Asking Good Questions in the Forums to get Good Answers|/people/rob.burbank/blog/2010/05/12/asking-good-questions-in-the-forums-to-get-good-answers]
Edited by: Thomas Zloch on May 12, 2011 5:40 PM

Hello Sunil,
The problem is that I have hundreds of users to maintain user groups.
found out that it is possible to assign user group to role and role to user groups. implementing hr authorization with in-direct assignment of auth. So if I could use sq10, user groups could also be link to position in the org chart.
sq10 does allow you to assign a user group to a role but when you assign the role to a user and the user runs a query, it reports that no user group has been assigned.
Suspect that there must be a parameter or switch that is not turned on
Regards

Role assignment to users (Change documents)

Hi
I was looking through the change documents for users and here i came across "START_REPORT" under the Transaction column along with SU01 and PFCG. I was not quite sure about what this "STATUS_REPORT" was all about. I was wondering if this is a program. It certainly is not a batch coz we dont run batches here. I am trying to track down this change to the user but STATUS_REPORT is leading me nowhere....
Any ideas?
ravi

Hi ravi
Could you please explain the problem once more ?
If you want to see the changes in the profiles of the user(which i take as one example of change documents) then you can use the transaction SUIM and there it'll give you options for change documents as below:
1) For users
2) For role assignment
3) For Roles
4) For profiles
5) For authorizations
and then you can choose the option you want.
If I can help in some other way then kindly let me know.
Cheers

Implementing authorization based on database roles

Hi,
I am trying to implement authorization in my sample jdeveloper application.
I have the list of users stored in LDAP and my database table contains the roles for those users.
Now how can I get the roles from the database table and implement authorization based on the roles?
I am using jdev 11 and weblogic 10.3
Thanks

Hi,
Checkout [this post|http://forums.oracle.com/forums/thread.jspa?threadID=928304]
Sireesha

Which authorizations are required for assigning a query to a role?

Hi everybody,
we try to set up some roles for "reporting power users". These guys should be alble to define new queries using BEx (works fine) and also should be able to assign these new defined queries to a role, so other users can use these roles.
The idea is simple, but we're searching for the right authorization object (or - as i suppose - set of authorization objects) that enables the user to assign a query to a role (using that "enter to a role" button in the open / save dialog).
At the moment, the user can user that button, and the role, he should the query assigned to is shown. After selecting the role and clicking button "create" it take some seconds and a message "error when saving. entry has not been created" is shown.
Obviously, there is a problem with writing the role (or adding the new information to that role).
So, could anyone help me and provide me with a list of authorization objects that are required.
Thanks in advance,
Alfred

S_RFC
S_TCODE
S_USER_GRP
S_BDS_D
S_OD_SEND
S_RS_AUTH
S_RS_BCS
S_RS_COMP
S_RS_COMP1
S_RS_FOLD
S_RS_ICUBE
S_RS_MPRO
The above mentioned authorization objects are enough to add in the role and required for the accessing a query.
particularly, S_RS_COMP, S_RS_COMP1, S_RS_MPRO, S_RS_ICUBE are the most important auth objects which are directly getting involved in authorization of a query in a role.
SO, you have to assign the respective info area, info cube and info providers names in these auth objects.
The same scenario , i am using in my project to give access to the queries in all the areas for my end users.
The values and access/authorizations restrictions is up to your project requirement.
Hope this would help you.

CUP 5.3 sp7.1 - 049:Role assignment to user not executed completely

Hello Experts,
Message received in audit information:
049:Role assignment to user not executed completely
Can anyone help me with why I am receiving this message?
=[],id=6129,reqNo=201000139,actionDate=Tue Oct 19 10:40:27 EDT 2010,action=ROLE_PROVISIONING_FAILED,userId=U03776,path=,stage=,actionValue=PR4-300,description=049:Role assignment to user U10025 not executed

Hi,
Check that the connector that you have created is working fine and also the user ID that you are using in the backend system is within the valditiy date and all the required authorizations.
Use remote login and ensure that the user can login with out any issues and has all the required authorizations.
Rgds,
Raghu

BW authorizations based on assigned PPM users/roles + inherited roles

Similar Messages

Maybe you are looking for