Custom Authorizer

I have created a custom Authorizer and RoleMapper for 8.1SP5. I have also implemeted a new a new Security Console Extension (SecurityExtensionV2), replacing the default WL screens. I have everything working except for one small item. When I try to create/edit a Web Application's Security Policy or Scoped Role the default "URL Pattern" screen appears. The text on the screen says that URL Patterns already defined are shown below. They are not. I cannot find any way to replace this screen or any methods in the Policy/Role MBeans that are being called to populate the list. Once I enter something into the input field, the getExtensionForPolicy() or getExtensionForRole() method is called with the correct resourse and url.
Any help would be greatly appreciated.
Joe [email protected]

Similar Messages

Custom authorization provider for WL7 problem (not getting all parameters from ContextHandler)

I'm implementing a custom authorization provider for WebLogic 7.
In my Access Decision isAccessAllowed method I need to check values of
the parameters passed to an EJB method. Now, if an EJB method I have
two parameters of the same type, for example int, when I get
ContextElement array from ContextHandler and iterate through it to get
names and values of the parameters I get the same value (value of the
first int parameter) from both ContextElement's.
Here is the code:
String [] names = ch.getNames();
for (int i = 0; i < names.length; i++)
String name = names;
System.out.println("name = " + name);//here it gets array of
Strings, which contains two parameter names: "int","int",
which are the types of EJB method parameters
ContextElement[] ces= ch.getValues(names);
for (int j = 0; j < ces.length; j++)
     ContextElement ce = ces[j];
     System.out.println(ce.getName()+ " = " + ce.getValue());
//here if the value of the first int was 2 and the second 0,
it would get 2 from both ContextElements (each of ContextElements will
have name "int"
If I try this with method parameters of different types, for example
int with value 2 and long with value 0, then this code work fine -
first ContextEleement has name int and value 2 and the second has name
long and value 0.
Thanks,
-Oleg Kozlov.

I'm implementing a custom authorization provider for WebLogic 7.
In my Access Decision isAccessAllowed method I need to check values of
the parameters passed to an EJB method. Now, if an EJB method I have
two parameters of the same type, for example int, when I get
ContextElement array from ContextHandler and iterate through it to get
names and values of the parameters I get the same value (value of the
first int parameter) from both ContextElement's.
Here is the code:
String [] names = ch.getNames();
for (int i = 0; i < names.length; i++)
String name = names;
System.out.println("name = " + name);//here it gets array of
Strings, which contains two parameter names: "int","int",
which are the types of EJB method parameters
ContextElement[] ces= ch.getValues(names);
for (int j = 0; j < ces.length; j++)
     ContextElement ce = ces[j];
     System.out.println(ce.getName()+ " = " + ce.getValue());
//here if the value of the first int was 2 and the second 0,
it would get 2 from both ContextElements (each of ContextElements will
have name "int"
If I try this with method parameters of different types, for example
int with value 2 and long with value 0, then this code work fine -
first ContextEleement has name int and value 2 and the second has name
long and value 0.
Thanks,
-Oleg Kozlov.

How to add custom authorization object to a SAP standard transaction

Hi All,
I have a standard tcode IW22 (change PM Notification) and I would lock changing when some users modify the field Functional Location (field TPLNR).
Since this field does not have an authorization object associated, I've tried to solve this problem with the following steps:
- tcode SU20 - creation of new authorization field TPLNR with data element TPLNR
- tcode SU21 - creation of a new auth object in transaction SU21 with name ZPM and field (TPLNR, ACTVT and TCOD)
- tcode SU24 - insert of new authorization field e check indicator (green)
- tcode SU22 - check indicator - check (green)
After this we have created a new role with PFCG and add transaction IW22; the new auth.ZPM was added manually.
We have try to analyze log (ST01 trace) but it seems no check was made in the trace file.
It seems new authorization object was not checked.
My question is: "Is it possible to add a custom authorization object into standard transaction and implementing authorization check without writing abap code in exit or badi ?"
Thanks
Maurizio

> My question is: "Is it possible to add a custom authorization object into standard transaction and implementing authorization check without writing abap code in exit or badi ?"
>
No .. not possible. The list of Auth. objects SAP proposed in SU24 for each Stnd. SAP TCodes are basically documentation of the Authority-Checks in the program for that TCode. The extra advantage of SU24 is to set the object status (means the proposal for availability in PFCG) among any of the four check indicators. So that we can provide our own value (customer specific values which are basically defined and separate from sap provided values) and reinforce the authorization concept of the organization.
So you need to provide a Authority-Check for ZPM in the program of IW22 to make sure that the fields you want to be checked are really being checked during execution of the tcode.
Regards,
Dipanjan

How to create and configure a custom authorization service

Anyone has any idea how to create a custom authorization module? Can anyone tell me where can I find a documentation or some example how to do it?
I appreciate any idea.
Regards.

The Access Manager developer guide on the Authentication SPI should be all you need to get started
http://docs.sun.com/app/docs/doc/819-4675/6n6qfk0nf?a=view

HR ABAP Custom Authorization Check

Hi all,
We know that Implicit authorization check is carried out. The system determines whether the user has the authorizations required for the organizational features of the employees selected with
GET PERNR.
I have a question, if we create a custom authorization then, whether this custom authorization is checked or not.
Thanks in Advance.

There is no difference in the coding of the check, which as RJ has stated needs to be somewhere at the correct coding location... otherwise it is going no where.
Some special differences are:
- The object class of the custom object in SU21 => Authorization objects in HR cannot be deactived context specifically in SU24. You can create custom objects within SAP classes.
- Depending on the transport type of your system, you will have to maintain transaction SU24 with a check indicator for the object - so make in known that the transaction has the capability to check the object. This does not affect "customer" systems, but is still a very good practice for the same reason that SAP forces it in their own development systems.
- Additional object checks in SE93 (which are typically "plausibility" checks) are not subject to this restraint. The check is always there, and your ability to bypass it is limited if you check the tcode authority of the caller at initialization of the (called) coding context. CALL TRANSACTION will skip this check, unless the called transaction is sy-tcode already (as it is in variant transactions... which urban legends claim to be secured to use for CALL TRANSACTION).
This concept is to a large extent influenced by SAP's own development guidelines and "settings" - but it is advisable to understand them and the intended authorization concept - to be able to create consistent customer implementations of SAP products.
Of course there are exceptions to the rules... but they generally cause problems and sooner or later need to be corrected as well when the auditors get hold of them....
Cheers,
Julius
Edited by: Julius Bussche on Apr 27, 2009 9:03 PM

Custom authorization object

Hi all,
I have created a custom authorization object to define a data security based on the Company code field.
These are the steps I did:
- I create a new authorization object containing the Company code field (BUKRS).
- I create a new role with this authorization object, and I have assigned a specific value to the Company code field.
- The role contains also the standard authorization object HR Master data which contains the field: infotype, personnel area...
- I have assigned the new role to a user and I have executed a report, but I had not the expected result.
- I had assigned the custom authorization object to the report transaction through SU24 and SU22, but I had not the expected result.
As expected result I was expecting that the data are filtered based on the Company code I put in the authorization field.
Any idea about the problem?
thx!

Please check that you have followed all of the steps listed here when creating your object:
<a href="http://help.sap.com/saphelp_erp2005vp/helpdata/en/9e/74ba3bd14a6a6ae10000000a114084/content.htm">http://help.sap.com/saphelp_erp2005vp/helpdata/en/9e/74ba3bd14a6a6ae10000000a114084/content.htm</a>
- April

Custom authorization object and check logic

Hi gurus,
we need to apply additional authorization check in our custom reports.
so i created a custom fields & object, and put the statement
      AUTHORITY-CHECK OBJECT 'ZHR_APP01' FOR USER uname
               ID 'ZROLEID' FIELD '03'
               ID 'ZSOBID' FIELD zzdwbm.
in a abap class method centrally, so it could be called by many reports.
but the test show that the sy-subrc always set to 0, even for users without any authorization.
what i missed for adding custom auth check?
for this case, do i need to maintain authorization check indicator in SU24?
what i am confused is that , su24, you have to maintain a transaction , but our authorization check is not for transaction , but for reports and bsp application, how should i maintain su24 for that?
thanks and best regards.
Jun

Hi,
I have created a Custom Authorization Object for HR named Z_ORIGIN (it has Personnel Subarea field BTRTL besides what's there in Auth. Object P_ORIGIN) and made it Check/Maintain for transaction PA30 in SU24.
I can see the entries in the USOBT_C & USOBX_C tables for this object, I am also able to add this object in the roles as well.
Everything looks fine, but when I execute the transaction the object Z_ORIGIN is never checked (for a user having this object in his/her User Master). Only P_ORIGIN object is checked instead.
We've ran the report RPUACG00 also which is mentioned in this thread.
We also coded the authority check code in the both user exit ZXPADU01 and ZXPADU02 for PA infotype operations
I believe I'll have to write some ABAP code e.g. AUTHORITY-CHECK OBJECT 'ZP_ORGIN' etc. Can anybody tell which User Exit or Field Exit I'll have to put the AUTHORITY-CHECK code in, so that my new custom authorization object is alwayz checked
but still it is taking the P_ORGIN object.

Custom Authorization Object for HR

Hi,
As per our Company's internal needs I have created a Custom Authorization Object for HR named ZP_ORGIN (it has Personnel Subarea field BTRTL besides what's there in Auth. Object P_ORGIN) and made it Check/Maintain for transaction PA30 in SU24.
I can see the entries in the USOBT_C & USOBX_C tables for this object, I am also able to add this object in the roles as well.
Everything looks fine, but when I execute the transaction & do a trace on it, the object ZP_ORGIN is never checked (for a user having this object in his/her User Master). Only P_ORGIN object is checked instead.
I believe I'll have to write some ABAP code e.g. AUTHORITY-CHECK OBJECT 'ZP_ORGIN' etc. Can anybody tell which User Exit or Field Exit I'll have to put the AUTHORITY-CHECK code in, so that my new custom authorization object is alwayz checked.
Your help will be appreciated.
Thanks,
Mandeep Virk

Hi,
I have created a Custom Authorization Object for HR named Z_ORIGIN (it has Personnel Subarea field BTRTL besides what's there in Auth. Object P_ORIGIN) and made it Check/Maintain for transaction PA30 in SU24.
I can see the entries in the USOBT_C & USOBX_C tables for this object, I am also able to add this object in the roles as well.
Everything looks fine, but when I execute the transaction the object Z_ORIGIN is never checked (for a user having this object in his/her User Master). Only P_ORIGIN object is checked instead.
We've ran the report RPUACG00 also which is mentioned in this thread.
We also coded the authority check code in the both user exit ZXPADU01 and ZXPADU02 for PA infotype operations
I believe I'll have to write some ABAP code e.g. AUTHORITY-CHECK OBJECT 'ZP_ORGIN' etc. Can anybody tell which User Exit or Field Exit I'll have to put the AUTHORITY-CHECK code in, so that my new custom authorization object is alwayz checked
but still it is taking the P_ORGIN object.

HR Authorization : Custom Authorization Object for P_ORGIN

Hi,
I have created a Custom Authorization Object for HR named Z_ORIGIN (it has Personnel Subarea field BTRTL besides what's there in Auth. Object P_ORIGIN) and made it Check/Maintain for transaction PA30 in SU24.
I can see the entries in the USOBT_C & USOBX_C tables for this object, I am also able to add this object in the roles as well.
Everything looks fine, but when I execute the transaction the object Z_ORIGIN is never checked (for a user having this object in his/her User Master). Only P_ORIGIN object is checked instead.
We've ran the report RPUACG00 also which is mentioned in this thread.
We also coded the authority check code in the both user exit ZXPADU01 and ZXPADU02 for PA infotype operations
but still it is taking the P_ORGIN object

Online Help
<a href="http://help.sap.com/saphelp_erp2005vp/helpdata/en/d9/64141c0774194593da29f3cb813f1b/frameset.htm">P_NNNNNCON (HR Master Data: Customer-Specific Authorization Object with Context)</a>

HR custom authorization issues/BADI to be used for some customization

We can develop custom authorization object in HR and run RPUACG00 to generate include MPAUTCON.Is it possible to include some customizations to the MPAUTCON program to accomplish some of our requirements.
If not can you please suggest me a BADI/User exit which can be used to develop some customization on a specific field, which can be called at the times the HR Master data is being changed/displayed/created.
Thanks in adavnce for the answers.

Hi Kiranm,
the MPPAUTCON program (or MPPAUTZZ in non-contextual mode) is automatically generated by the RPUACG00 report.
But you can modify it to add custom controls.
Best regards.

Customized Authorizations in SAP ISA Frame work

Hi All,
I am using SAP ISA Frame work in my project and displaying customized Authorizations in my Project and i want to add new Authorizations in my Project.
Please let me from where these authorization data is coming whether it is coming from back end or front end.
If it is front end from which file these data is coming.
I am expecting it is coming from some xml file and i would like to know from file name of xml.
regards,
suresh

Hi All,
Any suggestions please
Regards
G.s.naidu

Custom Authorization Policy

Hello Experts,
I need to create new custom Authorization Policies, but seems that I can create or copy only Policy from these Entity Type:
- User Management
- Role Management
- Authenticated Self Service User Management
What about the other entity Type? Why I cannot create an Authorization Policy based (for example) on Entity Type 'Scheduler'??
Thanks in Advance and Best Regards
AT

Open an SR and ask Oracle for the 11gR1 unpublished API.
We automate the creationing of an authz policy when we create a group. We were able to receive the API for 11gR1 with the understading that it was unsupported, and with a very strong business case for needing it.
Hope that help.

CHARM:Urgnt Corr. type of doc isnt created using Custom "Authorize" Action

Hi Experts,
I have copied SDCR Action profile to YDCR and defined all scheduled conditions as default. I have assigned YDCR action profile to my Txn Type YDCR. However, when I am trying to create Urngt type of correction using custom "Authorize" action from the action button, system is changing the status to "Authorized" However, the followup document of urgnt correction is not being corrected though I have selected the "Urgnt Correction (Maintenance)" from the Subject line.
I have properly copied all the copy rules and working fine if I use SDCR action profile instead of YDCR.
May any one please help me diagnose and solve this problem?
Regards,
Faisal

Hi All,
I want to share the latest on this.
I had basically created new schedule conditions by copying the original ones. Below are mentioned schedule conditions I copied from original:
Original schedule condition name : Only Status 'To be approved' (Assigned to Authorize and Reject Change Request)
Custom schedule condition name: YOnly Status 'To be approved'
The above YOnly Status 'To be approved' was assigned to "Authorize Change Request" and "Reject Change Request" actions in my YDCR Action Profile.
But When I changed it to Only Status 'To be approved' and created the urgnt correction, this type is created.
Can any one tell me what could have happened?
Regards

Customizing Authorizations

Dear all,
what are the by SAP recommended and needed Authorizations for Customization? I am looking for a document by SAP mentioning the situation for SRM.
We are facing the situation of strict role & authorization management at a company, where they also do not allow SAP standard roles. I need proven SAP document why extensive SAP authorizations needed in SRM. We do not have the time, to trace all tables, transactions etc. to rebuild SAP standard roles & authorizations.
Any help & info is highly appreciated.
Cheers,
Claudia

As all we aware SRM is a Role based application. however you also right and customer also right to ask this question to us.
In SAP SRM one or more predefined roles are assigned to each user or user account. Depending on
the role, the user is authorized to carry out certain transactions and access certain data. In addition,
each user or user account is assigned to its company and/or organizational unit. By way of this
assignment, the user inherits additional attributes that further restrict access, for example, employees
may only assign purchase orders to their own cost centers.
In the standard SAP SRM delivery, customers receive predefined role templates that they can extend
or adapt to their specific requirements. The standard roles include roles for managers, employees,
and so on.
Individual users access SAP SRM transactions and data via their browsers and then transfer sensitive
confidential data. This information must be protected against unauthorized access. As standard, this
is taken care of by encoding all data during the transfer from the Web Server to the browser. SAP
SRM follows the standard in this case and supports secure HTTP.
Roles for System Configuration
Users wanting to set up or configure an SAP SRM Server system are assigned to the SAP SRM
Administrator role, which provides them with the required authorizations. The necessary Customizing
authorizations ensure that these setup users are able to carry out IMG projects.
For more information, see http://help.sap.com SAP NetWeaver SAP NetWeaver 7.0 Including
Enhancement Package 1 System Administration Security Guide User Administration and Authentication
User Management .
do you want this security guide realeased by SAP
Security Guide
SAP Supplier Relationship Management powered by SAP
NetWeaver®
Target Audience
n System administrators
n Technology consultants
mail to businesss id i send you. i believe i have downloaded from market place?a re you looking for this document?
I have read and listened some web ex slides discusions on role arena form SAP experts.if you could not locate i will search for you..
br
muthu

Custom authorization for MDB in WLS 7.0

Hi,
Does anyone know how to authorize MDB using a Custom Authorization
Provider while the Weblogic Container registers the MDB as a listener
to JMS queue? My Custom Authorization Provider uses an oracle database
to store user roles and access control lists to allow a certain role
to access specific weblogic resources.
Any assistance is highly appreciated.
Thanks
Siva

The main reason is that JMS topics do not work well with HTTP clients. A topic cannot
initiate an HTTP call to the subscriber, so we have to store the message in memory
outside of JMS waiting for the subscriber to call us. Reliability is lost (if anyone
cared). The lifecycle of the outbound message is controled by the HTTP session timeout
(yuck!). This did not look like a solid feature that we should support.
If you like it, you can implement it yourself. I would recommend using JAX-RPC
handlers for that.
Thanks,
-ruslan
Michael Poulin wrote:
The deprication note is in "Creating JMS-Implemented WebLogic Web Services, section
Overview of JMS ...

Custom Authorizer

Similar Messages

Maybe you are looking for