CRM - Process Flow of Authorization Check in Business Transactions

Hello Folks:
I have implemented CRM security using Process Flow of Authorization Check in Business Transactions.
What I have in place:
CRM_ORD_OP (inactive, don't want access to own documents)
CRM_ORD_LP (inactive, not using standard org level values Distribution Channel, Sales Group, Sales Office, Sales Organization, and Service Organization.)
CRM_ACT (active)
CRM_CMP (active)
CRM_ORD_OE (active, restricted to display with dummy value ' ' for Distribution Channel
Sales Group, Sales Office, Sales Organization and Service Organization, as we are not restricting on them)
CRM_ORD_PR (active and restricted to display)
Issue:
Restrictions to display for documents works fine when using CRM backend system and the system throws out a message that you are not authorized to change. But, when i come in through Portals (PCUI), i dont get the display at all and it throws out a message insufficient access authorizations.
Traces on backend CRM reveal failing on change access for CRM_ORD_LP and CRM_ORD_PR, which we dont want to give out b/c we dont want to provide change for documents.
OSS notes to SAP have resulted in no results....please advise what is wrong here.
Thanks
KT

Thanks for the Priyanka for the reply, but what you mention is not correct.
BSP errors are different from what I am refering to.
The issue is still open...and looks like a SAP bug, which even they havent been able to fix so far.
Regards,
KT

Similar Messages

Authorization Check in Business Transactions

Hi All,
i need to create Authorization Check for Business Transactions ( create/display/change ).
The standart sap Authorization object CRM_ORD_OP or CRM_ORD_LP is no good for me .
does anyone know a BADI or something else i can use ?
Thanks
Lilach.

I would suggest to give the authorization with CRM_ORD_OE if he isn' t in the document may be he is the organization which is selected on the activity..
For details, please have a look at this link :
http://help.sap.com/saphelp_crm70/helpdata/EN/48/a44236ceb873e8e10000000a42189b/content.htm
BR,
Cenk Sezgin

Authorization Check in Business Transactions in CRM 2007

Hi everybody, I have a problem whit the authorization check in CRM 2007.
This link help me to follow the steps
http://help.sap.com/saphelp_crm60/helpdata/en/e9/b29a39e7aee372e10000000a11
I follow this steps:
1.- Created a new single role on the PFCG
2.- On the Menu tab add the transaction BSP_CRMD_BUS2000108 (Trax for LEADS)
3.- On the authorization tab create a new profile and in the authorization data set the values for CRM_ORD_OP: PARTN_FCT 00000012, PARTN_FCTT *, ACTVT '02,03
4.- Generate the authorization.
5.- Set my user "TESTUSER" on the user tab
6.- Save the profile
Then, I login to CRM whit TESTUSER and I see all the leads. I miss something, what could be the problem ?
Thanks for your help

Hi Shaji, Pankaj and Jushan, thanks four your answers.
I still have the same problem, I want to see only my leads that I´am the responsible, after I generated the authorization and assign the role to my user from tcode PFCG and SU01, I logout and login again and no changes, I still see all the leads.
Another test I made, I changed the authorization data and set the values for CRM_ORD_OP: PARTN_FCT , PARTN_FCTT 0008, ACTVT ' (person responsible) and the results was the same, see all the leads.
How works the User Comparisons and how can I check for errors in my pfcg role ?
Thanks for your help.

CRM Process Flow and Documentation

Hi,
I am new to CRM (But i have 6 months SRM experience), i am trying to learn CRM.
Can anyone suggest me the process flow in CRM and can please send any documentation in CRM like CRM100,CRM300,CRM800 materials to my mail id.
Here is my mail id: <removed by SDN Forum Moderator>
I really appriciate your response.
Thanks,
Ramya.

Hello,
Did you happen to read this:
"Be aware, the receiving, requesting or distributing of copyrighted material by any means other than those set forth by the owner of said material is against the law. DO NOT request such material nor distribute such material on SDN, and for your own good I would not recommend you do it anywhere else either."
Ref: step by step in Bw
The best and most fruitful way to get this material is by attending the SAP courses.
Best regards
Gregor

Authorization Check for Business Partner screen

Hi!
Is it possible to exclude certain business partner information from being
processed or displayed in the business partner screen of Sales Order
(VA01/ VA21...) by restricting the authorizations? Thanks!
Just something similar to what is suggested for condition types in OSS notes 105621.
Best Regards,
Chris Poon

Thanks Mani for answering,
However, I am looking for ways to do it for the same TCode (VA01...) instead of creating a new TCode.
I tried using the user exit USEREXIT_FIELD_MODIFICATION in MV45AFZZ.
Display/hide Customer related field according to user authorization
IF SCREEN-NAME = 'GVS_TC_DATA-REC-NAME1' OR
     SCREEN-NAME = 'GVS_TC_DATA-REC-STREET' OR
     SCREEN-NAME = 'GVS_TC_DATA-REC-POST_CODE1' OR
     SCREEN-NAME = 'GVS_TC_DATA-REC-CITY1'.
    AUTHORITY-CHECK OBJECT 'ZV_DOC_CUS'
    ID 'ACTVT' FIELD 'L1'.
    IF SY-SUBRC NE 0.
      SCREEN-ACTIVE = 0.
    ENDIF.
ENDIF.
But it does not works at all
So I wonder if there is any other user exit to control the fields in Business Partner Page? thanks!
BR,
Chris Poon

Need to hide tabs in CRM 5.0 SAP GUI for a business transaction

Hi all,
I've created a custom complaint transaction in CRM 5.0, and I need to hide some tabs and fields when I create it or edit it via SAP GUI. I've searched through the help, and I figured out that probably I have to use transaction CRMV_SSC, but than I'm blocked.
Has anyone some hints or guides that can help me?
I you have any documentation, please send to [email protected]
Thank you a lot,
Daniele.

Hi,
if you activate the technical names in the menu, you'll see that transction for maintaining sales transactions is called:
crmd_bus2000115
So there you have it, it's BO BUS2000115
regards, Rob Dielemans

Authorization flow Business Transactions

Hello partners,
I have a issue with the authorization flow concept.
My need is :
A.- the transaction type z01 is only for the user that belong to unit org A, object CRM_ORD_OE
B.- the transaction type z02 is only for the for own transactions of the employee, object CRM_ORD_OP
C.- the transaction type z03 is access for all users and not depend of unit org or his transaction.
So I have doubt with the combination of all of them, how can indicate to the system that for A scenary, I need the restrict only if the transaction type is Z01? and for the scenary B only for Z02, and the scneary C without restrictions?
this is the help sap documentation:
Process Flow of the Authorization Check in Business Transactions - Authorization Check in Business Transactions - SAP Li…
Regards
Roberto.

Thanks Christophe,
I analize the FM CRM_ORDER_CHECK_AUTHORITY_ACE,
but when I try to search activities in the SALESPRO, component view BT126S_APPT/ApptSQ, the break not work,
in others view like search service request, work ok the FM,
but for search activities not work,
I'm not sure if I need a specific Switch for that.
Do you know?
Regards

Process flow completed successfully but flagged as BUSY in OWB ?

Hi, I have several process flow jobs that are scheduled to run each night.
All steps of the process flows completes successfully (checked in Workflow Manager and Warehouse Builder Browser), but the overall status is always set to BUSY in OWB Browser.
I have seen earlier related threads in this forum regarding the termination of jobs left in a BUSY state (through problems with the process flow etc), but why are my jobs being flagged as busy ?
Seems like the completed successful status is not getting through to OWB Browser.
Any ideas ?
Thanks
Paul

Login to SQL PLUS as Workflow owner and run
call wf_purge.Move_To_History(null,null)
Search this forum for posts from Oleg from Kiev. He knows what he is doing and his posts helped me a lot. I have seen few posts from him related to this subject.
Vladimir

BUSINESS PROCESS FLOW (BPF) TASK SETUP - CURRENT VIEW OPTIONS

This article explains a few findings regarding the options on Current View Type for setting up Business Process Flow tasks and will discuss BPC for Excel, Data Manager and BPC Web tasks.
Future posts will cover more tasks.
This is valid for 5.x versions only.
IMPORTANT NOTE:
DATA MANAGER PACKAGES
    Data Manager Packages tasks such as Run Specific Package, Run User Package are not integrated
    with the Current View Type selection. Therefore, the options Inherit from Data Region, Inherit from
    Current View or Member Lookup does not work on Data Manager Packages. This is due to the diversity of Data Manager Packages, such as Import, Export, Clear, Default Formulas, each of them requiring a complete different set of parameters, some of them not related to the Current View.
1. INHERIT FROM DATA REGION
Once you choose to Open a BPF from BPC for Excel, you are prompted to choose the Data
Region. Upon setting the desired Data Region, the Current View is changed
accordingly on BPC Web.
    OPEN TEMPLATE / REPORT LIBRARY / SCHEDULE LIBRARY
    If a step is defined as Open Template/Report Library/Schedule Library
    and INHERIT FROM DATA REGION is set to one (or more) of the Data Region
    dimensions, the Current View on BPC for Excel should change to match
    the settings done Data Region settings, being the same as the one on BPC Web.
    SET WORK STATUS
    Same as above.
2. INHERIT FROM CURRENT VIEW
    OPEN TEMPLATE / REPORT LIBRARY / SCHEDULE LIBRARY
    If a step is defined as Open Template/Report Library/Schedule Library and INHERIT FROM
    CURRENT VIEW is set to one (or more) dimensions, the report will pickup the Current View
    from BPC Web and BPC for Excel should change to match the Current View,
    being the same as the one on BPC Web.
    Example:
    1. Log on to BPC Admin on ApShell -> Manage Application Sets;
    2. Go to Business Process Flows -> Budgeting Process;
    3. Grant access to the BPF to your test user;
    4. Check Sub-Step 1 of Step 1 - Check Budget Data. This steps has a
       INHERIT FROM CURRENT VIEW setup (ENTITY).
    5. Log on to BPC Web on ApShell;
    6. Go to Open a Business Process Flow and choose Budgeting Process;
    7. Choose the desired Data Region;
    8. On BPC Web, verify the value setup for ENTITY on the Current View;
    9. Open the Check Budget Data;
    10. The ENTITY on the Current View will be set up accordingly to what
        was set on BPC Web.
    SET WORK STATUS
    Same as above.
3. MEMBER LOOKUP
    OPEN TEMPLATE / REPORT LIBRARY / SCHEDULE LIBRARY
    If a step is defined as Open Template/Report Library/Schedule Library and MEMBER LOOKUP
    is set to one (or more) dimensions, the report will set the Current View
    on BPC for Excel to the member that was configured.
    Example:
    1. Log on to BPC Admin on ApShell -> Manage Application Sets;
    2. Go to Business Process Flows -> Budgeting Process;
    3. Grant access to the BPF to your test user;
    4. Check Sub-Step 1 of Step 1 - Check Budget Data. This steps has a
       MEMBER LOOKUP setup (CATEGORY).
    5. Log on to BPC Web on ApShell;
    6. Go to Open a Business Process Flow and choose Budgeting Process;
    7. Choose the desired Data Region;
    8. On BPC Web, verify the value setup for CATEGORY on the Current View;
    9. Open the Check Budget Data;
    10. The CATEGORY on the Current View will be set up accordingly to what
        was set on the Task configuration, in other words, there should be BUDGET set
        on the Current View.
    SET WORK STATUS
    Same as above.
REFERENCES
This is an unofficial addendum for the SAP BPC 5.1 ADMINISTRATION USER'S GUIDE on:
PAGE 54 - Managing Business Process Flows
PAGE 57 - Adding new business process flows -> To add a step -> Select the current view type
SAP BPC 5.1 ADMINISTRATION USER'S GUIDE can be found on [BPC Instalation Guides and User Guides|http://service.sap.com/instguidescpm-bpc].
Edited by: Gustavo Bortoloti on Dec 15, 2008 6:48 PM

Hi Gustavo Bortoloti,
That's right, the SAP BPC version 5.x SP x not have the specific setting.
Thanks,
Wandi Sutandi

Control process flow from Business Rules

hi
i would wish to control the process flow in BPEL by using Business Rules(based on conditions) rather than using Switch. how can i accomplish this? please do help me in this.

what do you mean with control the process flow? Do you mean to destine which partner link is called? Or just make some decissions through the business rules and use a switch afterwards....
If you are talking about controlling the partner link to be called, then you should have a look at the chapter three of the cookbook
http://www.oracle.com/technology/pub/articles/bpel_cookbook/carey.html
You could use the outcome of the business rule to make a decission which endpoint reference to use. Perhapes even return the endpoint reference from the business rule...
Greets Jens

Process flow hangs in state "bussy"

Hi,
We are encountering what seems to be a "random" problem when runing process flows. In about 1 out of 4 runs the flow "hangs" with status "busy"
The technical specs are as follows:
OWB 9.2.0.2.8 on WIN2K Server SP4.
There are two runtime repositories on two different WIN2K database servers (Oracle 9.2.0.4 EE)
The symptoms are as follows:
- We have more than 10 process flows containing from 15 to 60 processes. The problem is not related any single process flow, and occurs on both our target servers.
- The process flows runs OK in approximately 3 out of four runs.
- When the process flows "hangs", one or more of the processes in the process flow also hangs in the "busy" state. The hanging process can be a mapping or an external process
- The processes that have status "busy" have actually finished. They have a completion time set, and in the case where the process sends mail, the mail has been received. In the case of mappings I have verified that the mapping has completed, and that the session performing mapping has terminated.
- When the problem occurs, there is always the same "lock" pattern displaying in OEM:
Username Session IdLockMode HelMode Requ Object Name ROWID Object OwnObject T Resource ID1 Resource ID2
OWBRT92 17TM ROW SHARNONE WB_RT_SERVICE_QUEUE_TAB OWBRT92 TABLE 61161 0
OWBRT92 17UL EXCLUSIVNONE 1073741824 0
OWBRT92 48TM ROW SHARNONE WB_RT_NOTIFY_QUEUE_TAB OWBRT92 TABLE 61145 0
OWBRT92 67TM ROW EXCLNONE WB_RT_NOTIFICATION_COMPONENTS OWBRT92 TABLE 61137 0
OWBRT92 67TM ROW EXCLNONE WB_RT_NOTIFY_QUEUE_TAB OWBRT92 TABLE 61145 0
OWBRT92 67TM ROW EXCLNONE WB_RT_NOTIFICATION_ACKS OWBRT92 TABLE 61141 0
OWBRT92 67TM ROW SHARNONE WB_RT_NOTIFICATION_STREAMS OWBRT92 TABLE 61135 0
OWBRT92 67TM ROW EXCLNONE WB_RT_AUDIT_EXECUTIONS OWBRT92 TABLE 61199 0
OWBRT92 67TX EXCLUSIVNONE 262151 87564
Session 17 is the runtime service, and these two locks are present under normal operation. Session 48 is the Sqlplus session runing the execution template, and session 67 is (i think) the session that is causing the problem.
- The advanced queue WB_RT_NOTIFY_QUEUE tab shows "Number in state ready" equal to the number of processes still in the state "busy" i the process flow.
- When the runtime service is stoped (using the stop_service.sql) The locking sessions disappears.
- When the service is restarted, the processes change status to "bussy recovery" There is now a RPE-01008 and a RPE-01009 message in the "errors" section for the mapping.
- After the failed recovery, everything looks normal, except that there are now twice the number of messages in state READY on the WB_RT_NOTIFICATION_QUEUE. The only way I have found to get rid of these is to delete them from the queue table.
Is this a known problem? We are about to go live in a few weeks, and this could be a serious show stopper if we can't rely on the daily process flows to run as expected.
I could log a TAR on this, but I suspect support would ask for a test case, and Im going to have a hard time providing it for them in this case.

Jean-Pierre,
Thanks for the update. I was afraid this was going to be one of those "hard to pinpoint" issues...
When the problems occurs the Worflow Monitor always shows the task status as "Notified".
The "Main routine" is no longer executing. The session that was executing the mapping has disconnected, and the mapping has completed successfully. (I have verified this by checking the rows in the target tables). Also, the problem is not restricted to mappings. Sometimes it happens to "mail notifications", and in these cases the mail message is received as expected.
It looks to me like there is some kind of synchronization problem between AQ and the controlling process (the runtime access user session) that can arise under a given condition (which I unfortunately have not been able to determine what is). As far as I can tell, the process executing the mapping completes and puts the message that it has completed on the Notify_Queue (hence the messages in stat "Ready" on the queue), but for some reason the process waiting to read the message fails to do so.
As for a test case, I have recently sent an export of our design repository to Igor Machin. Is it possible for you to have a look at that? As I mentioned in the first post, our Process Flows are fairly complex. Some of the flows are executing 50+ mappings in parallel.

Process Flow - ordering of mappings

hello group,
i've developed a simple process flow which loads several mappings in a sequence.
it has to be stated that mapping A has to be loaded before mapping B.
when i am running this process flow i get a litte bit confused.
in the job details mapping B is loaded before,
in repository browser the same information.
does this really mean, that mapping B is loaded before mapping A?
or how can i check if the ordering was ok?
are there some mechanism inside the process flow editor to check this?
thanks for your infos,
s.v.e.n

Hi,
the owb has a problem when you place a new operator (e. g. a mapping) into an existing workflow or change the transitions. After this for the source object of this new object the outgoing transitions will get a wrong and duplicate number.
You can find these problems as rep_owner with the following script:
select *
from all_iv_process_transitions
where (source_activity_id, transition_order) in
    select source_activity_id, transition_order
     from all_iv_process_transitions
    group by source_activity_id, transition_order having count(*) > 1
order by source_activity_id, transition_order;You must change the number for these transitions.
PS: To control the correct order you can use the workflow manager. There you can see the ordering at runtime of a workflow.
Regards,
Detlef

Authorization check problem

Hello,
I would like to know if somehow is it possible to add an extra authorization check into a transaction. When the transaction PA20 is executed the following authorization object are checked:
PLOG
P_ORGIN
P_PCLX
P_PERNR
None of these object allow to filter by company code. Could I modify the PA20, so it could check an extra object to filter by Comany code without writting any code?

Hi Jesus,
As Jose mentioned, using the org key (VDSK1) is the easiest and recommended way by SAP.
But, if you are already using it for some other purposes, some options are available to you:
1- use the standard string split option to use a part of the VDSK1 (IMG) to capture the company code.
2- You can modify PA20 in the user exit section, through transaction code PM01. But again, I would recommend to use the VDSK1, it is much more simplier, and well SAP Supported.
Hope the 2- answered your second part of you question Cheers
Jean-Michel

Short dump "Time limit exceeded" when searching for Business Transactions

Hello Experts,
We migrated from SAP CRM 5.2 to SAP CRM 7.0. After migration, our business transaction search (quotation, sales order, service order, contract etc) ends with the short dump "Time limit exceeded" in class CL_CRM_REPORT_ACC_DYNAMIC, method DATABASE_ACCESS. The select query is triggered from line 5 of this method.
Number of Records:
CRMD_ORDERADM_H: 5,115,675
CRMD_ORDER_INDEX: 74,615,914
We have done these so far, but the performance is still either poor or times out.
1. DB team checked the ORACLE parameters and confirmed they are fine. They also checked the health of indices in table CRMD_ORDER_INDEX and indices are healthy
2. Created additional indices on CRMD_ORDERADM_H and CRMD_ORDER_INDEX. After the creation of indices, some of the searches(without any criteria) work. But it takes more than a minute to fetch 1 or 2 records
3. An ST05 trace confirmed that the selection on CRMD_ORDER_INDEX takes the most time. It takes about 103 seconds to fetch 2 records (max hits + 1)
4. If we specify search parameters, say for example a date or status, then again we get a short dump with the message "Time limit exceeded".
5. Observed that only if a matching index is available for the WHERE clause, the results are returned (albeit slowly). In the absence of an index, we get the dump.
6. Searched for notes and there are no notes that could help us.
Any idea what is causing this issue and what we can do to resolve this?
Regards,
Bala

Hi Michael,
Thanks. Yes we considered the note 1527039. None of the three scenarios mentioned in the note helped us. But we ran CRM_INDEX_REBUILD to check if the table CRMD_ORDER_INDEX had a problem. That did not help us either.
The business users told us that they mostly search using the date fields or Object ID. We did not have any problem with search by Object ID. So we created additional indices to support search using the date fields.
Regards,
Bala

Derived business transactions and TBB1

Dear experts,
My question concerns Money Market derived business transactions.
When I enter position outflows that are not transfer postings, the system generates derived translations that update the position components (proportionate reduction) u2013 DBT_E001/DBT_E002.
These translations are not relevant for posting, but have a status Planned.
The question: is it possible to fix these derived flows during posting of operative business transactions in TBB1?
Right now I can fix them only through TPM18, which is very inconvenient to run separately.
Any help would be appreciated.
Best wishes,
Irina

Hi,
In status control the setting is status of plan and hence the derived transactions will always be generated in planned status and you have to fix them through TPM18.
In order to post it through TBB1 itself, the control setting should have same status option. But check with the business also whether this is not going to have any other effect because this is at the central company code and valuation area level. All derived transactions will have the same status of the operative transactions itself.
Regards,
Ravi

CRM - Process Flow of Authorization Check in Business Transactions

Similar Messages

Maybe you are looking for