Custom Administrator roles

The default admin roles all have write access to some data - policies, user info, etc. How do I create an admin role that has read-only access to user attributes?

login to amconsole http://host:port/amconsole as amadmin
create a new role>>services>>user Modify Access Then check out all attributes which you wish as read only>>OK>> Save. Then this role of users will not have the permission to change those read only attributes. Jerry

Similar Messages

Functional and Technical Administration Roles in Solution Manager

Hello
A big company has been implementing new functionality in Solution Manager during the last couple of years, they started with System Monitoring and EWA, Maintenance Optimizar, then Project Implementation, now Service Desk and ChaRM. This is company has a wide open structure in IT and a discussion has been raised about who is the owner of soluton manager in IT.
In my experience I always propose two main roles one is Technical Administrator Role and the other is Functional Administrator role. The former is more basis oriented, in charge of the installation and update of stacks in Solman, basic-initial configuration and then working mainly in setting Solutions, RFCs, System Monitoring, EWA, SAP services, OSS connections, Diagnostic, E2E Root Cause Analysis and also support in ChaRM (in setting up the transport routes, security)
On the other hand, I support a role of SolMan Functional Administrator which deals with Implemenation side, ASAP methodologies, business process definition, integration with ARIS, setting up project standards, coaching Project Managers, ensuring good application information. Also in Service Desk and ChaRM, setting the process, customizing, implementing and controlling that things are running smooth in SolMan productive.
I would like to get from you your inputs and experiences regarding how to set-up those roles, whether there are clear lines to divide responsiblities or what kind of definitions should be made.
Many thanks
Esteban Hartzstein
Director
Tebyon Consulting

As recommended by some colleagues I am also investigating Customer Center of Excelence as a reference to define roles and responsibilities, particularly in the concept of Application Lifecycle Management.
Any other input is welcome.
Regards
Esteban

Assessment - Planning Page will not show in Custom MSS Role

I have gone through the Notes/Docs for setting up OBN for Performance Management and have implemented the same.
Now if I go to the Standard MSS role and try to open up Assessment > Click on 'Create' for Succession Planning, it works fine by showing up the Talent Assessment window where it can be completed.
Now, we have a custom MSS role copied from the standard one and I have included the same Talent Management workset (with the page, folder inside - just like the standard role).
But when I try the same scenario as above (Z_Manager_role > Talent Management > Assessment (from Service Map) > Click on Create under Succession Planning), I get the following error.
There is no iView available for system "SAP_ERP_HumanResources": object "employee". For more information, contact your administrator.
Why would it work on the standard role and not the copy? Any directions highly appreciated.
FYI. We are on 7.01 SP8, SAP_MSS 600 SP18
Thanks,
BR
Edited by: BR on Oct 5, 2011 12:38 PM
Edited by: BR on Oct 5, 2011 12:39 PM

Thanks Sidharth.
Sorry for not getting back earlier. I had opened a message with SAP. It looks like the problem has to do with Navigation Targets in my custom MSS role - so that is narrowed down now.
The following prerequisite applies: You must include the navigation targets (for the portal pages mentioned below) in your role.
pcd:portal_content/com.sap.pct/line_manager/com.sap.pct.erp.mss.bp_folder/com.sap.pct.erp.mss.14.bp_folder/com.sap.pct.erp.mss.14.pages/com.sap.pct.erp.mss.hcm/com.sap.pct.erp.mss.appraisal_document_wd_ui
pcd:portal_content/com.sap.pct/line_manager/com.sap.pct.erp.mss.bp_folder/com.sap.pct.erp.mss.14.bp_folder/com.sap.pct.erp.mss.14.pages/com.sap.pct.erp.mss.hcm/com.sap.pct.erp.mss.appraisal_document_pmp
How do I include these navigation targets in my custom MSS role? I mean these pages are not part of the role.
Thanks,
BR
Edited by: BR on Oct 14, 2011 11:46 AM

Custom Administrative Template Error 53 Key name specified more than once

Hi All,
Hope I've picked the correct forum. I am making my first foray into setting up a custom administrative template for some software that is developed in house. The current deployment method is to merge a reg file on each computer that requires the registry
settings. I am trying to set this up so that it is controlled via GPO.
My idea is that in the a GP can set the registry settings for one or more areas that are controlled by the software.
The problem I have - I get Error 53 Keyname specified more than once on Line 9 (second KEYNAME). In total I will have about 30 different sites this needs to be set up for.
Does this mean that I can't set more than one registry key per "Policy" setting in the GPO?
The adm file I have so far is below
TIA
Jason
---------------------------------------------CUT---------------------------------------------
CLASS User
CATEGORY "App Site Settings"
POLICY !!Site1Policy
EXPLAIN !!Site1Explain
KEYNAME "Software\ApplicationCompany\Site1\Access"
VALUENAME "SystemDatabase"
VALUEON "D:\\App\\Data\\App.mdw"
VALUEOFF DELETE
KEYNAME "Software\ApplicationCompany\Site1\Arbitration"
VALUENAME "ConfigPath"
VALUEON "D:\\Site1\\Data"
VALUEOFF DELETE
KEYNAME "Software\ApplicationCompany\Site1\Common Settings"
VALUENAME "ConfigFile"
VALUEON "D:\\App\\Data\\App_Comms.mdb"
VALUEOFF DELETE
VALUENAME "SysConfig"
VALUEON "D:\\Site1\\Data\\SITE1_SYS.mdb"
VALUEOFF DELETE
END POLICY
POLICY !!Site2Policy
EXPLAIN !!Site2Explain
KEYNAME "Software\ApplicationCompany\Site2\Access"
VALUENAME "SystemDatabase"
VALUE "D:\\App\\Data\\App.mdw"
KEYNAME "Software\ApplicationCompany\Site2\Arbitration"
VALUENAME "ConfigPath"
VALUE "D:\\Site2\\Data"
KEYNAME "Software\ApplicationCompany\Site2\Common Settings"
VALUENAME "ConfigFile"
VALUE "D:\\App\\Data\\App_Comms.mdb"
VALUENAME "SysConfig"
VALUE "D:\\Site2\\Data\\Site2_SYS.mdb"
END POLICY
END CATEGORY
[strings]
Site1Policy = "Site1 settings"
Site1Explain = "Enabling this setting configures the registry settings for dummy Site1."
Site2Policy = "Site2 settings"
Site2Explain = "Enabling this setting configures the registry settings for dummy Site2."

Well - I ended up sorting this out - and no - you can't have the Keyname keyword twice - unless you enclose the the setting in a PART statement. Below is what I ended up with:
---------------------------------------------CUT---------------------------------------------
CLASS USER
CATEGORY "ApplicationSettings"
KEYNAME "Software\ApplicationCompany\Site1\Common Settings"
POLICY !!SITE1Policy
#if version >= 3
EXPLAIN !!PolicyExplain
#endif
KEYNAME "Software\ApplicationCompany\Site1\Access"
PART !!ConfigFilePolicy EDITTEXT
KEYNAME "Software\ApplicationCompany\Site1\Common Settings"
VALUENAME ConfigFile
DEFAULT !!ConfigFileDefault
END PART ;!!ConfigFilePolicy
PART !!SystemDBPolicy EDITTEXT
KEYNAME "Software\ApplicationCompany\Site1\Access"
VALUENAME SystemDatabase
DEFAULT !!SystemDBDefault
END PART ;!!SystemDBPolicy
PART !!SysConfigPolicy EDITTEXT
KEYNAME "Software\ApplicationCompany\Site1\Common Setting"
VALUENAME SysConfig
DEFAULT !!SysConfigDefault
END PART ;!!SysConfigPolicy
PART !!ArbitrationPolicy EDITTEXT
KEYNAME "Software\ApplicationCompany\Site1\Arbitration"
VALUENAME ConfigPath
DEFAULT !!ArbitrationDefault
END PART ;!!ArbitrationPolicy
END POLICY
POLICY !!SITE2Policy
#if version >= 3
EXPLAIN !!PolicyExplain
#endif
KEYNAME "Software\ApplicationCompany\Site2\Access"
PART !!ConfigFilePolicy EDITTEXT
KEYNAME "Software\ApplicationCompany\Site2\Common Settings"
VALUENAME ConfigFile
DEFAULT !!ConfigFileDefault
END PART ;!!ConfigFilePolicy
PART !!SystemDBPolicy EDITTEXT
KEYNAME "Software\ApplicationCompany\Site2\Access"
VALUENAME SystemDatabase
DEFAULT !!SystemDBDefault
END PART ;!!SystemDBPolicy
PART !!SysConfigPolicy EDITTEXT
KEYNAME "Software\ApplicationCompany\Site2\Common Setting"
VALUENAME SysConfig
DEFAULT !!SysConfigDefault
END PART ;!!SysConfigPolicy
PART !!ArbitrationPolicy EDITTEXT
KEYNAME "Software\ApplicationCompany\Site2\Arbitration"
VALUENAME ConfigPath
DEFAULT !!ArbitrationDefault
END PART ;!!ArbitrationPolicy
END POLICY
END CATEGORY
[Strings]
ArbitrationDefault =D:\SITE\Data
ArbitrationPolicy =Arbitration path
ConfigFileDefault =D:\App\Data\App_Comms.mdb
ConfigFilePolicy =Application configuration file
PolicyExplain =Enter Explainition of the Registry settings here
SysConfigDefault =D:\SITE\Data\SITE1_SYS.mdb
SysConfigPolicy =Application site system configuration file
SystemDBDefault =D:\App\Data\App.mdw
SystemDBPolicy =Application system database path
SITE1Policy =Site1 Application Settings
SITE2Policy =Site2 Application Settings

Transfer customer specific Roles assigned to a customer from R/3 to CRM

Hello dear all,
on R/3 side there are customer specific roles defined and assigned to customers. These roles are sales area depending.
On CRM side we plant to uses the Employee Responsible relationship to build up these customer specific roles. To differentiate these roles we want to use the partner function which is assigned to the sales area.
Can anybody show me how to do the initial load of the CRM system and map the role to the Employee Responsible relationship?
I assume that I have to create a own mapping function module to realize this. Where do I register this function module so it will be used during the initial load? How do I debug these functionality?
A similar functionality we have to build up in case of the upload to the R/3 system. There we have map the Employee Responsible relationship to the specific role and assign it to the customer. Where do I register this function module?
Thanks for your help!
Best regards
Michael

hi
In order to replicate the ECC customer to CRM customer the following steps (tips) might be helpful to you:
First a Mapping structure should exist between business partners in SAP CRM and ERP ECC Customers in both the directions. In the ERP ECC system you can see this mapping using transaction /nPIDE
You should create your own account group for the data transfer from SAP CRM to ERP ECC
In SAP CRM, the roles sold-to party, ship-to party, bill-to party and payer are assigned to the classification Customer and the customer is assigned to exactly one account group in ERP ECC
For consistent distribution of Business Partners with identical numbers in both the systems, the internal number range (ex. 1-5999) should correspond to an external number assignment in the ERP ECC system or vice versa. Thus a business partner is given the same number in both systems.
For data exchange to be successful, you must ensure that the field control (mandatory fields) between the CRM system and the ERP system matches.
Besides Both SAP CRM and SAP ECC can talk to each other only when there is some settings done in the middleware. And for the CRM only a small plugin is needed for the ERP/ECC Connectivity.
Now whenever you have both the system mapped then if you create a BP in CRM it will automatically flow in the ERP System. And also the vice versa. As for the roles are concerned, the roles like ship-to-party and some few specific roles are mapped in ECC system. For a complete look at roles matching have a look at the following link.
http://help.sap.com/saphelp_crm50/helpdata/en/52/cff837a9aae651e10000009b38f8cf/frameset.htm
Once you have created a BP in CRM it will be created in some Account group in ECC. And in that AC GRP you will be not be able to create the Customer with identical ID. So if your systems are connected then even manually you also cannot create same BPs.
And for all of these the PIDE settings in ECC needs to be maintained properly.
Hope it serves your purpose
best regards
ashish

OES MAPI problem of "Assigning Principals to an Administration Role"

Hi,
I meet the problem of programmatically Assigning Principals to an Administration Role using Oracle Entitlement Server Management API. I can successfully run the sample code following the <Developer Guide>, Chapter 5.4.3 Assigning Principals to an Administration Role
My code snippet is like this:
List<PrincipalEntry> principals = new ArrayList<PrincipalEntry>();
     principals.add(new BasicPrincipalEntry
       ("weblogic.security.principal.WLSUserImpl", "Lisa"));
     //Grant the users in the list the role
     admManager.grantAdminRole(adminRole, principals);
And no error or exception occurs in java app side or oes_admin side. But when login to http://vmware.localdomain:7001/apm admin GUI, I could not login with Lisa.
I also tried manually assign app1 with delegated admin role, and then Lisa can successfully login to admin GUI.
Then I run the app program to programmatically assign app2 with delegated admin role to Lisa. Login with Lisa could not see app2.
I have checked the system admin "weblogic" login to admin GUI and it can see that app2 already have Lisa listed on the external user of delegated admin of app2.
I even checked the DEV_APM.JPS_CHANGELOG in the oracle database schema for oes. I can see the changelog of java app assiging operation.
Can anyone tell me the reason why programmatically assign user to an delegated admin not work correct? Is there some mistake steps in my java app code or there is a bug in OES product?
I use the OES 11.1.1.5 version with Oracle Database 11.2.0, Weblogic 10.3.5 on Oracle Enterprise Linux 6 32bit.
Thanks very much.

Thanks very much for all the reply posts. With the suggestions from yours, I tried distribute the policy and finally it works!
The code snippet is from 4-8 Using the distributePolicy() Method , listed below:
//get the PolicyDistributionManager
PolicyDistributionManager pdm =
app.getPolicyDistributionManager();
//distribute policies
String distID = pdm.distributePolicy(true);
DistributionStatusEntry status = pdm.getDistributionStatus(distID);
System.out.println("Start distribute policy");
while (status.getPercentComplete() != 100) {
Thread.currentThread().sleep(200);
System.out.print(".");
status = pdm.getDistributionStatus(distID);
System.out.println("Finish distribute policy");
There is another trick that I discovered from DEV_APM.JPS_CHANGEBLOG:
If this is the first time that user be assigned as a delegated admin, you should also grant user with applicaionRole "APMViewer" to the application "oracle.security.apm"
You can refer to the sample code from 2-9 Assigning Principals to an Application Role , also listed below:
ApplicationPolicy app = ps.getApplicationPolicy("oracle.security.apm");
AppRoleManager roleMgr = app.getAppRoleManager();
//Construct the list of users to be granted
List<PrincipalEntry> principals = new ArrayList<PrincipalEntry>();
principals.add(new BasicPrincipalEntry
("weblogic.security.principal.WLSUserImpl", "Nick"));
//Grant the users in the list the role
//admManager.grantAdminRole(adminRole, principals);
AppRoleEntry appviewerRole = roleMgr.getAppRole("APMViewer");
roleMgr.grantAppRole(appviewerRole, principals);

Not able to work with customized Java roles which were edited in ABAP stack

Hello All,
I am trying to copy standard roles into customized roles (i.e. Z roles) using PFCG in XI system. All ABAP based roles are working fine, but all JAVA based roles are not working. I generated profiles as well. And I check all the authorization objects in both standard and customized roles. Everything look same but customized roles are not working.
And when I check the logs on JAVA stack I found the error which says " User XXXXXXXXXX IP address HTTP request processing failed. HTTP error [403] will be returned. The error is [You are not authorized to view the requested resource.No details available]."
I thought there might be any Jco RFC connections missing between the stacks and I tried to check in Visual Admin, but I was not able to find much info regarding these roles.
Am I missing anything or is there any other way for these roles to make customized roles.
And can any one tell me how to run a trace for JAVA stack activitites as we do in ABAP using ST01. Any help will be rewarded. Thanks in advance.
Regards,
Farooq.

Java roles work with influence of permissions in Application Server which we call actions in UME. As you are aware in PI user master record will be in ABAP stack. So the roles in ABAP stack will be having only RFC connections to JAVA stack for the specific JAVA based role. So you need to edit the permission on Java App Server. For that you need to log on to server through visual admin and then go to services and you will find the standard groups assigned to actions. But I dont remember that under which service you will find them
Under that service you will find some 200 actions. And you have to add the name of the custom created JAVA roles on ABAP to all those actions where you find the standard roles. And its a very very lengthy procedure. So SAP advice to go for customized ABAP roles and Standard JAVA roles.
Hope this answer clears your query.
Farooq.

Request Offerings not showing up for custom User role in SMPortal

Hello All,
I've created a custom End User role and scoped it to the domain users group.
To this role I want to show a specific set of Request Offerings on the portal
For that Purpose I created a new Service Offering and added these Request Offerings to it.
I then went on to create a Catalog Group and added the Service Offering to it.
I then created the custom user role based on the EndUser role and allowed them to see all Forms, all Queues, All CI's and on the Catalog group I select that they could only see the Catalog Group which I just created.
I then logged in into the SMPortal and was expecting that my Service Offering would be shown to them.
However, they don't see the service offering.
What could cause this?
Is there something I'm missing?
Thanks in advance!
Filip

You have to add the Service Offerings and the Request Offerings in the Catalog Group. Nesting doesn't work because Service Offerings and Request Offerings are different types of objects.
This offers the option the manage the access to Service Offerings and Request Offerings very granular if needed. For instance you can control access to a Service Offering in one Catalog Group related to one user role (A) and use two additional Catalog Groups
with different Request Offerings related to other user roles (B) and (C). Result will lead to:
User in Role A and B -> Can see Service Offerings A containing Request Offerings B
User in Role A and C -> Can see Service Offerings A containing Request Offerings C
User in Role A, B and C -> Can see Service Offerings A containing Request Offerings B and C
User in Role A only -> Don's see anything because of the missing permission on any Request Offering. So the "empty" Service Request won't show up in the portal.
Hope his helps.
Andreas Baumgarten | H&D International Group

Transaction launcher not working for custom business role in WEB UI

Hi Experts,
we have maintained a link for activity reports in web Ui which triggers a program Z_CRM_TIME_REPORT . we have maintained the logical links and assigned them to the custom business role. when we run the program in SE38 in GUI its working fine but we are facing the problem when we click the link in WEB UI we get a different screen related to BP and not the activity report.Kindly suggest what are the configuration need to be tested.
Thanking you,
Deepa

My guess would be that the parameter stated in the logical link (navigation bar customizing) that you use is incorrect. This should be the name of the transaction launcher definition you have maintained.
Otherwise, check the transaction launcher wizard to see that the report is maintained correctly.
Hope this helps.
Regards,
Pieter Rijlaarsdam

How to create SR Queue and Custom User Role for technician only see which SR assigned Him/Her and Resolve

Hi
I have created workitem SR advance and Criteria with ID [Assigned To ME] and created user role in Advance operators.
But in technician Console showing which SR he/she created not service desk assigned to him/her.
Please suggest...
Regards
Sheetla Maurya

I have find out Solution .......Create Queue with Service Request Advance and we not need to create any criteria option, After that create custom User role on Advance
operators with View "Assigned To ME"
Regards
Sheetla Maurya

Administrator role

Hi,
I have just installed Contribute CS3 a day ago, and have been
getting to grips with it.
I won't need any other 'writers' or 'publishers', just the
one Administrator role, but I would like it to ask for a password
sometime before it allows me (or anyone) to editor the website on
starting up Contribute . . . . . but it doesn't!!
When I set up the administrator, I did give it a password
where it asked.
What could be wrong?
Cheers
Greg

Hello,
I have provisioned a user with Planning admin access. And later when i provision him with Essbase admin access, he is not able to see any Essbase applications. I have refreshed security from shared services for Essbase, but that doesnot work. I am using version 11.1.1.3 and shared services, workspace services, planning and Essbase services are installed on Unix.
In shared services, when i navigate to Application Groups-> Essbase -> Essbase Server and then right click to "Assign Access Control", I am getting 'page cannot be displayed'.
In EAS -> Users, 'Application access type' is coming as planning.
Can anyone please suggest on how a planning user can be given access to Essbase.
Thanks,
- hg

Administrator Role Deleted in Portal???

Hi all,
Accidentally administrator role deleted in UME.When i login j2ee_admin i deleted administrator role in UME what i do Now plz tell me. How i found administrator role ???.Because sap predefined administrator role to j2ee_admin So i am not able to working in portal in UME all button is disabled.
Help me Plz
Thanks & Regards
Kumar
Message was edited by:
Kumar

Hello,
May be you cud try out this:
First of all give the user (J2ee_Admin) SAP_J2EE_Admin group.
Now login to the usera administration of J2EE using the User with SAP_J2EE_Admin group.
Next go to useradministration and then give the user (Self) different admin roles
such as super admin, system admin, content admin etc.
Hope this helps you.
Regards,

Administrator Role deleted ???

Hi all,
Accidentally administrator role deleted in UME.When i login j2ee_admin i deleted administrator role in ume what i do Now i am login via j2ee_admin it gives error what i do plz tell me. How i found administrator role ???
Help me Plz
Thanks
Kumar

Hi Kumar:
For all the non UME Roles content in Portal has some action. So I guess for Administrator Role should have an action pertaining to its admin responsibilities. Try to Create Role under Identity Management and assign the action equivalent to it.
Goto:
User Admin > Identity Mgmt > Role > Create User > Give Name > Assign Action.
Note: I'm currently not at EP server for few days, plz check the option said above and I hope they might work for you.
If my guess is correct, you can get the Action for already existing Administrator Role from other EP Server in your organization.
Tnx,
Munna SAP

Custom Administration Setting (Visual Studio form dll)

I am developing a custom extension to SCSM that needs an administration settings page. I have the MP created and the SCSM part in place. Also the WPF User Control dll part, but the link between the two is the trouble. I have used Travis
Wright’s article for the MP stuff:
Creating a Custom Administration Setting
But get this message when accessing the dll from the SCSM console.
Any sample VS project or help?
/Kim

I'm afraid the screenshot doesn't provide enough information about the error.
Have you stepped through your code yet to find out where the error is occurring? If you're unfamiliar with how to do that: In Visual Studio, Debug|Attach to Process, attach to the Microsoft.EnterpriseManagement.Monitoring.Console.exe. Set a break-point at
the first statement in your ExecuteCommand method, then double-click your admin settings in the console. If your DLL is properly installed, you should hit the break-point right away.
If you're not hitting your break-point but still seeing the exception, it's likely something is out of whack with your MP or the way your DLL is setup.

Business Connector - Read only - Administrator role

Hi Community,
We've currently got SAP 4.8 running in our environment.
The situation is that often developers need to check the extended settings, logs, or what jobs are scheduled.
The two main roles are Developer or administrator.
The only way to get access to the web GUI admin page is to assign the administrator role.
Does anyone know how to assign a "read-only" role for the web admin page?
I would then assign this to a developer rather than give them full administrator access on business connector.
Kind Regards,
Chris

To the best of my knowledge thats not an option.
But like to hear it if otherwise.
Regards
Juan

Custom Administrator roles

Similar Messages

Maybe you are looking for