Create new derived role.

Hello,
I'm looking for some easy way to automatically create a set of derived roles (with different organizational levels defined in itab) for specific imparting role. Any f-modules or your implementation experiences I could loot at?
Regards,
Filip

Hi,
it seems that there in no easy way I did it step by step ...
Regs,
FS

Similar Messages

Create new partner role type

Hi Guys
This one is from Traders' and Schedulers' Workbench from IS Oil and Gas Downstream.
I need to know whether we can create new partner role types (e.g. TSW011, TSW011, etc). The partner role types are maintained in table OIJRRT but I could not find a transaction to maintain this table.
Do I need to create the entries in the table directly? Will the system allow me? Has anybody tried this earlier?
Also, can anybody tell me what is the significance of Role differentiator type and how can we use it?
Many thanks in advance for all your time on this.
Kartik

TS W as a standard has some partner roles, which can be assined to the TSW location or Transport system.
e.g. Carrier
Shipper
Supplier
Supplier in pipe
Receiver
Receiver in pipe
Consignee
Tanker
Inspector
Breakout S/L locational
Your partner role can be either of the following SAP entities : Vendor, Customer, Plant , Plant + SLoc
At a physical location, you can have multiple suppliers. In SAP, they are created as Vendors, and assigned to the TSW location as the 'Supplier' partner role. Another vendor may be assigned the 'Carrier' partner role at the location. Similary, a Plant can be assigned as a 'Supplier' partner role.
The same applies to Customers or Plant which can act as a 'Receiver' partner role at a diferent TSW location.
Once you have set-up the partners for the location, this data is used as a validating and defaluting source in the TSW documents.

Security Issue: How to create a derived role from the Base role

Hi All,
Kindly let me know how can i create a derived role from the base role?
Please respond at the earliest.
Thanks in advance.
Ramesh.

Go to PFCG and Create a role with desired Name.
In the Description Tab, on the Left Side there is a text box for "Derive From "
enter the Base role.
Now your newly created role is derived from the Base role.
Save the newly created role and again run PFCG, enter the Base role name and execute.Select Edit role. Go to Authorization tab.
Edit Authorization.
In the Menu Adjust Derived -> Generate and Adjust derive
This will Generate the derived role.
Now you may go and check the authorization in the derived role.

Extending JComponent and creating new derived class



Dear Friends,
I developed new component SwingComponent and I extends it
from JComponent and also implements
the interfaces like
KeyListener and MouseListener .. but when I press ctrl+b and ctrl +n it wont recognize in the KeyEvent but it works fine if i press individual keys. Please give me an idea
public class SwingComponent extends JComponent implements
KeyListener,
MouseListener{

This one working fine for individual character for example if i press 'A' in keyborad it was working but how to activate if i press ctrl + n or ctrl + b in the JComponent or Component. did you got my question?
private KeyListener keyListener;
     public void addKeyListener(KeyListener listener) {
              keyListener = AWTEventMulticaster.add(keyListener, listener);
          enableEvents(AWTEvent.KEY_EVENT_MASK);
     public void removeKeyListener(KeyListener listener) {
          keyListener = AWTEventMulticaster.remove(keyListener, listener);
     public void processKeyEvent(KeyEvent evt) {
          if (keyListener != null) {
               System.err.println("" + evt.getKeyChar() + " " +
                                    evt.getKeyCode());
               switch (evt.getID()) {
               case KeyEvent.KEY_PRESSED:
                    keyListener.keyPressed(evt);
                    break;
               case KeyEvent.KEY_RELEASED:
                    keyListener.keyReleased(evt);
                    break;
               case KeyEvent.KEY_TYPED:
                    keyListener.keyTyped(evt);
                    break;
          super.processKeyEvent(evt);
       public void keyTyped(KeyEvent e) {
                 System.out.println(e.getKeyChar());
     public void keyPressed(KeyEvent e) {
            System.out.println(e.getKeyCode());
     public void keyReleased(KeyEvent e) {
             System.out.pirntln(e.getKeyCode());
          }

What permissions require to create CASES (Service Module). Creating new role.

Hi All,
Can you please suggest me what permission require to create new case from service module. Steps is below i followed to create case and assigned to user.
1- Created new blank role.
2- Went in service module.
3- Given the Create, Read, Write, Append & Append To permission to CASE entity on organization Level.
4- Assigned this role to user.
After assigning this role login into crm online and trying to create case. Its giving message "Insufficient Permission".
Kindly suggest me the steps i am missing here. Want to assigned single custom created role.
Thanks in Advance

Hello,
Recheck following article -
http://www.powerobjects.com/blog/2015/02/13/access-denied-identify-fix-security-role-issue/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+PowerobjectsMicrosoftCrmBlog+%28PowerObjects+Microsoft+CRM+Blog%29
Dynamics CRM MVP/ Technical Evangelist at
SlickData LLC
My blog

Derived role

hiii we created a derived role from a master role we can change the manually this derived role

Hi Syed,
Just create a new role by giving name of master role in Derived from option in role cretion process.
It automatically picks all the Tcodes from master....in derived roel you only can change the sub values like org leves..
And if you need any clarification, just close this message and open new thread under SECURITY forum.
Regards
Nick Loy

Master role and derived role concept

Guys,
1) How to assign the organizational levels for the derived role?
Say for example, I have to create the derived roles with respect to the plant code.And after inheriting the tcodes ,authorizations from the master role , I noticed a pop up page with organizational level tabulation and I assigned the respective plant code there and in the same way for all the following derived roles.But the rest of the rows like company code,sales organization,distribution channel etc which are seen in the tabulation are left empty.I noticed that all the fields which are left empty in the org.levels of the derived roles are been filled up with the vaules of the corresponding master role org.level values when the derived button icon , which is seen under the authorization tab of master role is pressed.So pls let me know the correct procedure to assign.*Do we really need to maintain org.values for master roles?*
2) If a master role is transported to QA or PRD, will the derived role along with it move automatically?
3) Is master and derived role tested parallely in the QA system or first master role is tested ,followed by the derived role?
4) According to my understanding we dont assign any user to the master roles, but why do we move it to PRD?
Greatly appreciate for some body's help.

> 1) How to assign the organizational levels for the derived role?
> Say for example, I have to create the derived roles with respect to the plant code.And after inheriting the tcodes ,authorizations from the master role , I noticed a pop up page with organizational level tabulation and I assigned the respective plant code there and in the same way for all the following derived roles.But the rest of the rows like company code,sales organization,distribution channel etc which are seen in the tabulation are left empty.I noticed that all the fields which are left empty in the org.levels of the derived roles are been filled up with the vaules of the corresponding master role org.level values when the derived button icon , which is seen under the authorization tab of master role is pressed.So pls let me know the correct procedure to assign.*Do we really need to maintain org.values for master roles?*
Only if you assign the master roles to users. (and maybe for testing, see 3)
>
> 2) If a master role is transported to QA or PRD, will the derived role along with it move automatically?
Nope, but if one of it's derived roles is transported the master is automatically included in the transport. You'll have to make sure all derived roles are transported yourself.
>
> 3) Is master and derived role tested parallely in the QA system or first master role is tested ,followed by the derived role?
Best order is to do all unit testing wit the master, with all org levels at * and create the derived roles only when the master is tested and corrected to satisfaction. In that way the derived roles only have to be tested for organizational shielding.
>
> 4) According to my understanding we dont assign any user to the master roles, but why do we move it to PRD?
See 2, it goes there automatically. No choice.
Jurjen

Org data in Derived role differ from Parent role

Hi there
I need some help please, I am in the process of creating various parent / derived roles and have found that when I update the parent role (org data) and I do a generate do a derived role update the values in the org data is not correctly pulled through to the derived roles.
e.g.
In the parent role for Org data "Purchase Org" the previous value was "/" so that it could be specified in the derived roles should they require the split on this field, however the business has decided that they do not require a restriction on this field so I went back to the parent role and changed the value to "*", so I generated the parent role, updated the derived roles, but when I go to any of my derived roles that field value is still blank, it did not pull through the value * .
We are currently on
SAP_ABA 701 0005 SAPKA70105
SAP_BASIS 701 0005 SAPKB70105
I have created the derived roles with the parent role as the derived from role, it does pull through the values but just does not update it once I do make changes.
Your help / suggestions would really be appreciated as I need to create MANY roles.
Regards
Sonja

Hi Sonja,
obviously there is a misunderstanding of how the derivation works....
> Thanks guys for the feedback, but surely I do not only need to maintain the ORG data in the derived roles individually, if I have got an Org field that should be the same for all the derived roles I must be able to update the Parent role with this value which then upon generate, and generate / activate the derived roles must update the derived roles.
-->no.
Only the first time of derivation, if the field content in the derived roles are initial...
help.sap.com:
quote
The organization level data is only copied the first time the authorization data is adjusted for the derived role. If data is maintained for the organizational levels in the derived role, and if you have maintained the organizational levels using the dialog box, the data is not overwritten by another conciliation (See SAP Note 314513).
unquote
The whole stuff: http://help.sap.com/saphelp_nw70ehp2/helpdata/en/1c/c38028816c11d396bc0000e82de14a/frameset.htm
otherwise the maintained org.fieldvalues would get overwritten by the value of the master role every time. And that is exactly, what has to be avoided!
b.rgds, Bernhard

Master role-derive role concept and FICO role in dev system!!!

Hi all,
I have created a master role with t-codes
AWUW
BAPI
BD10
BD100
BD101
BD102
BD103
BD104
BD105
BD11
BD12
BD13
BD14
BD15
also included object PLOG where maintained org data
and created a derived role from that master role and generated from the master role.
After that I wanted to change the org level but the system is not allowing me to change, although I selected the values from the F4 screen.
Now I want to maintain seperate org value of each of the derived role...and when adjusted from the master role..these maitained value should not vanished.
How should I proceed???
I have another issue....I am now in Dev system....I need to create a role with FICO module with SPRO....
Should I go ahead and cread a role and assign FICO block and assign SPRO...will that be sufficient??
Thanks in Advance
Regards,
Souren

Yes, It seems that you have broken the org level by directly making changes in the org level field inside pfcg.
One way to correct this is to regenerate the role in expert mode by selecting the option 'Delete and recreate profile and authorizations' (in case you want to correct it for all the org level fields.).
If you want only for PLOG, then delete this object and add again. Then go to organization level tab at the top and give the required value. Do this in the master role and generate and push the changes to derived role. Now, goto derived role and make the org level change the same way you did for parent role..
For your second question, you will have to see what all auth objects are being checked by SPRO for a FICO module assosciate. You can create a test role with SPRO in it and then do authorization trace through ST01 to see what all objects are checked when they work.

Master role-derive role concept?

Hi all,
I have created a master role with t-codes
AWUW
BAPI
BD10
BD100
BD101
BD102
BD103
BD104
BD105
BD11
BD12
BD13
BD14
BD15
also included object PLOG where maintained org data
and created a derived role from that master role and generated from the master role.
After that I wanted to change the org level but the system is not allowing me to change, although I selected the values from the F4 screen.
Now I want to maintain seperate org value of each of the derived role...and when adjusted from the master role..these maitained value should not vanished.
How should I proceed???
Thanks in advance
Regards,
Souren

you should refer to the SECURITY forum at Security

Configure new user role

Hello,
I'm new in town so, please forgive me all misteakes I will make. I try to do my best.
I would like to modyfie a user role in SAP CRM 7.0. My point is, I want to add a button ( assing a user to the respossible employee). In my current role I have only "search". But I want to assing a user to employee, in creating sales order level for example.
At start I know that I should copy standart role and make it "z" (and I did it).I copied sales rule. Than copy the navigation bar profile...(sls-pro) and here problems apper when a choose 'copy all'.
Help me with this, please.
ML

According to your link, I create new user named "A" belong to new group named "Beijing" in the BIEE console, and in the EM I also create new application role named "Beijing" that contains the "Beijing" group, then restart the server. Finally I filter the City column into "Beijing" in Administration-->Appliction roles-->"Beijing"-->Permissions-->Data filter, but when I login into the answer through A user, I see all data in the city column, do not only view "Beijing" data .
If you know the method for solving it, please help me. Thank you!

ERM 5.3 (SP12) Derived Role Update Problem

Hello Experts,
I have a question.
We have a master role/derived role set up in the back-end system. We are trying to update a master role and its derive roles in ERM via PFGC sync.
Our problem:
We can add a transaction to a master role no problem in ERM via PFCG sync (adding a transaction code in the back-end and sync to ERM) However, we are unable to update the transaction for derived roles (nothing happens for derived roles in ERM).
If I am correct, we don't have to add a transaction to each derived role manually, and we should be able to update derived roles automatically once we update a transaction in a master role.
Please just note that we successfully imported all the master/derived roles from our back-end system, and we are not try to create a derived role in ERM at this time. All we want right now is to update a master role and its derived roles in ERM via PFCG sync.
If you can, please advice.
HM

Go to the TXT file , cut the last line from the AGR_1252 (rtable and insert it to the top of the lines ( AGR_1252) , and reimport it will work I had the same problem in my previous implementation.
try for one parent & child role
This is a known problem with SAP they will rectify it in SP12/SP13 or so

Derived role authorization tab

Hi All:
      I created a derived role from a master role and the authorization tab is RED for both roles.Under the profile for both roles it says profile match up required.I even did profile comparison using PFUD.Can anyone help me.
       Thanks,
       J D

Hi Jim,
To generate the both the roles
1. First goto the parent role in change mode and then click on the authorization tab and then click on the change authorization data and then save the role here and generate the role. (This will generate only the parent role).
2. To generate the derived roles don't need to goto the derived role in the parent role itself goto the change authorization data in the authorization button, click on the menu option Authorizations, under that click on adjust derived and then under that save the derived role and then Generate the derived role.
but incase if you have changed anything in the derived role itself, you can save and generate in the derived role.
Regards,
Ashok

Create new user same as a existing roles and Privileges

Hi Team,
I am a junior DBA. New user Joined in Application team. So, Client requested me.....
Crerate new user with same privileges as like as existing user.
As of now i am creating user like "create user username identified by "password". Then grant privileges to that user. earliar I never comapare or copied users.
Please suggest any one how to create new user as like as existing user roles and privileges.
Thanks,
Venkat

For basic cloning:
select dbms_metadata.get_ddl('USER', '...') FROM DUAL;
SELECT DBMS_METADATA.GET_GRANTED_DDL('ROLE_GRANT','...') FROM DUAL;
SELECT DBMS_METADATA.GET_GRANTED_DDL('SYSTEM_GRANT','...') FROM DUAL;
SELECT DBMS_METADATA.GET_GRANTED_DDL('OBJECT_GRANT','...') FROM DUAL;
SELECT DBMS_METADATA.GET_granted_DDL(‘TABLESPACE_QUOTA’, ‘...’) FROM dual;
Then just replace the username with the new one you want to create.

Issue with Creating CATT Script for Generating Derived Roles

Hi Experts,
I am desperately trying to find the solution on how I create a CATT Script to generate derived roles from few 100 master roles.
I posted a thread on Security (Can I do a 'mass generation' of dervied roles?) .. however, since it turns out to be a SCAT issue, I thought I'll ask someone from this forum too.
Extract from the other thread is as follows :
"I cannot get the script to automate the generation of derived roles.
when Entering parameters for a test case, I can only see the Initial PFCG Screen. Display/Change Authorization screen doesn't seem to get recorded / logged in the test screen.
I.e : All screens with program SAPLPRGN_TREE is recorded, however all screens with program SAPMSSY0 is not.
I hope it makes sense.. Any suggestions on how I can automate the generation of derived roles tasks?
Thanks.
Dineish

Hi,
I have the same problem just now.
Have you found some solutions about it ?
thx
Luigi

Create new derived role.

Similar Messages

Maybe you are looking for