Derived roles

All,
I have a question regarding the authorization for the derived roles.Say for example you are combining two derived roles from the same master role role1: z_der_plant100 and role2 :z_der_plant200.Now role1 has only create option for plant 100 and role2 only change option for plant200.If we combine both the roles and assign it to user,will user get access for create,change to plant 100 and create,change to plant 200??

My own thinking what will happen if we combine so and so roles....
I have a other basic question regarding the field values of a A.object.As we know the one particular A.object is related to so many T.codes.Eg:assigning just 1 tcode to a role which contains 5 A.objects(those 5.A.objects are related to so many different T.codes).If we generate the profile for the role it will bring up all the mandatory field values for that specific T.code which is added.Suppose if we assign some values in the fields which are blank(maintain) or even changing the standard values(01,02 standard but deleting those values and assigning 03,04).Will the user gets accesss for the maintained/changed field values ? The reason for asking is ,as we are deleting the mandatory field values of the tcode and assigning some other values which are standard values for some other Tcodes (which are not added in the menu)
Pls excuse me if it confuses ....

Similar Messages

Error while uploading R/3 Derived Role into EP

Dear all,
When i was trying to upload the derived role from backend R/3 system. It's giving following error.
com.sap.portal.pcd.rolemigration.RoleMigrationException: Nested Exception. Failure to execute native function. Nested Exception. ROLE_IS_DERIVED - message at com.sap.portal.pcd.rolemigration.util.Connector.callFunction(HQ1CLNT230,en_US,pradeep,TWPN_GET_ROLE,ROLE_TABLE,{ENABLE_LOGGING= , ROLENAME=ZR:GT_CUSTOMER_001, MENUTEXTS_ONLY_IN_MASTERLANG= }): Check parameters. Nested Exception. ROLE_IS_DERIVED at com.sap.portal.pcd.rolemigration.util.Connector.callFunction(Connector.java:244) at com.sap.portal.pcd.rolemigration.RoleMigrationObject.migrate(RoleMigrationObject.java:1699) at com.sap.portal.pcd.rolemigration.RoleMigrationObject.migrate(RoleMigrationObject.java:769) at com.sap.portal.pcd.rolemigration.RoleMigrationThread.run(RoleMigrationThread.java:488) Original exception: com.sapportals.connector.ConnectorException: Nested Exception. ROLE_IS_DERIVED at com.sapportals.connectors.SAPCFConnector.SAPConnectorException.getNewConnectionException(SAPConnectorException.java:67) at com.sapportals.connectors.SAPCFConnector.execution.functions.SAPCFConnectorInteraction.execute(SAPCFConnectorInteraction.java:318) at com.sapportals.connectors.SAPCFConnector.execution.functions.SAPCFConnectorInteraction.execute(SAPCFConnectorInteraction.java:411) at com.sapportals.connectors.SAPCFConnector.execution.functions.SAPCFConnectorInteraction.execute(SAPCFConnectorInteraction.java:433) at com.sap.portal.pcd.rolemigration.util.Connector.callFunction(Connector.java:403) at com.sap.portal.pcd.rolemigration.util.Connector.callFunction(Connector.java:148) at com.sap.portal.pcd.rolemigration.RoleMigrationObject.migrate(RoleMigrationObject.java:1699) at com.sap.portal.pcd.rolemigration.RoleMigrationObject.migrate(RoleMigrationObject.java:769) at com.sap.portal.pcd.rolemigration.RoleMigrationThread.run(RoleMigrationThread.java:488)
Kindly Suggeset me
Rgds
PRadeep

Pradeep,
Kindly explain the process flow of your upload.
James

Little Challenge --How to give or restrict TRX in derive roles !

Want to give 10 trx in 2 derive roles and 15 in another 2 derive roles from same Parent role-Any method to do so?One I know is to give additional 5 Trx access through manually Adding TCD in remaning 2 derive roleANY other way to give or restrict so that tabs should not be in manually or changed mode?

>
ARYENDRA DALAL wrote:
> so that tabs should not be in manually or changed mode?
Hi,
Excellent answer from Juluis. Also the way you want to do this is conflicting with the Ref-Derive role concept.
I can add/modify some thing to the previous two answers.
One point I want to make clear that you mentioned as quoted above. Do you mean to say that the S_TCode will not be in changed mode (_or_ need not to add S_TCode manually) in Profile generator?
If Yes, then please check the following approach:
1. Create your first parent role and pair of derived roles with 10 Tcodes.
2. Create one role as per the concept of Transaction role - value role. That means, the role will contain those 5 TCodes in the menu but will not contain any authorization (except S_TCODE, all objects should be deactivated).
3. Then create one composite role with these two (one derive role of the pair and the other single role).
if No, then follow this approach:
1. Follow step one of above.
2. Create one generic role without any menue entry. Add TCode manually in authorization tab and then 5 TCodes there.
3. Create another role (value role) [let me know if you need details concept on this] and maintain the authorization of those 5 TCodes here together with org. values.
4. Create composite role by using these three roles (one derive role from the pair, one generic transaction role and one value role).
But please note that the menue entry should not be maintained in the derive role in any circumstances and if you do then you are no longer maintaining SAP Ref-Derive role concept.
Please let me know if these help you to some extent.
Regards,
Dipanjan

Risk Analysis of derived role is not able to fetch organisational values.

Dear All,
We have run the Permission level analysis in GRC 5.2 for the ROLES at permission level and
found that the tool is not reading the ORGANIZATION VALUES maintained
in the derived roles.
We had explored in the GRC tool & found that the field BUKRS,KOART,etc
are ENABLED in the RULES.While the CC tool is fetching value of other authorzation object.
Please Advice if there is any configuration settings required.
For your reference I am pasting the part of report.
Medium     F_BKPF_KOA : Accounting Document: Authorization for Account Types     ACTVT : Activity     Create or generate
Medium     F_BKPF_KOA : Accounting Document: Authorization for Account Types     KOART : Account Type     $KOART
Medium     F_BKPF_BUK : Accounting Document: Authorization for Company Codes     ACTVT : Activity     Create or generate
Medium     F_BKPF_BUK : Accounting Document: Authorization for Company Codes     BUKRS : Company Code     $BUKRS
Thanks,
Sandeep Bhatia

Hello Sandeep,
Doing Org Lvl Analysis is not so simple in RAR.
Firstly this is only user based.
For using it you will have to schedule one job in configuration which will update Org Values for users in the database table. I don't remember name of this Utility however it will be something Orguser, just search in Configuration tab.
As mentioned by you, org lvl are already enabled and make sure there values is $.......,
Reason being Org Rules will be generated at runtime and then anlysis will be done.
It will be better you take help of SAP on this. As they have document which will be very helpful to you.
Regards,
Surpreet

Master role and derived role concept

Guys,
1) How to assign the organizational levels for the derived role?
Say for example, I have to create the derived roles with respect to the plant code.And after inheriting the tcodes ,authorizations from the master role , I noticed a pop up page with organizational level tabulation and I assigned the respective plant code there and in the same way for all the following derived roles.But the rest of the rows like company code,sales organization,distribution channel etc which are seen in the tabulation are left empty.I noticed that all the fields which are left empty in the org.levels of the derived roles are been filled up with the vaules of the corresponding master role org.level values when the derived button icon , which is seen under the authorization tab of master role is pressed.So pls let me know the correct procedure to assign.*Do we really need to maintain org.values for master roles?*
2) If a master role is transported to QA or PRD, will the derived role along with it move automatically?
3) Is master and derived role tested parallely in the QA system or first master role is tested ,followed by the derived role?
4) According to my understanding we dont assign any user to the master roles, but why do we move it to PRD?
Greatly appreciate for some body's help.

> 1) How to assign the organizational levels for the derived role?
> Say for example, I have to create the derived roles with respect to the plant code.And after inheriting the tcodes ,authorizations from the master role , I noticed a pop up page with organizational level tabulation and I assigned the respective plant code there and in the same way for all the following derived roles.But the rest of the rows like company code,sales organization,distribution channel etc which are seen in the tabulation are left empty.I noticed that all the fields which are left empty in the org.levels of the derived roles are been filled up with the vaules of the corresponding master role org.level values when the derived button icon , which is seen under the authorization tab of master role is pressed.So pls let me know the correct procedure to assign.*Do we really need to maintain org.values for master roles?*
Only if you assign the master roles to users. (and maybe for testing, see 3)
>
> 2) If a master role is transported to QA or PRD, will the derived role along with it move automatically?
Nope, but if one of it's derived roles is transported the master is automatically included in the transport. You'll have to make sure all derived roles are transported yourself.
>
> 3) Is master and derived role tested parallely in the QA system or first master role is tested ,followed by the derived role?
Best order is to do all unit testing wit the master, with all org levels at * and create the derived roles only when the master is tested and corrected to satisfaction. In that way the derived roles only have to be tested for organizational shielding.
>
> 4) According to my understanding we dont assign any user to the master roles, but why do we move it to PRD?
See 2, it goes there automatically. No choice.
Jurjen

Question on org level values in derived roles

I have a set of derived roles for a retail org.
They have set the org level for the WERKS object to the store number i.e. 0012. in the M_MSEG_LGO, M_MSEG_WMB, and M_MSEG_WWE but set it to "" in the M_MRES_WWA and M_MSEG_WWA. Needless to stay the "" is overiding the site restriction.
My question is, how can they allow store to store transfers and goods issues for other sites but only do POs and goods receipts for their default store?
If the transactions in the role are using the same object, it doesn't seem like it can be done but I am told it can! I can't figure it out. Can anyone assist?
Thanks

If you are talking about straight authorization object ( then your design cannot go with derived role concept )
If your controls are only through the organizational object only then derived role design will help
If its a mix of both standard object + organizational level object derived role will not help you.
Please note
the WERKS is the organization level in your case the plan value is 0012
do not set the values in parent role and also do not populate this value were its "$werks"
what is TCODE you are using ?
Edited by: Franklin Jayasim on Jul 21, 2010 11:45 PM

Org data in Derived role differ from Parent role

Hi there
I need some help please, I am in the process of creating various parent / derived roles and have found that when I update the parent role (org data) and I do a generate do a derived role update the values in the org data is not correctly pulled through to the derived roles.
e.g.
In the parent role for Org data "Purchase Org" the previous value was "/" so that it could be specified in the derived roles should they require the split on this field, however the business has decided that they do not require a restriction on this field so I went back to the parent role and changed the value to "*", so I generated the parent role, updated the derived roles, but when I go to any of my derived roles that field value is still blank, it did not pull through the value * .
We are currently on
SAP_ABA 701 0005 SAPKA70105
SAP_BASIS 701 0005 SAPKB70105
I have created the derived roles with the parent role as the derived from role, it does pull through the values but just does not update it once I do make changes.
Your help / suggestions would really be appreciated as I need to create MANY roles.
Regards
Sonja

Hi Sonja,
obviously there is a misunderstanding of how the derivation works....
> Thanks guys for the feedback, but surely I do not only need to maintain the ORG data in the derived roles individually, if I have got an Org field that should be the same for all the derived roles I must be able to update the Parent role with this value which then upon generate, and generate / activate the derived roles must update the derived roles.
-->no.
Only the first time of derivation, if the field content in the derived roles are initial...
help.sap.com:
quote
The organization level data is only copied the first time the authorization data is adjusted for the derived role. If data is maintained for the organizational levels in the derived role, and if you have maintained the organizational levels using the dialog box, the data is not overwritten by another conciliation (See SAP Note 314513).
unquote
The whole stuff: http://help.sap.com/saphelp_nw70ehp2/helpdata/en/1c/c38028816c11d396bc0000e82de14a/frameset.htm
otherwise the maintained org.fieldvalues would get overwritten by the value of the master role every time. And that is exactly, what has to be avoided!
b.rgds, Bernhard

Change authorization object in a derived role

Hi Gurus,
What's happen if someone has added a new authorization object in a derived role?
He has only changed some derived role, not the parent role, he added manually a new value in the authorization field. The parent role didn't changed.
<u>Note:</u>The field was not an organizationnal field, it was S_DATASET.
What do you think about this ?
Thanks
Hery-zo

Do i understand this right??? do functional teams have access to PFCG to create roles???
If so that is your real problem, as that shoudl never been doen that way. You are completely right functional consultants have no clue about how roles should be build. advise:
1 take away the access to PFCG in ALL systems for anybody other than security consultants administrators.
2 ask all functional teams to describe the roles points to be adressed:
   A TRX in every role
   B all wanted restrictions on every TRX (described functionally)
   C orglevels on which restrictions should be build.
   D Test process for every TRX in every role (both positive and negative)
   E check all roles against table USOBT and look for manually added objects,
       if they can not give a good reason for adding these REMOVE them.
3 retest all roles based on point 2D, ask the funcxtional consultants to assist where needed. Adjust roels during testing where needed, but create a good auditable record for every change.
4 Update USOBT_C (use TRX SU24) for all changes you apply during testing
5 check your roles for the corrected TRX after this change and update the other roels involved as well.
6 ONLY allow roles that have followed the above process to go to Production.
The above steps are the only way to create a secure SAP Production system for you!

Master role-derive role concept and FICO role in dev system!!!

Hi all,
I have created a master role with t-codes
AWUW
BAPI
BD10
BD100
BD101
BD102
BD103
BD104
BD105
BD11
BD12
BD13
BD14
BD15
also included object PLOG where maintained org data
and created a derived role from that master role and generated from the master role.
After that I wanted to change the org level but the system is not allowing me to change, although I selected the values from the F4 screen.
Now I want to maintain seperate org value of each of the derived role...and when adjusted from the master role..these maitained value should not vanished.
How should I proceed???
I have another issue....I am now in Dev system....I need to create a role with FICO module with SPRO....
Should I go ahead and cread a role and assign FICO block and assign SPRO...will that be sufficient??
Thanks in Advance
Regards,
Souren

Yes, It seems that you have broken the org level by directly making changes in the org level field inside pfcg.
One way to correct this is to regenerate the role in expert mode by selecting the option 'Delete and recreate profile and authorizations' (in case you want to correct it for all the org level fields.).
If you want only for PLOG, then delete this object and add again. Then go to organization level tab at the top and give the required value. Do this in the master role and generate and push the changes to derived role. Now, goto derived role and make the org level change the same way you did for parent role..
For your second question, you will have to see what all auth objects are being checked by SPRO for a FICO module assosciate. You can create a test role with SPRO in it and then do authorization trace through ST01 to see what all objects are checked when they work.

Changing Organization level for derived roles

Dear All,
Below is my query:
When there is any requirement to change the organization level of a derived role, we go to the role and change the organization level manually.
We have derived our roles, based on the units(company codes).
Now we have a scenario, where we need to add one unit in a particular derivation of all roles.
Please suggest if there is any way of updating the organization level in mass for a specific derivation.
Regards,
Reshma Vijayan.

Colleen Lee wrote:
At least with this option you are using the PFCG functionality and not hitting the tables directly
Hi Reshma, Colleen,
Some additional warnings about manipulating the downloads:
The downloadfile is a fixed record length text file, do not mess up the data positions.
Be aware of case (upper/lower) when manipulating the file.
Make sure you do a unicode download to preserve special characters in the menu texts.
There are very, very few checks done on the file contents when uploading again. It will allow you to pollute your AGR* tables in such a way you'll need an ABAP-er or SQL-savvy colleague to clean up the mess. It is very close to manipulating the tables directly.
I once managed to get entries into AGR_1251 which didn't show up in PFCG and wouldn't even disappear from the tables after I had deleted the roles in question.
And yes, I still use this method, but I won't advise it to anyone I cannot personally train to be aware of the pitfalls ;-)
Jurjen

DB table for Derived Roles and Parent Roles

Hi Expart,
In which DB table the Derived Roles and Parent Roles are store .that is i need to find out the derived role and parent Role .i have completed the Complex and single role by table AGR_AGRS
But i have to find out the table for Derived Role
Plz help me to get those table
Thanks in advance
Tarak

It's the same table as for the master role: AGR_DEFINE (field PARENT_AGR is filled for derived roles).
~As from Forum

Missing Master and Derived Roles

Hello All,
I have got an odd scenario and I am hoping some of you might have run into the same issue or might point me to the right direction.
Back ground
We are on ECC 5.0 and have Master Derived Concept, and then Derived Roles are grouped in Composites
We recently( Last week ) created some ( say 34 ) Derived roles and some (10) composites using a combinition of the newly created derived and some Old derived roles.
Transported The derived seperatly and Composites seperately. Transports went successfully into QA and PRD.
This week we noticed that all of the 34 derived roles are missing in DEV ONLY along with 28 Master of the 34 Child Roles. All the Childs and master still exist in QA and PRD.
We have tried to look up the change Doc of the missing roles or the profiles or the authorizations of the missing roles and there is no change log under suim. Change Log shows when the role was created but nothing after that. According to Basis transports does not have any unusual log
Since its a DEV system so no delete transports have come into DEV, therefore delete transport could not be an option.
I have also uploaded one of the missing master roles from the PRD to DEV and it is succfully established the relation with the childs. I was hoping it might shake up the Change History regarding missing role but it did not, It now shows when the role was created earlier( 2006 ) and This week agian but no Delete History
Any Ideas on how to explain this behavior

Another possible and imaginable human error worth looking into is that at some stage in the past a transport request was created for the master and child roles -- okay.
Then the child roles were "broken" by changing org. levels and other fields in the authorization maintenance, so the roles themselves were deleted with the intention of creating them again from one of the "template" child-roles --> okay, seems reasonable to have happened.
Then (here is the problem!) someone released the transport before the new child roles were created. This is interpreted by the system to be a deletion transport of roles.
Additionally the sequence of the transports might have added additional obscurity to the issue and now, much later on, someone imported the transport into production which deleted the roles.
<conspiracy_theory>
The person then deleted the transport request from the queues and archived the change documents in SU83.
</conspiracy_theory>
Cheers,
Julius

All objects are inactive in derived roles (copied from existing derived role)

I need to create more than 1000 derived roles, from existing reference roles.
Reference roles are also derived roles. So I executed LSMW for mass copy.
Eg: Reference role XYZ with parent role XXX
New role(ABC) copied from XYZ ,so ABC is having same values as XYZ and master role also.
Now the issue is after executing the LSMW all roles are copied to new roles, but all objects are inactive in new roles .I am not able to activate the object also.

Hi Colleen,
Issue: I have derived roles for plant XX, now I want to derive same set of roles for YY plant. My reference plant is XX, So what am doing is copying the XX roles to New roles (YY) .No change in object or description, just copy role to new role. And I am using LSMW for the same.
After copy the roles, I will change the description and profile using another script and manually change the org values. But after copy the roles to new roles using script all objects are inactive (In red color),if am selecting the org tab ,I will get message like ,no org levels maintained. Because all objects are inactive .And there are no options (edit) to activate the objects or maintain the fields.
Thanks,
Anusha

Authorization in APO: org level concept (parent role -- derived role) ?

Hello experts,
we want to introduce some authorization / roles in APO using the typical R3 concept of having a "parent role" and derive "single roles" from such a parent role and change the "org levels" inside the single role. Testing this with master data objects like C_APO_LOC (location in APO) it seems to me that APO doesn't know about "org levels".
Whenever I create a parent role (lets say "Z_PAR_ROLE_LOC_MASTER") to access /SAPAPO/LOC3 (Location master data) and create a single role out of it (derive it into Z_SINGLE_ROLE_LOCMASTER_1234") and enter the location ID 1234 ... regenerating and populating a change from the parent role "Z_PAR_ROLE_LOC_MASTER" does immediately wipe out the location ID 1234 maintained before in the single/derived role "Z_SINGLE_ROLE_LOCMASTER_1234".
My question: is this by design that APO does not know about "org levels" or is there something special I have to consider using PFCG correctly in SCM (I can see the "Org Level" button but it says there are no org levels) ?
Regards
Thomas

I got the solution - the profile generation was missing !

Derived Role generation in BRM

Hi,
In BRM while creating a parent role, corresponding derived roles are created and sent for approval.
Post approval, the roles are generated, in the foreground confirmation message states that Parent + derived roles all are successfully generated.
In the backend system the derived role's "Authorization" tab is with a status yellow and profile is not generated. However, the derived role has all the relevant values in it and the last changed by / date is appropriate to reflect the changes done.
Can some one please point to a solution to this? We have raised an OSS for this about a month back and applied suggestions from SAP without any result.
Version - GRC 10.0 SP10
Thanks,
Sammukh

Hello Andrzej
Yes, the derived roles are in status complete. After generation of all the roles (parent+derived) the derived roles move to the maintain test cases phase. Here we maintain the test cases and close the methodology. Post this the derived roles' status become complete.
Yes, we did try re-generating them manually from mass generation from GRC. The result is same. In fact the surprising thing is following:
1. Derived role is complete and in not generated state.
2. Mass generated from GRC - still not generated.
3. Manually generated in backend system - roles are now generated.
4. Mass generated from GRC again - status that was generated from point 3 before changed to not generated again.
Looks like the generation from GRC itself is the problem, but we are unable to pin-point the issue.
Thanks
Sammukh

Mass role import with derived roles out of master roles

Hi everybody,
I want to import a mass of roles with derivation (org. values) levels.
Could you please provide me with the terminology of the org. info file.
Bulk and role info were created and could successfully imported, but the derivation level (comes up with the
org info file) never works. There are no derived roles.
Look of the org file:
Role Name [ Alphanumeric (100) ] [ Mandatory ]     Derived Org. Level [ Alphanumeric (50) ] [ Mandatory ]     From Value [ Alphanumeric (100) ] [ Mandatory ]     To Value [ Alphanumeric (100) ]
Z0007_K:FI_AP_CHANGE     Company Code (BUKRS)     CN10
Z0008_K:FI_AP_CHANGE     Company Code (BUKRS)     CN20
Z0009_K:FI_AP_CHANGE     Company Code (BUKRS)     CN30
Z0010_K:FI_AP_CHANGE     Company Code (BUKRS)     CN40
Z0011_K:FI_AP_CHANGE     Company Code (BUKRS)     MA10
Any ideas ?
Reg,
Ulrich

Hello everybody,
The right way to import orglevel fields is like that:
before the org level field, you need to add the "$" sign- like that - $BUKRS
in every line.
good luck,
best regards,
Haim Brauner

Derived roles

Similar Messages

Maybe you are looking for