Cost Center Authorization

Dear Friends / Experts
We have around 10 HR (BW/BO) reports. All are woking fine. Now the users wants to restrict the report based on cost center.
Hence, I have created one DSO with relevent information and extracted the data from ECC ( Used id, Cost Center belonging, Etc....). Created one customer exit variable and lookedup this used cost center data in CMOD. This is perfectly working.
My Doubts
1) This logic no where related with authorization. Do i still need to consider authorization object and handle further ?
2) If the Logged in user not available in the DSO, i am not able to edit the query in BO-Webi .
Can anybody advise ?. Good advise awarded with points.
Regards
Saravanan Raju

1) This logic no where related with authorization. Do i still need to consider authorization object and handle further ?
The concept of authorization is only similar, instead of a DSO, you use a Z*COST time-dependent authorization-relavent IObject & start to set the time-intervals for access. I assume the DSO concept, although is a quick fix is not a long term solution, as there needs to be loads, corrections at irregular time intervals & this needs to reflect on the BEx. This holds okay for lesser # of users, but you might never estimate the size, as the business would consider adding more in months to come. As rightly said, you need not have an authoriztion object to handle, but if you make cost center object's customer exit to refer this using a SSO-details (like sy-uname), this will restrict entries & authorization based on this field in your BEx. But still you need to work on the DSO concept & try to migrate towards a authroization-releavant IOBject for good sakes, as there is a possiblity the data is exposed -or- completely not avalialbe even for testing & you need to add the same set of ccenters repeatedly for all users again & again, month-on-month, issues like that.
2) If the Logged in user not available in the DSO, i am not able to edit the query in BO-Webi .
Yes, as stated above, this is the drawbacks in this model. Hope it helps.

Similar Messages

How to control cost center authorization when do ABSO/ABAA

Dear :
As our system organization structure is with mutiple profit center and
cost centers, in order to avoid processing TCODE ABSO/ABAA with wrong
input, we want to make authorization check with cost centers, as there
is no standard authorization check and control in TCODE ABSO/ABSS , we
want to know how could we realize the requirement
to control the TCODE with cost center authorization check, thanks in
advance.

Hi,
check SAPNET note 370082 + related notes + 698401 / 565436.
Best regards, Christian

Auto maintenance of user cost center authorizations

Greetings All,
In NetWeaver 2004s we recently added cost center expense/commitment reporting in BI. Now we want to automatically maintain user authorizations to determine which cost centers people have access to. Can you please point me in the right direction? Many thanks!
Regards,
Den

If you have some data set from where you can evalulate which values to assign to which user, you can do it using 'Generation of Analysis Authorization' Concept.:
http://help.sap.com/saphelp_nw04s/helpdata/en/59/fd8b41b5b3b45fe10000000a1550b0/content.htm

Purchase requisition and cost center authorization check

Hi all,
in a R/3 4.7, I need to check the cost center (or profit center) when managing (create/modify/view) purchase requisitions.
I have not found any auths object which perform this check.
Any idea ?
A BADI seems to be he only solution, inserting an authorizaton check.
Thanks
Andrea

Hi
use the BADI in SE18 Tcode
ME_REQ_POSTED
implement this and use
the Method POSTED has the parameter IM_EBKN which has KOSTL field
this will work
see the sample code for this BADI
BAdI Name: ZPUR_RFQ (Implementation name) Purchase Requisitions
Definition Name: ME_REQ_POSTED
Interface Name : IF_EX_ME_REQ_POSTED
Implementing Class: ZCL_IM_PUR_REQ
Method :            POSTED
METHOD if_ex_me_req_posted~posted .
TYPE-POOLS: pgrt.
DATA: t_txpdat TYPE STANDARD TABLE OF txpdat.
DATA: s_txpdat TYPE txpdat.
DATA: t_ident TYPE pgrt_t_obj_ident.
DATA: s_ident TYPE pgrt_obj_ident.
DATA: ident_tmp TYPE eketkey.
DATA: nmrid_init TYPE txpdat-nmrid.
DATA t_obj_event TYPE pgrt_t_obj_event.
DATA s_obj_event TYPE pgrt_obj_event.
DATA t_event     TYPE pgrt_t_event.
DATA s_event     TYPE pgrt_event.
DATA change_yes TYPE c.
    IF l_s_eban-estkz NE 'B'.
      CLEAR v_mtart.
      SELECT SINGLE mtart INTO v_mtart FROM mara WHERE matnr = l_s_eban-matnr.
      IF v_mtart EQ 'ZERS' OR v_mtart EQ 'FHMI' OR v_mtart EQ 'UNBW'.
        MESSAGE e000(zm_msg) WITH 'You are not allowed' 'to create PR for stock items'.
      ENDIF.
    ENDIF.
    IF l_s_eban-knttp NE 'F' OR l_s_eban-pstyp NE '9'.
      IF l_s_eban-knttp NE 'A'.
        IF ( l_s_eban-pstyp NE '9' AND l_s_eban-pstyp NE 'D' ) AND l_s_eban-matnr EQ space.
          MESSAGE e000(zm_msg) WITH 'You cannot create' 'a PR without material number'.
        ENDIF.
      ENDIF.
    ENDIF.
ENDLOOP.
ENDMETHOD.
reward points if useful
regards
Anji

Cost Center Authorization in MB21

Dear Sir,
We are unable to restrict the user to create reservation for one plant and choosing the cost center for the same plant. He may choose cost center of different plant for movement type 201 in T.Code MB21. The same is also happening in case of reservation through 221 and choosing WBS.
We want to know how can we restrict the same. We have checked it through our BASIS Team.
Regards
Mudit Gupta

Hi
Cost Center is defined at company code level.
But user have authrizations for one particular plant which is assigned to company code
Hence it is not possible to restrict

Cost Center authorization - issue

Hi All,
The Cost Center and Areas (0CO_OM_CCA_USER_1) datasource load is getting failed with error message as ''Error occurred in the data selection ".
The data selection is Hierarchy name and it is blank; so no issues with that.
When I run the datasource extractor checker in ECC, It ends with a ABAP dump. The Dump displays "Missing Cost Center", this extractor runs by a FM.
I am not sure where the issue persist? I feel the issue with the data.
This daily full load was success till last month, but due to some unknown reasons the load is getting failed everyday. When I check the records in ODS, I could see a record with User as "D_E_L_E_T_E" and the Cost center, Co area and other fields are blank. I am not sure, whether it is meaningful data or not?
If it a meaningful data, what does it mean?
Can anyone let me know, how to dig down and confirm its an issue with the Data?
Thanks
Regards
San

Okay, I misread the "NE". Sorry.
Have you done a syntax check on it?
Also compare to:
AUTHORITY-CHECK <object>
ID 'KOSTL' '*'.
I cannot confess to ever have done a "full" AUTHORITY-CHECK myself, but it is most likely the same as with DUMMY -> you should not use the FIELD statement as '' value if the data element does not know what a '' is...
Cheers,
Julius

BI-IP Authorizations: Accessing own Cost Center only

Hi,
We are currently implementing BI-IP in our company. We have created the ready-input templates and we are prepared for roll-out.
There is still one concern though which I haven't resolved. I am currently looking for an AUTHORIZATION that will let users access their respective COST CENTERS only. For example, if I am part of the Marketing Group, then I will only be able to access the budget of my respective cost center.
Can anyone lead me to the right AUTHORIZATION OBJECT in BI-IP to implement this restriction.
Your reply is much appreciated. Thanks.
Regards,
Ramon

Hi Ramon,
authorizations for transaction data in BI (and therefore in BI-IP) are not based on authorization objects. You have to make the cost center InfoObject authorization relevant and then create so called Analysis Authorizations for it. Please see the online help:
http://help.sap.com/saphelp_nw70/helpdata/en/66/019441b8972e7be10000000a1550b0/frameset.htm
BTW, you can upload the cost center authorizations from SAP R/3 or ERP.
http://help.sap.com/saphelp_nw70/helpdata/en/59/fd8b41b5b3b45fe10000000a1550b0/frameset.htm
Regards,
Marc
SAP NetWeaver RIG

Authorization on cost center !

hi,
i need help on Cost center Authorization.
I have crared 3 dso. 1 for Hierarchy nod, 2. single values and 3. user reporting. and the data is loaded in all 3.
after this i have generated Authorization in bW using RSSB_Generate_Authorization.
Now, i m in Tcode RSSM, over there i am creating Authorization object ZZZ_OPC.
Over here , i have to select Infoobjects for authorization.
i have choosen 0TCTAUTHH for hier, 0costcenter ( As i am doing authorization on this ), what else i have to choose ?
do i have to choose anything for Single value ? if yes then which info object ?
thankz

Hi,
The relevant authorisation objects are as follows:
K_CSKS_SET: This will allow display/change/creation of groups based on activity selected.
K_CCA: This is a general authorisation object (relevant activites should be 0003, 3027, 3029). You are obviously trying to run a report. For running a report the relevant authorisation object is K_REPO_CCA, which sadly does not have cost center group as a selection, only cost center values and ranges.
However, K_CCA will work, if the cost center group that you have entered in the authorisation is also present in the standard hierarchy. Can you test this, enter a cost center group from the standard hierarchy and not just any group that you have created seperately. The authorisation should get restricted to that group.
Cheers.

Search help results of cost center

Hi everybody
Cost center is normally assigned to SC item based on the attribute set in PPOMA_BBP (attribute CNT). Now, when you're in the item details screen and want to change that default cost center you can search for other ones using the "glasses icon". This starts some kind of a F4 search help screen and returns a list of all available cost centers existing in the backend system.
Our SRM users are NOT created in the backend system, therefore we're not able to control cost center authorizations via backend user authorizations.
So the problem we have is, that in the result screen we get by far too much cost centers from which the enduser can make his choice. We'd like to reduce this result list to only the cost centers assigned via CNT attribute on org. unit level in PPOMA_BBP.
I already looked at BAdIs BBP_F4_READ_ON_ENTRY and BBP_F4_READ_ON_EXIT (method GET_COSTCENT) and to verify if they could do what I wanted simply tried to delete all entries from table ET_COSTCENT_LIST and ET_COSTCENT_FAVOURITES... no changes, the result list still contains a complete overview of all our backend cost centers.
To all SRM gurus out there: how is it possible to restrict the result list of cost center search help?
Thanks again anyone for some help.
Kind regards,
Renaud

Hi Case,
We can get this functionality with out changing any standard program.
Herewith I am sending details.
1.     Implement the badi using definition BBP_DRIVER_DETERMINE and write below mentioned code in method DETERMINE_DRIVER.
        IF functionname = 'B470_SHLP_CALL' AND sy-tcode NE 'PPOMA_BBP'.
functionname = 'ZB470_SHLP_CALL'.
        ENDIF.
2.     Copy the standard FM B470_SHLP_CALL to ZB470_SHLP_CALL then make
       the changes in ZB470_SHLP_CALL.
       Here you have to make two changes.
a.     Clear the destination name (LV_DESTINATION) for calling search help
                        from SRM
b.     Give your own search help name (ZCOST_CENTER we need to create this search help in SRM )
       Now it will call the search help ZCOST_CENTER from SRM only
               Sample code
          CASE shlp_field.
        WHEN gc_g_l_acct.
      lv_shlpname = 'SAKO'.
       lv_shlpparam = 'SAKNR'.
        WHEN gc_cost_ctr.
      lv_shlpname = 'ZCOST_CENTER'.
      lv_shlpparam = 'KOSTL'.
      CLEAR lv_destination.
3.      Create you won search help (ZCOST_CENTER) in SRM and write code in search help exit for getting the cost centers from user attributes. For reading the cost centers from user attributed you can use the FM BBP_READ_ATTRIBUTES (pass the CNT as attribute ID)
Regards,
Padmaraju
If it useful to you,please reward points.

BW Analysis authorization issue on cost center range

Hello BIW security experts
I have a problem where I created an analysis authorization on a cost center range and it looks like the interval is not working. The report is just a list of cost centers (demo to users to prove that analysis authorizations work in order to skip 2 managerial cost centers.
. Cost centers are numeric. Example: 2000100. In the drop down list they appear as such.
. I want to have the following cost center range: 1000000 to 1000771, 1000773 to 2000771, 2000773 to 9999999.
Thereofore 1000772 and 2000772 should not appear in the list.
. In the analysis authorization I have put the 3 ranges above on 3 separate lines. 'BT' is the operator. The cost centers have been selected from the drop down list.
Results: I get only 1 record from the report.... 2000772. (which is one I want to exclude..
Steps tried to debug:
. When I put a list of cost centers in the analysis authorization on separate line with the 'EQ' operator, then the report works.
. I tried putting ' ' delimiters since cost center is a char field but it fails.
. I tried adding leading and trailing zeros to fill up the char(10) but no luck.
. I tried creating a hierarchy with the interval and put it in the hierachy auth. tab and it does not work either. It gives the same number of records than the first step.
. A hierarchy with single values work.
I do not know what else to try..
Thanks.
YB.

Good morning
Here it is from RSECVAL
ZCC_TEST     0COSTCENTER                    I       BT        1000000                                                      1000771
ZCC_TEST     0COSTCENTER                    I       BT        1000773                                                      2000771
ZCC_TEST     0COSTCENTER                    I       BT        2000773                                                      9999999
ZCC_TEST     0COSTCENTER                    I       EQ        #
ZCC_TEST     0COSTCENTER                    I       EQ        :
ZCC_TEST     0INFOPROV                         I       CP        *
ZCC_TEST     0TCAACTVT                        I       EQ        03
ZCC_TEST     0TCAIPROV                         I       CP        *
ZCC_TEST     0TCAKYFNM                       I       CP        *
Thank you for your help.

BW report authorization for restrict cost center

dear all,
i have problem on BW report authorization for restrict cost center.....when i execute the query, after selection screen, appear error message 'you cannot change zv_cctr for characteristic 0COSTCENTER during query'.
note : zv_cctr is variable restriction for costcenter, type processing = customer exit.
below the customer exit :
WHEN 'ZV_CCTR'.
    IF i_step = 2.
      DATA : gt_mstuidvscc TYPE TABLE OF ztbw_mstuidvscc,
             gs_mstuidvscc TYPE ztbw_mstuidvscc,
             wa_final2(10) TYPE c.
      SELECT * FROM ztbw_mstuidvscc INTO CORRESPONDING FIELDS OF TABLE gt_mstuidvscc
        WHERE userid = 'sy-uname'.
      LOOP AT gt_mstuidvscc INTO gs_mstuidvscc.
        wa_final2 = gs_mstuidvscc-kostl.
        l_s_range-opt = 'EQ'.
        l_s_range-high = wa_final2.
        APPEND l_s_range TO e_t_range.
      ENDLOOP.
    ENDIF.
Regards,
Tony

i defined variable as ready for input and mandatory.
regards,
Tony

Authorization issue with Company code/ Cost center combination

Hi,
I am currently trying to restrict user access by company code and cost center combination.
We have roles defined for each user and I am trying to use the standard authorization object A_S_KOSTL in this role . It seems that since it is not a 'maintianed' object no activity can be assigned to this autorization object.
currently the values are :
company Code : 1110 , 1112, 1114
Cost Center : *
i am getting sy-subrc as 0 even when i test for company code : 1110 for a user with the above role.
My code is :
AUTHORITY-CHECK OBJECT 'A_S_KOSTL'
    ID 'BUKRS' FIELD '1110'.
F sy-subrc EQ 0.
AUTHORITY-CHECK OBJECT 'A_S_KOSTL'
ID 'KOSTL' FIELD '*' .
IF sy-subrc EQ 0.
    MESSAGE 'Success with KOSTL also' TYPE 'S'.
ELSE.
      MESSAGE 'Success with BUKRS only' TYPE 'S'.
ENDIF.
ELSE.
      MESSAGE 'Failure' TYPE 'S'.
ENDIF .
I get a subrc NE 0 for the KOSTL part. The test passes for BUKRS.
Please advise on how to proceed.
Thanks and Regards
Soumya

Okay, I misread the "NE". Sorry.
Have you done a syntax check on it?
Also compare to:
AUTHORITY-CHECK <object>
ID 'KOSTL' '*'.
I cannot confess to ever have done a "full" AUTHORITY-CHECK myself, but it is most likely the same as with DUMMY -> you should not use the FIELD statement as '' value if the data element does not know what a '' is...
Cheers,
Julius

Authorization: data level security by cost center to finance line items

We have a business unit request requiring implementation of cost center data level security through FI transaction codes for financial line items. Example requirement: Cost center manager can execute FS10N GL account line item display, drill into the balance and only return those line items to which the cost center manager has access. Cost center managers currently report their cost center expenses via cost center accounting report and through those reports are able to drill into the FI line items to display document and line item details. Cost Center managers, due to their varied responsibilities, also have access to tcode FS10N, from which if they execute reports directly, can access data for cost centers which they are not responsible for.
Our security team has stated that the determination of authorization objects which are checked at transaction code/program execution are not configurable. We’ve found when debugging that it would be possible to implement user exits for additional authorization checks, but that in order for the authorization check to actually get called, the object must be set as ‘checked’ within SU22/SU24.
Has anyone had a request to implement such cost center data level security for financial line items through Financial transaction codes? If so, what steps were taken to be implemented? Was this able to be accomplished via security configuration and PFCG security role updates or was custom code logic needed? If custom logic was needed, to what extent was this implemented (what tcodes/programs were included; how was the decision of what to include and exclude determined). What was the duration of this effort?
Has anyone had a request to implement such cost center data level security request for financial line items via Financial transaction codes and not implemented the request? How was this communicated to the business that the request for data level security goes against SAP’s authorization design?
Thank you in advance for your input,
Becky Zick

Hi Becky
Have you tried with object K_REPO_CCA? You have available these fields to filter authorizations.
I hope this helps you
Regards
Eduardo

Why authorization for cost center groups does not worked ?

hello all,
I would like to give authorization for a CO report (S_ALR_87013625) based on authorization values : cost center groups.
But, unfortunately, it doesn't work. I get a message : No authorization for x of x read records.
Is it only possible to give authorization on standard hierarchy and cost center ?
Please, help me
Thanks and best regards

hi,
Run the su53 transaction.See what authorization was missing

Authorization for cost center in migo transaction

Dear Experts,
I need to restrict the user by the cost center assigned to him in the migo transaction,
i tried with these objects A_S_KOSTL, K_CSKS and K_CCA. As per forum threads I also maintained the check in su24 , but still authorization is not happening.
please let me know how to do it, is there any user exits to achieve .
waiting for ur help.
Thanks & regards,
Reena...

Reena,
You can do teh followign , apart from others :
1. Ask the business owner the values for teh objects...ofcourse explain to them what the objects are in plain lainguage.
2. Then populate the values "accordingly"
OR
1.As an earlier post...trace teh user --on ST01 - here again - you can give eiither wide access and trace teh path and then restrict ..or restriced acces and then each time a road block is hit ..analysi s and assign.
BUT DONOT maintian SU24 to restrict acces !!

Cost Center Authorization

Similar Messages

Maybe you are looking for