Destrict access to SQ01

Hello Gurus ,
I would like some help with restraining access to users that have Tx SQ01.
I know there are two ways to do this :
1. With authorization objects
2. With user groups in SQ03.
Allthough i created user groups , in SQ01 i have still the option to go over
SQ01> Edit>Other user groups and choose a different user group. This is probably because i have more rights . How can i be sure , or better deactivate this option to a user that is using SQ01 so he can execute, create Queries only within a limited SAP area with the infosets that are assigned to his user group ?
Regards,
David (SAP Basis)

Like Jurjen said, Securtiy SAP is not about denying but granting access carefully.
Many user perform daily reporting combining different criteria and queries are to ease their their life
You can give access only to SQ01 and deactivate S_QUERY.
Then assign the users to to particular query user groups using SQ03 so that they may have access to execute queries which they actually need.
When the users execute SQ01, they can see the queries for which they are authorized.
This is a two forked advantage.You prohibit change access in SQ01 at the same granting access to queries which the user needs for reporting on display.
And if you are speaking of production environments, then there is no danger of user creating a query via SQ01 as the prd client is normally closed for changes!
Regards
Deepa

Similar Messages

MRP Area tables for MD06 information access like SQ01, DBM logical database

We currently use SQ01 DBM logical database to access MD06 information (tables MDKP and MDTB). The MRP results from the MRP Area are not showing in this query. This implies that the MRP area, MRP results are stored in other tables.
I have reviewed tables (MDLV, MDMA, MDLG, DVER, MDIP) from a similiar thread. However, they do not contain the MRP data (planned orders, stock, production orders ect) like in the DBM logical database.   This data access is very powerfull for exporting planning data for more robust analysis.
Any help is much appreciated.
Thank you

Hi,
       Please try FM: 'AUFBAUEN_MDPSX_ANZEIGEN'.
    MD06 dame come many table.
Example:
(Plant level)
icm61w-fabkl = wk_fabkl.                  :Factory calender
imt61d-matnr = p_matnr.                    : Materials
imt61d-werks = it_tbl-werks.            : Plant
AUFBAUEN_MDPSX_ANZEIGEN 呼出
CALL FUNCTION 'AUFBAUEN_MDPSX_ANZEIGEN'
    EXPORTING
      ecm61w      = icm61w
      ecm61x      = icm61x
      emt61d      = imt61d
      et399d      = it399d
      ECM61B      =
      ESFILT      =
    IMPORTING
      icm61m      = wa_e_cm61m
      imdkp       = wa_e_mdkp
      imdsta      = wa_e_mdsta
    TABLES
      mdpsx       = it_mdps
regards,
   Gaito

Restricting Access for SQ01 User Group

Hi ,
Please let me how to Restrict Access for a User Group to only some of the specific users?
Thank you
Edited by: Vibhor Arora on Apr 12, 2010 7:29 AM

Hi,
Can you please clarify what exactly you want to know, your request can be interpreted in a few different ways.
If you are concerned that people have access to all user groups, then you need to remove access to S_QUERY activity 02 and I think activity 23. They will lose access to all user groups that they are not assigned to via SQ03.

Limit infoset access in SQ01

Hi experts,
We created an infoset and assigned it to a user group. Then we assigned one user to this user group and yet other users can create queries using the user group and infoset.
How can we limit the access of other users not assigned on the user group?
Thank you.

Don't really understand your problem.
Do you mean that the infoset is assigned, say, to User group 1.
User A is asigned to User group1. User B is not.
User B can also make use of the infoset
Is that your problem?

Way to allow the user access to the saved lists of this Z report

We have a Z report that we want to run at midnight each Sunday and then view the output/layout first thing Monday morning. We can schedule the report to run but it appears that the only way we can save the output as a 'file' for later viewing is by using the "Save with ID" option, which puts the output into a SAP 'saved list'.
The problem with this is that it doesn't appear to be possible to access that list from the Z-report - it would appear that you have to go into SQ01 and use the 'saved list' button. This means giving the Z- report user access to SQ01 as well as Z-report, which, for security (SOD) reasons we don't want to do.
We can run the report in foreground with the output option "File store" and save the output as a file to a specified location,. But this option doesn't appear to be available when the report is scheduled as a background job. If this is done, the background job runs but there's no output anywhere, as far as we can tell.
So what want is to run the report in background but with the output option 'File store' or equivalent (i.e. an output stored somewhere that the report user can view). Is this not possible, or have we missed something in setting up the report run?
Or is there a way to allow the user access to the saved lists of this Z report without giving them T-code SQ01?
Thanks

Hi !
I just wonder if the answer from Varishtb below did solve your propblem.
I have exactly the same problem as you. I also want to be able to look at the saved list without using the sq01.
If you solved it I will be grateful to get the solution.
regards Lars
answer:
You can call the infoset query directly from a transaction code. There's
no need to copy it as a 'Z-report' (or as a custom report). In fact,
everytime you're copying an infoset query to a report, you're calling
for problems the next time you face an upgrade. (That is because SAP
changes the internal logic used to handle the infosets queries from
version to version)
We're using some infoset queries and they work fine this way.

Utilizing SQ01 SQ02 for user report generation of production data

I am interested in utilizing sap query transactions SQ01, SQ02, and SQ03 to create and customize end user reports that will be used by our audit team to analyze SAP data in our production environment. My objective would be to have one person with authorization to run SQ01,02,03 and have that user create all the reports that would be required for the team to use. This way there isn't a bunch of users out there using SQ01 indiscriminately or perhaps not using it at all. I currently have authorization to run SQVI but it is limited. From what I understand there is more flexibility with SQ01 because they allow you to create calculated fields and offer more formatting options. Most of these reports would be related to finance, sales, vendor, customer, etc.
My question is this. How do I create these custom queries and allow multiple users to access and run them? Are the queries created directly in production? Are they created in DEV and then tested in QA before being transported to Prod? I understand you can map an sap query program to a transaction and then add that to a role but isn't the program name generated by SQ01 different in every instance? I would like this code to be reproducible as I have 5 different SAP instances in which these reports would be used. Same reports, different data.
I am looking to leverage the power of SAP query to produce meaningful reports for our team without having to use programmers to develop them from scratch. What is the optimal approach to doing this without creating a lot of hassles and without creating additional security risks?
If I create a query based on SAP tables I have access to does the general user also have to have authorization to those tables in order for the query to run for them? In theory the entire team should have authorization to the same standard SAP tables because we all have the same roles assigned but I may have some additional tables assigned to me because I am the IT auditor. Just confirming.
I appreciate any and all suggestions. I would like to proceed with the best solution as soon as possible.
Thank you very much.
Mark

Hi Mark,
It is best to create queries in dev rather than doing it in prd directly.
Query user group can be used to control the access in production.
You can have one query administrator with access to sq01,2,3 and sqvi who will assign query user group to respective users in prd so they can run these.
BR,
Mangesh

SQ01 authorization

Hi Expert,
I created SAP query for users, and assigned users with their respective infoset and user group.
The problem is that when users access SQ01 to execute the queries, users have authorization to change / maintain the queries, which I want to disable this functionalities.
I would like the users have authorization to execute the queries only and they are not allowed to change / maintain the queries.
Question:
What kind of authorization object / way that I can achieve the above objective?
I read this post, Restricting Access for SQ01 User Group but it is not working to me. I am from SAP FICO side (not much knowledge on basis).
Thanks in advance.
sbmel

Hi Both,
Thanks for your reply.
Activity under object: S_QUERY, only has 02, 23, 67 (they are not working to prevent user from changing the queries)
I have several queries; therefore the level of maintainability is not advisable if each queries create a Tcode for it.
Do you have any other suggestion?
If there is really no way to prevent user from changing the queries from SQ01, one way that I can think of is to build a customized tcode for SQ01, for example: ZSQ01, and from this tocde, disable some of the buttons (like change button).
Kindly help on this.
Thanks in advance.
Sbmel

All the users are able to access all queries in all infoset's.

Hello All-
All the users are able to access all the queries in all the query areas and infoset irrespective of the user group setting. even though the users don't have access to a particular infoset they are able to access and execute the queries in them and also edit them.
Please advice if there is a setting that is set at the client level or any other setting. We are in ECC 5.0 recently upgraded from 4.6.
Thanks-
Chakri.

Thank you all for your prompt responses!
The role all these employees are having is a composite role which is having SQ01, SQVI as a single roles in it.
But if the users have the access to SQ01 then why are they able to edit or change any other queries which they don't have access as per the user group. What is the use for the user group?
Please advice with any thoughts!
Thanks-
Chakri

How to restrict a user group of SQ01 for only execution for some users

Hi,
   I would like to know if it is possible to restrict the access to SQ01 transaction for some users. I would like that these users have only execution access to some queries associated with an user group.
   Do I have to associate the user group to the users I want to have access to it? How can I do it=
   Do I have to associate the queries created on SQ01 to the users? or it is enough to assign the users to the user group where the queries are defined?
   Do I have to associate the infosets created on SQ02 to the users? or it is enough to assign the users to the user group to which the infosets are associated?
   Thank you,
   Luz D.

I suggest you do a web search on SQ01 and SQ02. That'll bring along SQ03 as well.
There's so much information available on the web that there's no reason to repeat it here.
[try google|http://www.google.com/search?hl=en&safe=off&q=SAPsq01sq02&meta=]
Jurjen

Report with purchase requisitions and purchase orders: how?

Hi,
I need to get a list of items bought with their purchase requisitions and purchase orders (when they exist). This can be done looking at each purchase order (ME23N), ou purchase requisition (ME53N), and writing it down. But in some cases, I have to do it on about 450 operations. I'd like to get this list without having to search for each requisition ou order. I can get a complete list of orders and requisitions, but without any relationship between them (they are mixed as if they were the same thing, but there´s a field telling it that row is an order or a requisition). Using some macros in excel, I can find this relationship in 40% of the cases (for example, if item 421351 was purchased only once, an order for item 421351 is related to a requisition for item 421351). Is there any way to get this list automatically? Or is there any field that tell me this relationship?
Thanks,
Francisco Morbiolo
Votorantim Cimentos
Votorantim, SP - Brazil

Sorry, I forgot to tell this: I don´t have access to SQ01/SQ02/SQ03.
I get the orders and requisition reports using ZGLPS020.
Thanks,
Francisco Morbiolo
Votorantim Cimentos
Votorantim, SP - Brazil

Question on creation of t-code for SAP query

Hello,
I posted a thread in here back on 06/20/2007 asking for help on creating a t-code for a SAP query. one of the responses that I recieved was
<i>"Sure, all you need to do is get the report name which is generated by the query. You can find this in SQ01, select the query and from the menu, Query, More Functions, Display Report name. Then go to Se93 and create the tcode with this report name."</i>
the report name was AQFKZFINANCE====GL_FRANCE=====.
I created the t-code using this name. I had it transported to my QAS system an now we are getting a error stating that the the program is not found.
When I check in SE38, I can see this program AQA0ZFINANCE====BP_RECON====== in both my development system and my QAS system.
Should I have created in the t-code using the AQA0ZFINANCE====BP_RECON====== instead of the AQFKZFINANCE====GL_FRANCE===== program?
Is there any reason why the program AQFKZFINANCE====GL_FRANCE===== would not be in QAS?
I do not have access to SQ01 in our QAS system so I cannot perfrom the process stated above.
thanks in advance for the help.

Hi,
Please check this thread perhaps it may help.
Re: How to create TCode for Sapquery
Regards,
Ferry Lianto

T-Code Securities

Can I limit functional through security for a t-code? Example; we created some queries in SQ01; gave users access to sq01, by accident a user deleted all the queries. Can give access to the user without having the authority to delete? I still want them to be able to run and analyze the data, but not be able to delete. Any suggestions?
Thanks, Kev

users that only have to run queries need SQ00 and nothing else. this does not allow them to create. change or delete Queries. A even better suggestion go to BW

ABAP Query Execution via Custom Transaction Code - Not working

We have created an ABAP Query in our DEV client and we then created a transaction code to run that query. We have done this because the customer does not want anyone to have access to SQ01, SQ02 in production. This works great in DEV but we can not get it to work in production.
The ABAP Query was exported to our Prod client successfully. I say exported because you do not do direct transports with queries.
We then transported the new transaction code to run the query to production and it was successful.
However, when we run the transaction is production we get a sys dump stating it can not find the query.
We believe the problem is the TRDIR table is missing an entry for the program in production (it has an entry in DEV).
I would have thought that the export on the query would have brought in this entry -but obviously not.
Any suggestions on how we can get this entry into the production client? Did we miss a step on the export that would do this? We want to only bring over this entry - not the entire TRDIR table for obvious reasons (size (1.5 million entries, programs not ready for production, etc.).
Please help!
Thanks.
Scott

Hi,
The above solution will work if you assign the transaction in one server, If you want this will not work in quality/production boxes when transported the query..the program name will not be the same in all the servers...
For this. Do the below:
In SE93, Create a Paramter Transaction
-> Transaction = Start_report
-> In default values, give the below details:
     D_SREPOVARI-REPORTTYPE = AQ
     D_SREPOVARI-EXTDREPORT = Name of the Query
     D_SREPOVARI-REPORT = User Group
Save the transaction..Now if the program is generated with different names in the quality/proudction, this will still work..
Regards
Vijay Hebbal

Change Management Process for SAP Queries

Our company has recently implemented SAP. We are having some struggles with agreeing on a process for developing queries in SQ01. Our functional specialists currently have to create a query in DEV200 then download to DEV100 to create a transport.
Is this the general practice? It seems very strange and way too cumbersome considering SAP Query was designed for quick access to data. As for security the tables are already protected by the roles assigned to the users and the queries are assigned to User Groups within the query.
It also seems that HR uses the queries for all kinds of data searching so access to SQ01 to create a quick query in PRD seems appropriate.

Hi Karen,
I have seen some companies severly restrict query writing and usage because queries, if not written well, can seriously degrade system performance.
A potential rationale for your company's approach could be to test the query's efficacy and resulting system performance when a query is run. However, this kind of test won't be very accurate unless you do frequent refreshes of your production system.
I have been with some companies who do write queries in PRD, but the ability to write queries is limited to a very few number of people and they wind up becoming strictly query writers which somewhat defeats the purpose.
A lot of the answer to how your company should approach query writing is going to depend on your landscape, who has access to write queries, and if that access is to information that crosses all functions or is limited to a smaller set of data.
If your company has always had information dissemination controlled by IT, i.e. users have historically had to go to a central group to get a report, then there will be cultural changes needed as well as training if the user population should write queries directly in PRD.
Regards,
Julie

Restricting Queries in HR: Compensation Management User Group

I am trying to restrict the Infoset /SAPQUERY/HR_XX_CM_03, which contains salary/compensation queries, assigned to User Group /SAPQUERY/H0, from being accessed by anyone. In SQ03, user group /SAPQUERY/H0, there are no users assigned but users with access to SQ01 can select the user group /SAPQUERY/H0 and access the queries tied to infoset /SAPQUERY/HR_XX_CM_03. Why are users able to access the infosets of the user group when no users are assigned to the user group?

Turns out that security authorization for access to SQ01 had an S_QUERY value of 02 which allows for full change. With this value the user group/user assignments done via sq03 did not work. Setting S_QUERY to 23 allows for user group assignment to restrict access in sq01

Destrict access to SQ01

Similar Messages

Maybe you are looking for