Creating Custom Privilages to assign to Authorization policy

Hi,
I want to create custom priviliages like "Create User", "Search User" in OIM. So that I can assign these privilages to authorization policies.
Please let me know how to create custom privilages.
Thanks

Refer to this documentation provided by SAP.
Definition
Maintenance status authorization for material master records
The data contained in a material master record is divided into user departments or views (Purchasing, MRP, and so on). The maintenance status is a single-character key for the relevant user department or view.
This object determines which user departments or views a user is authorized to process; that is, which data he or she may process from this view.
Note
To use material master functions, a user needs the authorization for at least one user department.
Defined fields
Fields Possible values Meaning
ACTVT 01 User may create data.
02 User may change data.
03 User may display data.
06 User may flag data for
  deletion.
08 User may display change
  documents.
STATM  Here, you specify the
  maintenance status for which
  the user is authorized.
The maintenance statuses possible are as follows:
User department Maintenance status
Work scheduling A
Accounting B
Classification C
MRP D
Purchasing E
Production resources/tools F
Costing G
Basic data K
Storage L
Forecasting P
Quality management Q
Warehouse management S
Sales V
Plant stocks X
Storage location stocks Z
Notes
This authorization object also determines:
Whether a user may flag a material master record for deletion. In this case, 06 must be entered in field ACTVT; the maintenance status is irrelevant here.
Whether a user may change the material type. In this case, 02 must be entered in field ACTVT; the maintenance status is irrelevant here.
Whether a user may process an MRP profile or forecast profile. In this case, the following values must be entered in field ACTVT:
01 to create
02 to change or delete
03 to display

Similar Messages

  • Error in create Customer code.

    hi,
    when i try to create the new customer, am getting "ACCT GROUP SOLD to PARTY user EXT. NO".  can you please suggest where we need to assing , whether the customer number is auto genrate or manuall number?
    and how the running number interval which is defined (OVZC) can allocate to customer account group?
    Thanks
    Bala

    may be your customer number range marked for external, please remove the check mark in defination of number range under this path.
    SPRO> Financial Accounting > Customer Accounts > Master data > Preparations for Creating Customer Master Data > Create Number Ranges for Customer Accounts > select your number range and remove check mark for External number range.
    if you want to see the number range assigned to your account group, check below path.
    SPRO> Financial Accounting > Customer Accounts > Master data > Preparations for Creating Customer Master Data > Assign Number Ranges to Customer Account Groups.

  • Give "Number of an SD business partner" internally while creating customer

    When we create a new custpmer by VD01 or XD01, at the "partner functions" tab, the number for each partner role is given internally. Where is the customization for the internal or external partner number? I want the system to give the partner number internally for the new customer's partner roles but it is externally customized. The partner numbers (which can be seen in "Partner Functions tab") for the new customer being created should be the new customer's own number and should be given internally.
    Thanks in advance.

    Hi
    To assign the internal or external no. range to Customer is based upon the account Group. It can be assigned in IMG, the path is ;- IMG>Financial Accounting>Account receivable account payable.> Customer Account> Master data>Preparation of creating Customer Master data>Assign No. range to customer Account group.
    Regards
    Amitesh

  • Custom OWSM Authorization Policy Not Visible in OSB 11g

    I am trying to configure custom OWSM authorization policies to grant web service access in OSB to userids associated with custom WebLogic groups. Both OSB and SOA are version 11.1.1.5 with an Oracle Enterprise 11g database backend. To help rule out some possible operational errors, here are things that ARE working with the combination of SOA and OSB servcies:
    * the underlying SOA service functions in the /em console test page
    * the OSB proxy service works from the /sbconsole test page with OWSM oracle/wss_username_token_policy enabled
    * the oracle/log_policy can be added to the OSB business service and generates log entries
    * the outer proxy service can be successfully invoked from a remote client with no security policies,
    with HTTP transport security and authorization policies and with OWSM authentication policies
    attached (given the correct request payloads)
    These findings would appear to rule out connection errors from the OSB engine to the jdbc/mds/owsm DataSource or proper startup of the "OWSM Policy Support in OSB Initializer Application" service within WebLogic. (By the way, that deploys with a typo in its registered name -- "Aplication" with a single p.)
    Here are the steps that were performed:
    1) created group myfirmIdentityData in WebLogic console (/console)
    2) created userid myappuser in WebLogic console
    3) added myappuser to the myfirmIdentityData group in WebLogic console
    4) cloned the oracle/component_authorization_permitall Security policy to myfirm/authorize_IdentityData
    using the Fusion console (/em on the SOA domain)
    5) edied myfirm/authorize_IdentityData to add the "role" myfirmIdentityGroup to the
    list of permitted roles (***)
    *** note -- "roles" referenced within the OWSM policy configuration dialogs actually correspond to "groups" at the WebLogic Server level. A bit confusing at first but harmless.
    6) accessed the SOA service in the Fusion console (/em), clicked on the Policies tab and verified
    the myfirm/authorize_IdentityData policy is available for application to the SOA service (BUT DID
    NOT ATTACH IT HERE -- I'm trying to attach it at the "outer" layer in OSB, not SOA Suite)
    7) accessed the Service Bus console (/sbconsole), started a change session, selected the
    proxy service, then clicked on the Policies tab, then clicked the Add button in the
    Service Level Policies section
    At that point, the only services listed are the factory supplied oracle/********* policies. There are two pages listed and flipping between the two doesn't show any other policies other than the oracle/***** policies.
    I even tried stopping and starting the domain thinking maybe OSB caches all of the OWSM policies at startup rather than querying the mds_owsm schema dynamically to no avail. No myfirm/****** policies are displayed after a domain restart.
    Any insight?
    Thanks.

    Once again, I wound up opening a Support Request with the TAC for direction on this issue. The policies were not appearing for assignment to OSB proxy / business services because they were being created against the wrong type of object within OWSM.
    In a nutshell, policies in OWSM can be created to be applied against:
    * Components --- only usable against SOA services
    * Service Endpoints --- against URLs used as access points into services
    * Service Clients -- against consumers of services as identified by credentials
    * All -- all of the above
    However, policies built against Components can only be applied to SOA composite services. When I cloned the existing oracle/component_authorization_permitall Security policy to myfirm/authorize_IdentityData policy then limited it to the myfirmIdentityGroup group, that policy would only be assignable to SOA composities since it applied to only Components.
    To allow the group based authorization policy to be enforced in the outer OSB tier, the oracle/binding_authorization_permitall_policy was cloned to myfirm/authorize_IdentityGroup. That policy was defined to apply to endpoints and once saved, appeared in the GUI of the Service Bus console to assign to the proxy service for the service being implemented. A second component policy named myfirm/componentauthorize_IdentityGroup was cloned from oracle/component_authorize_permitall_policy to perform the group authorization at the SOA layer.
    A different issue is being encountered configuring the OSB business service to forward the OWSM headers from the outer proxy service to the SOA service so the authorization succeeds at the inner layer but that's a different problem. With the SOA layer authorization policy disabled, client tests to the proxy service function correctly with a userid in the myfirmIdentityGroup group and generate an authorization failure when another client credential is used that does not belong to myfirmIdentityGroup.

  • Custom Authorization Policy

    Hello Experts,
    I need to create new custom Authorization Policies, but seems that I can create or copy only Policy from these Entity Type:
    - User Management
    - Role Management
    - Authenticated Self Service User Management
    What about the other entity Type? Why I cannot create an Authorization Policy based (for example) on Entity Type 'Scheduler'??
    Thanks in Advance and Best Regards
    AT

    Open an SR and ask Oracle for the 11gR1 unpublished API.
    We automate the creationing of an authz policy when we create a group. We were able to receive the API for 11gR1 with the understading that it was unsupported, and with a very strong business case for needing it.
    Hope that help.

  • How to create Authorization policy using OIM 11g API

    Hi,
    Could you please let me know how to create Authorization policy using OIM 11g API.
    Thanks

    Constructing A Policy Programmatically
    http://docs.oracle.com/cd/E27559_01/dev.1112/e27154/cons_policy_prog.htm#CHDHACBF
    api ref for PolicyStore
    http://docs.oracle.com/cd/E21764_01/apirefs.1111/e22649/oracle/security/jps/service/policystore/PolicyStore.html#createApplicationPolicy_java_lang_String_
    something like below code to start with
    try {
    JpsContextFactory ctxFact;
    ctxFact = JpsContextFactory.getContextFactory();
    JpsContext ctx;
    ctx = ctxFact.getContext();
    PolicyStore ps = ctx.getServiceInstance(PolicyStore.class);
    if (ps == null) {
    // if no policy store instance configured in jps-config.xml
    System.out.println("no policy store instance configured");
    return;
    ApplicationPolicy ap = ps.createApplicationPolicy("Trading", "Trading
    Application","Trading Application.");
    } catch (JpsException e) {
    }

  • Authorization Policy for Modify user in OIM 11gR2

    Hi Experts,
    Requirement: I want the users in particular org not to modify certain user attributes and users from other org should be allowed to modify user.
    I have created user1 whose organization is org1 and role is role1. I have also created user user2 under same org and same role. I assigned the Admin Role "User Administrator" role to user2.
    So If user2 from same org1 tries to modify certain attributes then OIM should throw error message. I have completed till this.
    But when the user from diff org say org2 with Admin Role "User Administrator" tries to modify user, OIM is not allowing to modify user which should not be the case.
    I want the Auth Policy to trigger only for Org1. I have specified the below condition for my custom policy in OES admin console but it is not triggering.
    The condition is
    IF ( OrclOIMTargetEntity = 'true' AND OrclOIMUserOrganizations = 'true' AND STRING_AT_LEAST_ONE_MEMBER_OF(OrclOIMUserOrganizations,['25','1000000']) = true )
    What am I missing?
    Any help is much appreciated.

    Hi
    Can anyone let me know the steps to restrict modify user operation for the users belonging to specific organization in OIM 11gR2. The condition which I specified under Authorization Policy in APM console is not triggering at all.
    Thanks!

  • Modify/Suppress default Authorization policy

    We have a requirement to restrict Proxy assignment only to a restricted set of users. There is a default authorization policy 'Self Service User Management All Users Policy' which grant proxy assignment permission to all users. Since this policy exist we are not able to restrict the permission to assing proxy to a limited set of users.
    1.Is it possible to modify or delete default authorization policy ,Self Service User Management All Users Policy,
    2. If not, is there a way to override the default policy
    Thnx

    Hi Siddarth
    Please follow the instructions here to accomplish ur requirement:
    http://docs.oracle.com/cd/E14571_01/doc.1111/e14309/appoimcust.htm#BCFIAGCD [27.4 Creating Custom Proxy Plug-in]
    Regards
    user12841694

  • Authorization Policy for only search users

    Hi all,
    I need create a custom authorization policy for only search all users in create request. The users can't see any profile information of others users.
    Anyone can help me ?
    Regards,
    Joel

    ViewUser Admin Role can search and view users by default. Since the OES policies for this admin role has action as ViewSearch Entity. In your case, you can write EL's to hide Admin tab which will hide Admin ltab links based on current logged-in user profile.
    http://docs.oracle.com/cd/E27559_01/dev.1112/e27150/uicust.htm#BABHBFGH

  • OIM 11g - User Management Authorization policy issues

    Hello,
    1) Created an organization -> Human Resource
    2) Created an Role -> HR_Admins
    3) Assigned HR_Admins roles as administrative role of Human Resource organization
    4) Created user1 with organization as Human Resource & Assigned HR_Admins role to this user.
    5) Created authorization policy for user management with following selections
    Permission -> Create User.
    Data Constraints -> Selected "Users that are members of selected Organizations" & selected above Human Resource organization.
    Assignment -> HR_Admins role .
    now when i log into user1 i am not able to see Administration tab where i can select Create user.
    I am working on this issue for couple of days ,but not able to find the solution & have i missed some configurations ?
    Thank-You
    Rahul Shah

    Hi Rahul,
    I have tested your scenarion.. with below clause
    1) Created an organization -> Human Resource
    2) Created an Role -> HR_Admins
    3) Assigned HR_Admins roles as administrative role of Human Resource organization
    4) Created user1 with organization as Human Resource & Assigned HR_Admins role to this user. : default role All Users
    5) Created authorization policy for user management with following selections
    Permission -> Create User. :- *"Select ALL"*
    Data Constraints -> Selected "Users that are members of selected Organizations" & selected above Human Resource organization.
    Assignment -> HR_Admins role .
    In data constraints
    Organization Security Setting     Hierarchy Aware (include all Child Organizations)
    Now I am able to see the create user tab and, I can create user in Human Resource org only.
    If it doesn't work for you. Just assign "REQUEST ADMINISTRATOR" IN AUTH POLICY. Test the result.
    Also what is your OIM version?
    Test it with fresh data like new role name, org and user,
    -kuldeep
    Edited by: Kuldeep on May 22, 2012 4:19 AM

  • ISE authorization Policy not working

    Hi ,
    I have configured the ISE as per the belwo link 
    https://supportforums.cisco.com/document/110031/central-web-authentication-cwa-guests-ise
    but my authorization policy is not working as when user get connected to guest wlan it get authneticated but when it look for authorization
    it going to default policy it should hit on above policy created screen shot as below

    What version of ISE + patch are you running?. Could you please send an screenshot of AUTH policies including the default --- > USE part?. Are you using customized portal for the first authentication process?
    CWA is pretty straightforward. Only issues I faced was multiple VM (ISE Personas) running on one single server was not replicating properly the AUTHZ policies so I added the PSN persona into the PAN Node and everything worked fine immediately. In addition to that, I realized that I needed at least ONE ENTRY into the ISE PAN Internal Endpoints DB so I could hit the AUTH Policy for MAB & user not found condition which sent me to the AUTHZ = User Unknown + Redirect. Once I authenticated the user using the Default Portal that meant I hit the GUEST FLOW policy. If you are using customized portals for the first authentication process, check: web portal mgmt. --- > Guest --- > MultiPortal Configurations --- > Customized Portal -- > Authentication part.

  • OIM 11g - Authorization Policy

    Hi,
    I am facing issue in OIM 11g Authorization policy configuration. I am using OIM 11.1.1.5 Version.
    I have Created a OU --> Sample Helpdesk OU. Under this OU, i have created a user --> Sample Helpdesk user.
    I have created a role --> Sample Helpdesk Role and assigned this role to the user --> Sample Helpdesk user.
    I have created a Auth Policy --> "HelpDesk Create User - HelpDesk OU" which has to allow the user --> Sample Helpdesk user, to create a new users under the organization "Sample Helpdesk OU".
    During creation of User in OIM, i am not able to search the Organization in the lookup field. I am getting Zero records for the search. I used all type of filters to search the OU in the OIM User Form.
    Thanks,
    Sandy.
    Edited by: Sandy on Dec 6, 2011 9:24 PM
    Edited by: Sandy on Dec 6, 2011 9:25 PM

    Hi,
    Make Helpdesk Role created above as administrative role of OU.
    Regards,
    Raghav.

  • OIM 11g authorization policy issue

    Hi ALL,
    We have created one authorization policy.
    which will give the following permissions for the users.
    1.search users
    2.view user details
    3.Modify a single attribute in user profile
    it has been assigned to a role.
    Now we assigned this role to a user and he is able to search the users and view the details but he is able able to edit all the attributes besides the specified one. Please let me know where iam going wrong.

    In the Modify User, check for which all attributes are selected...if all are selected, then just select only one which you require.
    J

  • Error message while creating customer.

    Hi there,
    I am trying to create customer using Tcode XD01.
    I have input the Account Group, Company Code, Sales Organisation, Distribution Chanell & Division and on pressing Enter I am getting the error message 'Sales area ITCS RS AG is not defined for customers'.
    ITCS - my sales Org
    RS - Distribution Chanell
    AG - Division.
    I have already done the assignment in SPRO and sales Area is already set up.
    Please help.
    regards,
    Subhrojit

    Hi
    Check whether u have maintained the common Distribution channel and Common Division in VOR1 and VOR 2 transaction codes.
    If not maintain the same, and also maintain S.org+Common D.Ch + Common Division.
    Regards
    Vamsi Javaji,

  • Create customer with reference to customer master

    Hi,
    If the user creates customer master (XD01) with reference to another customer master then system should not copy some of the fields. How can I restrict this in SAP. Is there any Copy control functionality for customer master to customer master?
    Regards,
    Soumen

    Hello,
    As far as i know in Standard SAP system, when we are copying or even creating a Customer
    Master Recording in XD01 with reference to a customer, in case of the basic data i.e. General Data, the
    datas that are copied are
    1. Country.
    Under Company Code data, the following are copied,
    1. Reconcilation Account.
    Under Sales Area Data the following are copied,
    1. Currency.
    2. Shipping condition.
    3. Account assignment group.
    4. Taxes.
    Regarding your question, you can change the data and there is no concept of copying control here.
    Regards,
    Sarthak

Maybe you are looking for