Company Code Restrictions

Hi
We have Consultants with SAP_ALL & SAP_NEW on the system but no Role is assigned to them.
We need to restrict some of these consultants to certain Company Codes.
Please can anybody give me the procedure on How we can restrict them to Certain Company Codes without taking SAP_ALL away?
I know nobody is allowed to have SAP_ALL but this is the setup and I need to restrict access as is.
Please help urgently

> Please can anybody give me the procedure on How we can restrict them to Certain Company Codes without taking SAP_ALL away?
SAP_ALL is "all authorizations for the system". How would you restrict "all authorizations for the system" without removing it?
The "quick and dirty" way as mentioned by Auke is very insecure. Eg: They could display the tables directly, even if you restrict all BUKRS fields. Or, just give themselves SAP_ALL back again. There will be many more ways for them to bypass your security.
Take a look at some of the other posts on restricting SAP_ALL here at SDN. Keep an eye out for the expression "Make them do their job by giving you the transactions and authorizations which they do need".
Cheers,
Julius

Similar Messages

Company code restriction for dashboard and webi reports in BOBJ

Hi Friends,
We have a requirment where we need to restrict user on company code level in bobj.
we have some dashborads and webi reports which need to be restricted at company code level, hence i have created a role in BI and restricted the queries (bex queries) on company code level and same role and user i have imported in BOBJ.
Now i can see the role and user in BOBJ and also i can login to BILAUNCH PAD with authentication as SAP But unable to run the webi reports and dashboard hence i have added those reports to this user in bobj and now i can run the reports, but restriction is not working.
In BI I am able to restrict user but in bobj its not restricting. kindly let me know if i am missing anything?
We are having BO 4.0 SP6.
Thanks
Basis

Hi Saurabh,
In BI its wokring perfectly fine.
I can run the query for specific company code and data is being populated as the respective compay code.
I have also configure SSO between BI & BO using below link
http://wiki.scn.sap.com/wiki/display/BOBJ/How+to+setup+SSO+against+SAP+BW+with+SAP+BO+BI4.0+Common+Semantic+Layer+%28UNX%29+or+BICS
but when i am trying to create a olap connection in IDT with SSO connection test is getting failed with belwo error.
com.businessobjects.mds.olap.OlapException: [Internal] SSO token or User password is empty.
I checked STS is already there in APS .
Thanks
Basis

Company Code restriction at Financial statement Version

Hi All,
We have a requirement from business for company code creation, and all elements will be same as existing company code like CHOA, FSV, PPV,FYV,CO Area etc, however my client create this company code fro recalculation of Accural amount, so they want that whatever the document posted should not be reflect to company's corporate books means financial statemen. As iam very new iin this requirement, so request you to kindly suggest that is it possible in SAP. IF yes then how do we restrict company code at Financial statement version.
Thank you for your support in advance.
Regards,
Jamuna

Hi Gaurav,
Thanks for your response, it would be great if you can detailing the same, how do we exclude this field, do i need to take any ABAPER help, and also if this field get excluded, so will business be able to execute this report at company code level by selecting another company code associated with respective COA.
Thanks,
Jamuna

Creation of SC or POs based on the Company Code restriction

Dear All,
I am abaper and I am new to SRM. Ours is SRM 4.0 using Extended Classic Scenario
we got one requirement that one company ex: SE04 should be blocked for further ordering of SC and POs. i.e. when creating any SC or PO they dont want to use 'SE04'. If selected it should throw an error message "Company Code SE04 can't be used for Procurement".
I wrote code in BBP_DOC_CHECK_BADI-BBP_DOC_CHECK like this..
IF flt_val = 'BUS2121'. "When create SC
LOOP AT lt_item INTO ls_item WHERE be_co_code = 'SE04'
                                    AND del_ind <> 'X'.
    CLEAR ls_message.
    ls_message-msgty   = 'E'.
    ls_message-msgid   = 'BBP_PU'.
    ls_message-msgno   = '001'.
    ls_message-msgv1   = text-001.
    APPEND ls_message TO et_messages.
ENDLOOP.
endif.
and for po also BUS2201 we done the same.
it is working fine for creation of SC and POS, but when we are chaning old SC or POs for 'SE04' then also error is coming "Company Code SE04 can't be used for Procurement".
When I put break point in BBP_DOC_CHECK_BADI-BBP_DOC_CHECK it is not stopping there also.
Please guide me for this..
Thanks,
Kiran Madineni

I written code like this: now working for old SC and POs.
IF flt_val = 'BUS2121'. "When create SC
    IF cs_header-created_at >= '20110110000000'.
*if sy-title = 'Shop' and ( sy-tcode = 'BBPSC01' or sy-tcode = 'BBPSC02' or sy-tcode = 'BBPSC03' ).
      IF sy-tcode = 'BBPSC01' OR sy-tcode = 'BBPSC02' OR sy-tcode = 'BBPSC03'
        OR ( sy-tcode = 'BBPSC04' AND sy-title = 'Change Shopping Cart' ).
        LOOP AT lt_item INTO ls_item WHERE be_co_code = 'SE04'
                                          AND del_ind <> 'X'.
          CLEAR ls_message.
          ls_message-msgty   = 'E'.
          ls_message-msgid   = 'BBP_PU'.
          ls_message-msgno   = '001'.
          ls_message-msgv1   = text-001.
          APPEND ls_message TO et_messages.
        ENDLOOP.
      ENDIF.
    ENDIF.
ENDIF.
For POS BUS2201
Thanks
Kiran.

Restrict proforma invoice without doing pgi in STO(same company code)

Hi Gurus',
I am creating STO (same company code) from Exciseable Plant to Non Exciseable Plant.
For that i am creating ME21N> VL10B>VL02N(PICKING & PGI)>VF01(Proforma Invoice)>J1IIN>
Now problem arises ---
I am able to create Proforma Invoice without doing PGI.
Now i want to restrict proforma invoice creation with out doing PGI.
What config require for this.
Regards
Santanu

Check your copy controls fromT. Code: VTFL - Copy-Control Settings b/w Delivery-to-Pro forma say, F8 -- LF
Settings at Header for the combination equal copying requirements 003 Header/dlv.-related and at Item category copying requirements 004 Deliv-related item

F.01 restriction based on Company Code

Hi Team,
We wants to restrict the use of F.01 tcode based on the company code but i don't see any object where i can restrict this.
Please provide any solution for this
Regards
Narinder

Hi Narinder/V A Joshi
Can transaction FC10N be used instead?
Looking at SE93 definitions, F.01 uses program RFBILA00 and FC10N uses program RFBILA00N. It looks like FC10N is the new version (I thought a lot of the F.* transactions were replaced).
Can you confirm with functional team if the FC10N transaction should be used instead of F.01? You should then be able to restrict on object F_BKPF_BUK.
Regards
Colleen

Automatic restriction of currency based on company code

Hi,
I have a requirement where in the layout I need to restrict the header currency based on the company code chosen. How is this possible?
Currency is an attribute of company code and both company code and currency are in the header but users dont want to choose currency and only want to select company code from the drop down.
Now my problem is without limiting the header to a single currency the layout cannot be opened.
Any help would be appreciated.
Thanks

Hi,
if it is not working with the table as Sunil describes (I never tried this) maybe the solution for your problem is reading the value of the variable for company code with the function module Z_VARIABLE_GET_DETAIL as describes in the howTo-paper "Variables of type exit"
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/documents/a1-8-4/how%20to%20variables%20of%20type%20exit.pdf
It works, in case of troubles, dont use the buffer.
Greetings,
Christian

Restrict PO creation for multiple plants for same company code

Hi Gurus,
We want to restrict PO creation for multiple plants in the same company code. Based on Standard SAP settings for Purchasing organization assignment with multiple Plant and multiple Plant assignment with single company code, this is happening. Is there a way that we can restrict by doing some customization change.
Any thoughts or ideas will be highly appreciating.
Thanks and Best regards,
Karun Kumar

Hi,
Said functionality is not available in SAP standard.
To avoid the same ,i can suggest implement release strategy for PO,and then higher authority / commercial team can check created PO,if multiple plants available in single po then they have the option of rejection for the same.
Or else check BADI-ME_PROCESS_PO_CUST,take the help from abapor and apply the restriction to select multiple plant in PO.
Hope this will resolve your query,
Thanks & Regards,
Sandesh Sawant

Restrict PR/PO/GR for a particular company code from particular date

Hi Experts
How we can restrict PR/PO/GR for a particular company code from a particular date?
I know PR is not directly linked with company code
PO can be restricted by deactivating the assignment between company code & plant
GR- we can use posting period option.?
Suggest me the best solution for the above requirment.
Thanks/karthik

hi
Obvoiyusly , you can stop the company code posting by not activating the month end closing of periods (MMPV) in MM and similarly in FI ( OB52).
By removing the assignment you can stop PO creation for the company code but you need to ensure that all the old, un-finished PO/SA and other related activities are taken care off before that.
Regards

Restricting few FI T-codes based on company code

I was able to restrict some FI transactions based on the Company code by giving relevant values for Organization levels. However I could not restrict the following three T-codes:
FBV3                      Display
F.81                      Reverse Accrual/Deferral Document
S_ALR_87012342     Gaps in Document Number Assignment
Pls suggest.

Vamsi,
I think you do not want to allow to see the some FI user these Tcodes data for specific companies.
I think you have assigned more then one role to user and mentined 3 Tcodes are coming from multiple roles and the user buffer is having multiple entry for the . If this is the case please keep these Tcodes in one role only and restrict the user only in F_BKPF_BUK BUKRS.
If only one role is assigned to you then assigned the required company codes at Orgranisation Level only and it will populated at Authorisation Object F_BKPF_BUK BUKRS for company codes.
I would advise you not to modify the SAP standard object in SU24 because it can distrub the Standard Auth. Object.
Hope this will help.
Lokendra

Restriction of Tcode SQ01 based on Company code

We are running one customized query using Tcode SQ01. We need to restrict Tcode SQ01 in company code level. We have checked about authorization object in st01. But there is no check of authorization object. Can anybody help to restrict SQ01 based on company code level?
Regards
Auroshikha

Hi Auroshikha,
Itu2019s very easy to maintain authorization in your Infoset Query report. I got and implemented similar requirement i.e. restriction /authorization as per company code.
You need to use authority check for authorization object P_ORGIN in your infoset.
Please follow the bellow steps:
-->Go to SQ02, Enter your Infoset name and click on Change button.
-->Click on 'Code' (Shift+F8) icon dispalyed on application toolbar, you will be moved to Code Section of Infoset that lists different events.
-->Choose Record Processing event from code section.
-->Write the following code in 'Record processing' event of your Infoset.
AUTHORITY-CHECK OBJECT 'P_ORGIN'
*ID 'INFTY' FIELD '*'
*ID 'SUBTY' FIELD '*'
ID 'AUTHC' FIELD 'R' "read
ID 'PERSA' FIELD P0001-WERKS
*ID 'PERSG' FIELD DUMMY
*ID 'PERSK' FIELD DUMMY
*ID 'VDSK1' FIELD DUMMY.
CHECK Sy-SUBRC EQ 0.
Note: PERSA field used in this Authorization object plays an importan role , if you are in different module other that HR , then pass here table_name-companycode_field
-->Genetare Infoset
-->Go to SQ01 (in a new session) , Click on exeute or 'Test button' to check authorization is working for report
Let me know if you need any more details.
Thank you.
Regards,
Dinesh Tiwari

Search Help "PREM" Restriction on Company Code

Dear Friends,
I have modified the screen SAPLKACB 0002. I HAVE APPLIED SEARCH HELP "PREM" ON COBL-PERNR(Personnel No).Now if u go to F-02 Transaction.We have a Company Code entered Say : 2200.
Now if we fill in the mandatory fields we go 2 next screen there we have personnel no field where i have
attached F4(Search Help).
Now i need 2 restrict the search help according to the company code.
if the Company Code i enter say 2100 and hIt enter.it should give me some king of msg that
the company code 2100 does not match the (F-02 Transaction Company Code:2200).
Please Guide as 2 how 2 Accomplish this.
Regards,
Essam

Hi if you need to do any thing to search help u need to create a search help exit for it.
check my [blog|https://wiki.sdn.sap.com/wiki/x/du0] on this code.

Any option to restrict SE16 record level access based on company code?

Hi All,
I have a requirement to restrict record level access in SE16 based on company code.
Our SAP system has two company codes. The requirement is that users of one company code should not be able to see records of other company code in SE16.
Is it possible through some exits/badis/other methods?
Thanks in advance.
Regards,
Arun Mohan

You could write a small front end that accepts the company code, applies custom authorization code for each value and retains or removes, then calls the transaction and enters the selections the user requested and that your authorization check resulting in "passing".... Of course, you'd have to block those users from "pure" SE16... I once worked in situation similar, users in one country couldn't see USA data, etc. I think someone wrote an entire new program, called by ZSE16, for that.

How to restrict user to process own company code data in z program

Hi All,
I have this issue. in asset management I would like to restrict user to process its own company data.
for example A who works in company 0123 only can process comp code 0123 data whereas X who is manager can process all company code data.
In the abap program, how can i achive this? by authority object? if yes what asset management authority object to use?
i have company code in selection screen. so may i know what method i can achive so that A can only execute co 0123 whereas X can do for all company code.
thanks

Hi,
One way would be:
For all persons for whom you would like to 'control' the access to a specific company, SU01-->Parameters--->Give some parameter ID say XXX, & in PArameter Value key in the compnay code whose data it can process.
Please note that this is only one time process which has to be carried out for all the users. Then in your z-program in SELECTIO-SCREEN OUTPUT use GET PARAMETER ID 'XXX" Field w_value. If GET PARAMETER ID returns su-subrc = 0 then move w_value to your company code on the selection screen. Then Use LOOP AT SCREEN & make SCREEN-INPUT = '0' for company code so that company code will be displayed but protected thus not allowing the user to change the company code.
I hope this helps,
Regards
Raju Chitale

Restrict users with the same company code

Hi All,
I have developed editable ALV which allows users to edit and delete records and save those changes in database.
Input is Company Code , Document Number and Fiscal Year.
Now I want to restrict multiple users trying to edit/delete records with same company code at a same time.
Example:
User A is editing records for company code 1250.
If User B tries to access for same company code 1250 at the same time, it should return an
error message saying “Table currently locked by User A”.
and also want to restrict the records if multiple users are trying to edit/delete the same record at
a same time,I should give an error message.
Thanks,
Arpita

First perform some search on Lock Concept in online help (ABAP Programming (BC-ABA), The ABAP Programming Language, Saving Data Externally, Data Consistency, The SAP Lock Concept or The SAP Lock Concept (BC-CST-EQ), SAP Lock Concept)
Then use or create thru SE11 a lock object for your table (keys must start with mandt + Bukrs, to not interfere with standard locks, e.g. EFBKPF, you may create your own z-structure and an associated lock object) and before reading data check the company code is not yet locked with ENQUEUE FM, release the lock is either implicit at end of transaction or triggered thru DEQUEUE FM or COMMIT/ROLLBACK WORK (depends also on your choice on _SCOPE Parameter value).
Regards,
Raymond

Company Code Restrictions

Similar Messages

Maybe you are looking for