Custom Role Names

Good Morning All,
We have created our role names to reflect:
- Custom VS SAP template
- Type of role (Composite, Master..)
-System (ECC, BI < PI...)
-Module (FI, CO...)
I wanted to know what is most seen across industry, how companies name their security roles. Our company is going global so wanted to make standards which make sense to users and IT.
Your suggestions are much appreciated.
Thanks.

I think the role naming is a choice you make based on the client operations and the way they are structured, there is no internationally accepted standard as such. It is like taking an opinion on what colour car should i buy - well it depends,isnt it.
Anyway, coming to the discussion:
We have European operations controlled from the official headquarters and users are spread across 21 countries. My role naming has been based on the domians we work. for a start let me inform that we do not allow local role assignments. local administrators are empowered to maintain users locally (create/change/delete) but not assign/delete/restrcit role authorizations - it is managed centrally after due approvals are taken care of.
My master roles are defined as ZSMSLSX001, ZSMSLSX002 .......for sales, ZSMRDCX001, ZSMRDCX002.....for the local regional distribution centres owned by the local countries (these are the various plants in the loca countries), we have European distribution centres owned by the headquarters and the naming convention is ZSMELCX001........ZFMSXXX001, for Finance sales operations and ZFMMXXX001....for Finance manufacturing opearations
these master roles are derived to the local countries using the SALES ORGANIZATION for the sales roles (ex: ZSMSLSX001 is derived to ZSISDL1001, for Germany - ZSISFR2001 for France and so on, ZSMRDCX001 is derived as ZSIRDK1001 for the Danish plant, ZSICFR2001 is derived from ZFMMXXX001 for Finance manufacturing of France).........I dont know if it is an accepted appraoch in the forum, but it makes life easy at our end and i like it
bottom line: there is no right or wrong in the naming convention, trying to keep them as simple as you can and reflecting the operations and the domain they are created for, would make sense
With the approach you suggested of having the country "US" specifed in the role - can make life difficult if you want to create a role for India and Indonesia (or) Begium and Belarus , following ISO codes could be an option but then you would have to consider the Spanish feelings about using "HP" in the naming (atleast the set of users at our end hate having HP mentioned in the user Id (or) in the role name.........(i am told that it has a not so nice meaning when HP is expanded to its gloriest best).......many things to consider, isnt it?
I wish you luck for your search on the "IDEAL" naming convention

Similar Messages

Display Icon/Image instead of Role name in top level navigation

Hi,
I want to display a image / icon instead of role name for a particular role. Can you please tell me how to achieve this ?
Thanks,
VP

Hi,
the thread is just for the background image (for all elements).
if you want to display icons instead of role names, you have to create your custom top level navigation using the
navigation taglib from SAP. There are lots of examples. make a blog search for Mr "Kannengiesser" from SAP.
In case you are using already an EHPx in your EP 7.0 the AJAX framework might have this feature.
Regards,
Kai

Wlconfig with custom role mapper always fails FIRST time only

WLS 8.1 sp2.
I have a very strange problem, where I'm "coldstarting" a server and
configuring it, much like the ant build script for medrec. Only I have a
custom role mapper (medrec has a custom authentication provider). Anyway,
the first time I execute this task (after a clean), it consistently fails
like so:
[wlconfig] OK
[wlconfig] OK
BUILD FAILED
file:P:/dgs/build.xml:186: Unable to create mbean:
weblogic.management.MBeanCreationException: - with nested exception:
[java.lang.ClassNotFoundException:
weblogic.management.configuration.com.combinenet.security.CNRoleMapperProvid
erMBean]
(that class looks bogus to me, BTW, as my provider class is
com.combinenet.security.CNRoleMapperProvider)
Now, the SECOND time I execute "coldstart", which runs wlconfig, the server
starts up fine, and my custom role mapper is loaded successfully. So,
obviously I figured something was left around the first time which somehow
helped matters, but the strange thing is that I delete the entire domain
directory before "coldstarting" the server, and I also re-copy the role
mapper provider jar into the mbeantypes directory, so I'm very puzzled. I'm
copying the coldstart task below (and the clean).
Can anyone tell me what's wrong with this task that would make it fail the
first time through after a clean? Is this a bug? And why would it succeed on
all subsequent attempts (without a clean)? I just don't see anything wrong
with what I'm doing.
TIA,
Miles
<target name="coldstart"
description="Start a new DGS Server with an empty config"
depends="configServerEnv,startPointBase,configPointBase,dist" >
<delete dir="${dgs.root}" quiet="true"/>
<mkdir dir="${dgs.root}"/>
<wlserver
beahome="${bea.home}"
dir="${dgs.root}"
domainname="${dgs.domain}"
host="${dgs.host}"
port="${dgs.port}"
servername="${dgs.serverName}"
username="${wl.username}"
password="${wl.password}"
productionmodeenabled="false"
generateconfig="true"
action="start">
</wlserver>
<wlconfig url="t3://${dgs.host}:${dgs.port}"
username="${wl.username}"
password="${wl.password}">
<query domain="${dgs.domain}" type="Server"
name="${dgs.serverName}"
property="dgs.server"/>
<create type="JDBCConnectionPool"
name="DgsPool"
property="dgs.pool">
<set attribute="CapacityIncrement" value="1"/>
<set attribute="DriverName"
value="com.pointbase.jdbc.jdbcUniversalDriver"/>
<set attribute="InitialCapacity" value="1"/>
<set attribute="MaxCapacity" value="10"/>
<set attribute="Password" value="${pointbase.password}"/>
<set attribute="Properties" value="user=${pointbase.username}"/>
<set attribute="RefreshMinutes" value="0"/>
<set attribute="ShrinkPeriodMinutes" value="15"/>
<set attribute="ShrinkingEnabled" value="true"/>
<set attribute="TestConnectionsOnRelease" value="false"/>
<set attribute="TestConnectionsOnReserve" value="false"/>
<set attribute="URL" value="jdbc:pointbase:server://localhost/demo"/>
<set attribute="Targets" value="${dgs.server}"/>
</create>
<create type="JDBCTxDataSource" name="DGS Tx DataSource">
<set attribute="JNDIName" value="DgsTxDataSource"/>
<set attribute="PoolName" value="DgsPool"/>
<set attribute="Targets" value="${dgs.server}"/>
</create>
<create type="JMSConnectionFactory" name="Queue">
<set attribute="JNDIName" value="jms/QueueConnectionFactory"/>
<set attribute="XAServerEnabled" value="true"/>
<set attribute="Targets" value="${dgs.server}"/>
</create>
<create type="JMSJDBCStore" name="DgsJDBCStore"
property="dgs.jdbcstore">
<set attribute="ConnectionPool" value="${dgs.pool}"/>
<set attribute="PrefixName" value="Dgs"/>
</create>
<create type="JMSServer" name="DgsJMSServer">
<set attribute="Store" value="${dgs.jdbcstore}"/>
<set attribute="Targets" value="${dgs.server}"/>
<create type="JMSQueue" name="Registration Queue">
<set attribute="JNDIName" value="jms/REGISTRATION_MDB_QUEUE"/>
</create>
</create>
<create type="MailSession" name="Dgs Mail Session">
<set attribute="JNDIName" value="mail/DgsMailSession"/>
<set attribute="Properties"
value="mail.user=joe;mail.host=mail.mycompany.com"/>
<set attribute="Targets" value="${dgs.server}"/>
</create>
<create type="StartupClass" name="StartBrowser">
<set attribute="Arguments" value="port=${dgs.port}"/>
<set attribute="ClassName" value="com.combinenet.test.StartBrowser"/>
<set attribute="FailureIsFatal" value="false"/>
<set attribute="Notes" value="Automatically starts a browser on
server boot."/>
<set attribute="Targets" value="${dgs.server}"/>
</create>
<set mbean="Security:Name=myrealmDefaultAuthenticator"
attribute="ControlFlag" value="SUFFICIENT"/>
<set mbean="Security:Name=myrealmDefaultAuthenticator"
attribute="MinimumPasswordLength" value="10"/>
<set mbean="Security:Name=myrealm"
attribute="DeployPolicyIgnored" value="false"/>
<set mbean="Security:Name=myrealm" attribute="DeployRoleIgnored"
value="false"/>
<set mbean="Security:Name=myrealm"
attribute="FullyDelegateAuthorization" value="true"/>
<set mbean="Security:Name=myrealm"
attribute="AuthenticationProviders"
value="Security:Name=myrealmDefaultAuthenticator|Security:Name=myrealmDefaul
tIdentityAsserter"/>
<set mbean="Security:Name=myrealm" attribute="RoleMappers"
value="Security:Name=myrealmDefaultRoleMapper|Security:Name=myrealmCNRoleMap
perProvider"/>
<create type="com.combinenet.security.CNRoleMapperProvider"
domain="Security" name="myrealmCNRoleMapperProvider"/>
<set mbean="Security:Name=myrealmCNRoleMapperProvider"
attribute="Realm" value="Security:Name=myrealm"/>
<query domain="${dgs.domain}" type="Server" name="DgsServer">
<set attribute="StdoutEnabled" value="true"/>
<set attribute="StdoutSeverityLevel" value="64"/>
<set attribute="ListenAddress" value=""/>
<set attribute="ListenPort" value="${dgs.port}"/>
</query>
<query domain="${dgs.domain}" type="WebServer" name="DgsServer">
<set attribute="LogFileName" value="logs/access.log"/>
</query>
</wlconfig>
<copy file="${dist}/lib/dgs.ear" todir="${dgs.root}"/>
<wldeploy action="deploy"
source="${dgs.root}/dgs.ear"
name="dgsapp"
user="${wl.username}"
password="${wl.password}"
verbose="true"
adminurl="t3://localhost:7001"
debug="true"
targets="${dgs.serverName}"/>

<sleep hours="10"/>
</target>
<target name="clean"
description="Clean the build tree(s)"
depends="init">
<delete dir="${build}" verbose="true"/>
<delete dir="${dist}" verbose="true"/> (dist is where the ear file is
created)
</target>

g_wolfman wrote:
Are you using Parallels?
Wolfman, thats a good hint!
Additional info at --> http://reviews.cnet.com/8301-13727_7-20106682-263/macbook-airs-double-booting-wi th-parallels-and-filevault-enabled/
Thanks for the input.
Lupunus

FNDLOAD Question -- How to FNDLOAD a set of custom ROLES, not entire UMX?

Calling all FNDLOADers,
Question:
Are there any other options in FNDLOAD that will allow us to pull only those roles that are custom, either based off of UMX_ROLE name, UMX security CODE or any other attribute?
Background:
We have created ~40 custom roles in our 11.5.10.2 EBIZ environment, and would like to migrate these roles with FNDLOAD between environments. We are executing the following:
FNDLOAD <username/pwd@sid> 0 Y DOWNLOAD $FND_TOP/patch/115/import/afrole.lct umx_roles.ldt WF_ROLE ORIG_SYSTEM=UMX%
This will get us ALL UMX roles in the entire EBIZ system!
Now, granted, we can go into the umx_roles.ldt file and edit the file, but the possibility for human error comes in..."FAT FINGERS" syndrome!
Thanks and best regards,
Gabe D

Hello Gabe,
Did a lot with FNDLOAD, iSetup and ACMP in the previous month. I am assuming that you are using naming conventions for your roles, right?
In this case, the role code shall always start with XX, to specify that this role is a custom role.
Then, in FNDLOAD you use the parameter ROLE_NAME:
FNDLOAD <username/pwd@sid> 0 Y DOWNLOAD $FND_TOP/patch/115/import/afrole.lct umx_roles.ldt WF_ROLE ROLE_NAME=UMX|XX%
I just tested this and it works perfectly, exactly the 15 roles I created are extracted.
Any follow up question is welcome!
kr, Volker

Role Name Server defined in SLD but no CimomURL maintained

Hello gurus!
We have a problem with our NWDI setup.
What I want to do is to update an existing track DFODEV02 with the software package EP-RUNTIME.
I synchronize with the SLD. However when I try to save, I get the following error:
"SLD (URL http://<NWDI_server>:<port>)
server exception: Invalid Name Server null - Check SLD configuration -> Role
Name Server defined in SLD but no CimomURL maintained."
I am not familiar with the customizing for this but I have looked into a couple of customizing steps related to Data Supplier:
1) Under administration on SLD I see the following:
Update Namespaces is marked as sld/active; but
Update Other SLDs is an empty list.
2) From the configuration on NWA:
Target URL: <RuntimeSLD_server>/sld/ds
Both 'Automatic send' and 'success' are both "true".
Hope that you can guide us on the right “track”
In advance, thank you very much!
Best regards,
Elias

Hi Elias,
1) Under administration on SLD I see the following:
Update Namespaces is marked as sld/active; but
Update Other SLDs is an empty list.
This is something else, your error message is not about this one.
What you need to make sure is that you have a name server defined.
You can check it in various ways:
A). go to CMS -- Track Data -- select the track in question -- tab Build Variants -- Display/Download the Development Configuration --> This will be an XML file. If you see a tag "sld-nameserver" then you are ok, however I assume this tag is missing or points to a wrong SLD in your case.
B)
Go to the initial page of the SLD.
2. Choose Landscapes.
3. Choose New Landscape…
4. In the page that appears, select the landscape type NWDI System.
5. Specify NWDI as the name of the landscape. Choose Create.
The new landscape is displayed.
6. Select the new landscape.
You see the details about the landscape.
7. Choose Systems and then choose Add System to Landscape.
8. Choose the hosted system type System Landscape Directory. Choose OK.
You see the installed SLD.
9. Select the SLD.
The details view appears.
10. Select the roles Landscape Server and Name Server and save your changes.
The name server is now known to the NWDI and can be used there. Only now can you create valid development configurations.
Could you please confirm this way whether you have a name server specified and that points to the correct SLD ?
I hope this guides you to the right "track"
Regards,
Ervin

CUP Custom Role Attributes

All -
My question is about creating custom role attributes in CUP. I read in the "SAPu2122 GRC Access Control 5.3 Document Version 3.10 u2013 December 2009" on page 245 that "You can also define your own attributes to support your needs by adding custom fields." I have two questions:
1) Can I defined custom role attributes outside of the delivered ones (Company, Functional Area, Application Area, Business Process, Business Sub-Process, and Functional Area & Company)?
2) If "yes", where do I do this in CUP?
I'm running AC 5.3 SP10.
Any help would be appreciated.
Thanks,
Daniel

Hi Daniel,
Yes , you can define your own attributes as many as you want
Configuration --> Custom Fields --> Field Label
All these Field Labels will be shown as separate tab (Tab Name : Custom Attribute) , so in this tab you will get all the attributes which you have creates manually .( You can check this in configuration guide CUP)
Hope this will help you
Thanks
Uma Shankar Tekumudi

Printing different role name other than role property name

Hi,
we have one program it gives all the roles,workset,iviews according to the PCD names and locations.
Now for few roles localization property is there ,so due to this the name user see on the tab and the name we mentioned in the role property is differnt.
our program printing the role name what we given in the role property.
but i need the name what user seeing.
now i don't want to change my role property . but i need to print the role name what user will see.
let me know how i can achieve this.
Thanks
Surya

Is it a customer app? If so, the program needs to use the appropriate method that reads the language specific role name. Ask your programmer to use the correct method...

Custom Role Provider has issue with AuthorizeAttribute for MVC

Hi, I am developing a MVC 5 application with custom role provider, but it seems that the AuthorizeAttribute never call my customer role provider, my code is as below:
My Customer provider:
namespace MyDomain
public class CustomRoleProvider : RoleProvider
public override string[] GetRolesForUser(string username)
using (MyContext objContext = new MyContext())
var objUser = objContext.Users.FirstOrDefault(x => x.Username == username);
if (objUser == null)
return null;
else
string[] ret = { objUser.Access_Levels.Name };
return ret;
public override bool IsUserInRole(string username, string roleName)
var userRoles = GetRolesForUser(username);
return userRoles.Contains(roleName);
My controller:
[Authorize(Roles = "Administrator")]
public class AdminController : Controller
And Web.Config:
<system.web>
<roleManager defaultProvider="CustomRoleProvider" enabled="true" >
<providers>
<clear />
<add name="CustomRoleProvider" type="Online_Storage_Portal.CustomRoleProvider" cacheTimeoutInMinutes="30"/>
</providers>
</roleManager>
</system.web>
Also my custom role provider is in the same project as my other controllers, I am able to call my custom role provider method with following code within my controller
String[] roles = Roles.GetRolesForUser(username)
but the controller with [Authorize(Roles = "Administrator")] always redirect the page to login screen, even the user login and role are both valued.
Please help!!

You should post this question to
ASP.NET MVC forums as problem relates more to that than C#. But the problem might relate to how you have set the principal the one that you can access from HttpContext.User property. I think that is the one where the roles are retrieved.

Table contain role names capture in any change request

Hi All,
Kindly let me know if someone has any idea on any table name (if any) contains the role names captures in any change request
Arpan

>
P Arpan wrote:
>
> I need to view all the roles captured in multiple change request yet to release.
>
> Arpan
How about in table E070, Selecting on Type ( if it is Customizing Request - W, if it is customizing task - Q), Status ( for modifiable requests - D ) and Owner as your Security Admins ( assuming they are the ones who created role changes transport requests) and then using E071 ( selecting transports or tasks from E070 ) and using Program id R3TR and object ACGR.
Edited by: Nishant Sourabh on Apr 8, 2010 8:10 PM

Customized Roles with Split Permissions

We are running an Exchange 2013 environment using Outlook 2013. We did the install using split permissions because the Exchange Administration and AD Administration are going to be done in two different places. We have had lot's of permission
issues with the split permission install. We now need to figure out a way to created a customized role in Exchange that will allow users to only create/enable/move mailboxes AND add/remove people from Distribution Groups. To this point I have made
a copy of the Mail Recipient Creation role and have been removing role entries from the copy. I'm just not really sure which roles I should be removing. Any guidance on what roles would be needed?

Hi ,
Thank you for your question.
We could refer to the following steps to achieve your requirement:
1. Customized role
Create mailbox:
New-Managementrole –Name “Create Mailbox” –parent “Mail recipient Creation”
Get-ManagementRoleEntry “Create Mailbox\*” | where {$_.name –ne “New-maillbox”} | Remove-ManagementRoleEntry
Then we could type “A”.
Enable mailbox:
New-Managementrole –Name “Enable Mailbox” –parent “mail recipients”
Get-ManagementRoleEntry “Enable Mailbox\*” | where {$_.name –ne “Enable-Mailbox”} | Remove-ManagementRoleEntry
Then we could type “A”.
Move mailbox:
New-Managementrole –Name “Move Mailbox” –parent “move mailboxes”
Get-ManagementRoleEntry “Move Mailbox\*” | where {$_.name –ne “New-MoveRequest”} | Remove-ManagementRoleEntry
Then we could type “A”.
Add user to Distribution Group:
New-Managementrole –Name “Add user to DL” –parent “Distribution Groups”
Get-ManagementRoleEntry “Add user to DL\*” | where {$_.name –ne “Add-DistributionGroupMember”} | Remove-ManagementRoleEntry
Then we could type “A”.
Remove user from Distribution Group:
New-Managementrole –Name “Remove user to DL” –parent “Distribution Groups”
Get-ManagementRoleEntry “Remove user from DL\*” | where {$_.name –ne “Remove-DistributionGroupMember”} | Remove-ManagementRoleEntry
Then we could type “A”.
2. Customized role group and Role was add role group:
New-RoleGroup –Name “Manage Recipients for Helpdesk” –Roles
“Create Mailbox”, “Enable Mailbox”, “Move Mailbox”, “Add user to DL”, “Remove user to DL” –RecipientOrganizationalUnitScope “contoso.com/Users”
3. Add the user you want to grant this connect-mailbox permission to this role group through EAC;
4. Test.
If there are any questions regarding this issue, please be free to let me know.
Best Regard,
Jim

User / Customer Role Membership Check in ISF / Javascript

Did not see this in the documentation...
Does anyone know if checking for the User or Customer Role membership inside ISF / Javascript is supported? -- Like similar to how we can check for "Moment".
If so, what is the variable name and the values?
Thanks.

I think some of the libraries such as ExtJS are loaded and usable on the order forms, but for ones that are not, you can point to the existing library files under RequestCenter.war and add them as a JavaScript library in service designer.
Below is a quick example of looking up the role through the NS API, it should be enough to get you started on what you need.
function doSomething(){
   //Performs NS API XHR Request and returns the responseXML document
   function nsapiRequest(url) {
        var xhr = new XMLHttpRequest();
        xhr.open("GET", url, false);
        xhr.send();
        if (xhr.readyState === 4) {
            if (xhr.status === 200) {
                return xhr.responseXML;
            } else {
                console.error(xhr.statusText);
   //Function to check if user belongs to a role
   function hasRole(roleName) {
        var doc = nsapiRequest("/RequestCenter/nsapi/directory/people/currentuser");
       //Get all associated role elements
        var roles = doc.getElementsByTagName("associatedRole");
       //Loop through roles to check for a specific one, could also build an array of all user roles
        for (var i = 0; i < roles.length; i++) {
           //Extract role value
            var role = roles[i].childNodes[1].firstChild.nodeValue;
            if (role === roleName)
                return true;
        return false;
   var siteAdmin = hasRole("Site Administrator");
   if (siteAdmin){
       //do something

Error while assigning portal custom role

Hi All,
We have a custom role which we use to assign to the users. till now we are able to assign it without any problem. But now as i need to assign it to someone, i got an error stating that "An error occured while adding user assignments; to see the correct status, perform a new assigned user search".
Can anybody help us in finding out the reason of the error and in rectifying the error.
Thanks & Regards,
Ravi

Hi Raghu,
Thanks for your reply..
This role is existing in the PCD, and this error is coming, while assinging this role any users... it is working fine with the existing users, who are having this role before. This is happening only when we are assigning this role to some new user.
I dont think this has some relation with the backend, as the role assignment is part of the Portal itself.
And also here we dont have seperate UME, and we are using r3 users only with single sign on.....
Hi Jithendar,
Thanks fo your reply.....I will do that backend roles check also for those users and see whether any backend role variations happened for these users.
Thanks & Regards,
Ravi

Custom File Name Format in B2B Console

Hi,
Please let me know if we can have a customized File Name Format in the B2B Console for the X12 EDI/XML Files.
I have read the Oracle doc and only the following formats are mentioned:
%FROM_PARTY%
%TO_PARTY%
%DOCTYPE_NAME%
%DOCTYPE_REVISION%
%MSG_ID%
%TIMESTAMP%
Is there a way to have a PO# (From the Trading Partner Payload) in the filename format?
You help is appreciated.
Thanks
Priyanka G

no. It has the format which helps B2B in identifying the agreement

Error Importing a Transport in portal - Using custom role

Hello Everyone,
I have a custom role XYZ which has a few worksets copied (as delta links) from the standard System Administration Role. These worksets include Transport, Portal Display and Monitoring.
Now, I have assigned a user ABC the following roles:
1.Role XYZ
2.Content Admin Role
When the User ABC with the above mentioned roles, tries to import a transport package into the system he gets and authorization error. (This error does not occur if I assign the user Super Admin Role).
Error Details :
com.sapportals.portal.transport.RepositoryAccessControlException
Import data Access denied. (Object(s): pcd:..
Object ID:
Transport File: ..
Original Exception:
com.sapportals.portal.pcd.gl.PermissionControlException: Import data Access denied. (Object(s): pcd:..
at com.sapportals.portal.pcd.gl.transport.PcdGlTransportAdapter.checkPermission
at com.sapportals.portal.pcd.gl.transport.PcdGlTransportAdapter.startElement
at   com.sapportals.portal.pcd.gl.xml.ContentHandlerManager.startElement
<b>Questions:
1.     Is it really possible to have this functionality (ability to Import and Export without Assigning System admin or super admin roles) achieved?
(I went through a thread Portal role for transporting objects on SDN which discusses this scenario)
2.     How should I check for additional authorizations required for Importing / Exporting Transport packages into portal. (without having assigned the super admin role or system admin role).</b>Thanks To all of you
Joan Thomas

Thanks for the inputs.
I have fixed the problem.
To assign content objects to a package, you need at least read permission for the objects to be assigned.
You can only import objects into the Portal Content Directory if you have read/write permission for each folder in the Portal Catalog where the imported objects will be stored.
To create a transport package in a certain folder of the Portal Catalog, you need read/write permission for this folder.
These 3 points helped me do the required.
Raj

Object Custom Program Name of class RE and language EN does not exist

Hi All,
We are getting this bbelow error while running a custome program ,
Object <Custom Program Name> of class RE and language EN does not exist
Do any one has faced this similar issue earlier.
Regards,
Sen

Hi,
How did you resolve this problem ?
Re: Object <Custom Program Name> of class RE and language EN does not exist.
I am also encountering the same issue when I am executing the report.
Regards,
SSR.

Custom Role Names

Similar Messages

Maybe you are looking for