Diff.between BW and R/3 roles and authorizations

Hi Experts,
Please any one let me know is there any difference for creating roles and assigning authorizations in BW and R/3 systems.
Please let me know the BW related T-codes
Regards,
Reedy V.

What version of BW? Are you using BI7 analysis authorisations.
BI7 - go [here|https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/media/uuid/ac7d7c27-0a01-0010-d5a9-9cb9ddcb6bce]
If using BW 3.5 or another similar version then build your roles in PFCG and assign to users in SU01
There is more to it which you can find [here|https://service.sap.com/SECURITY] (sorry for the poor link Bernhard ) under category SAP Business Information Warehouse Security Guides
Edited by: Julius Bussche on Jul 8, 2008 12:34 PM
Formatting and link corrected
Thanks Julius!
Edited by: Alex Ayers on Jul 8, 2008 2:10 PM

Similar Messages

Is it possible to export and import the roles and users tables?

Hi,
is there any possibility to export and import the role and user definitions?
We have a SAP MDM repository with a lot of roles and users and also with a lot of changes.
And now I'm searching for a fast and efficient way of managing the roles and users.
Thanks and Regards, Melanie

Hi Melanie,
There is no export/import functionality for roles and users. The only way to manage these in an automated way would be to write a program that uses the Java or ABAP APIs. Both APIs expose functionality to create, update and delete roles and users.
Hope this helps,
Richard

Diff between the J2ee port,webdispatcher port and ICM port

HI All,
Can some one please explain the diff between the web dispatcher port and J2ee port, I am able to under stand the diff between the web dispatcher port and the ICM port. What I understood is that all the requests will be passed to ICM through the web dispatcher , but what is the j2ee port refers ?
Thanks & Regard
Rajesh Meda

Hi Rajesh,
The Webdispatcher,ICM servers as services to reach the ABAP and Java stack respectively. ICM is thread oriented.
Any communication flows through Webdispatcher ---> ICM ---> ABAP/Java Stack.
Every instance has a ICM process in it. Webdispatcher is mainly used for load balancing and to be placed in DMZ zone for more protection of the communication channel. All the communication happens via port . Each of the service can be reached by independent ports or via Webdispatcher>ICM> J2ee.
Like direct port for J2ee we also have direct port for ABAP message server.
Hope this clarrifies. Kindly let me know in case of further queries.

Export and Import of Roles and Privileges

Hi,
We're nearing the end of our development phase and are now preparing for initial load in our QA / Test environment.
Is there a way to export the Roles and Privilege metadata from one environment to import them into the other. The Staging guide states you need to create them before importing your Identity Stores. I was hoping we didn't need to do this as it's a time consuming task to create them manually.
Thanks
Paul

What I've seen is Business Role Export / Import functionality. It is pretty straight-forward to do, just export the Business Roles in a job (limit what to export in the source SQL) to a CSV-file, then read it back in to different environment in similar job.
When we were exporting the Business Roles we expored the privilege-references as MSKEYVALUEs not MSKEYs. Note how you have named your repositories in different environments (as you know the name of the MX_PRIVILEGE differs if your ERP repository in development is eg ERP100 and in Q/A ERP200), you may need to convert the privilege names accordingly in export or import.
One more thing you need to keep in mind is to pay attention whether your data has CR+LFs, which will break the CSV, we tackled this by encrypting/decrypting the data that had line feeds (DESCRIPTION-attribute).

Customised Oracle application and access to roles and users...please advise

Hi Gurus!
We are developing a customised Oracle application where we have users and roles...user - role mapping is done in the system administration module of the application.
Now, we are also developing Oracle discoverer reports based on this. Using 10g (10.1.2.0.2) for that.
When I am creating an EUL, I select 'New EUL for Oracle Applications users only' option, but, I do not have any 'FND schema' to specify. That's where I'm stuck up!
I want to give access to the 'roles' in tha same manner as I would give to the 'responsibilities' in Oracle Apps. But, I don't know how to do it here.
Can someone guide me on this?
Thanks and regards,
Aparna

Hi Aparna
It would appear that you posted the same question on the Discoverer forum. Here is the answer that I posted there:
If your application is not E-Business Suite you cannot install Discoverer into Apps mode. This mode is reserved for applications which are E-Business Suite, which basically tells Discoverer to use authenticate users using the FND tables owned by the APPLSYS user.
In your case, even though you appear to be using Oracle applications, because you want to take advantage of your roles you will have to install Discoverer into standard mode. As you are creating your EUL you need to uncheck the box which says grant access to PUBLIC and make this a private EUL. Then you will not have the headache of worrying about setting up new users. You simply manage what a role can do (Tools | Privileges) and what a role has access to (Tools | Security).
Now, when any any user connects to Discoverer their role will be evaluated and access will be restricted.
You can do the same thing using a PUBLIC EUL, except you need to reduce what that user can do (Tools | Privileges) to an absolute minimum, and then take control of this using roles. For example, you could have a set of functional roles, one each for say AP, AR, GL and so on, but you could further break this down by privilege, thus you could have roles called AP Viewer, AP User, AR Viewer, AR User and so on. The User roles would have full access while the Viewer roles would have a much reduced set of privileges.
You are basically setting up the Library approach that I discuss in my Discoverer 10g Handbook and in my white paper which you will find on my downloads page here: http://learndiscoverer.com/downloads/downloads.htm.
I hope this helps
Best wishes
Michael Armstrong-Smith
URL: http://learndiscoverer.com
Blog: http://learndiscoverer.blogspot.com

Diff between FSS0-"bal in local curr" and OBY6- no forex dif when clear in

I want to know the difference between the setting FSS0-only balances in local currency and the OBY6 - no forex rate difference when clearing in local currency.
I tried to fined the differnce by furfing on the internet and also by F1 help from SAP. The examples which were provided are not clear to me and any body explain with a simple example.
I want to know
1. difference between the two settings
2.under what circumstances these setting need to be applied, with an example

HI Anil,
Please refer the below points.
1. FS00- Balance in local currency
If you set the above indicator then while posting any document with more than one currency then this particular GL account will
update only local currnecy amounts . (In document this particular Gl account is having only currency and it is local currency).
GL 2000            1000 DEM       600 USD
GL 1000                                   600 USD
2. OBY6 No forex diff when clearing.
You have one Invoice with Exchanger rate X
but clearing exchange rate is Y
then
If above indicator is set then while clearing the Invoice (posted with two currency and exchange rate X)
                        Payment currency            Local currency
Cash receipt             650                             650
Clearing of receivable        650                             650
then system will not consider exchange rates here.
other wise it will consider the exchange rate Y and it will post like below
                        Payment currency            Local currency
Cash receipt             650                           650
Clearing of receivable        550                           650
Revenue from overpayment      100                           100
Exchange rate losses       0                          100
I hope above will clear you issue.
Reg
Madhu M

What's the diff. between Sound Blaster Audigy MB Audio and the similar but ADVANCED ca

I just bought a Dell Inspiron 53 with?the?former card, but whenever I search for more info about it, I can only find the "Advanced" version. Please, can you tell me, what's the difference between the two cards?Also,? as I was building the PC, Dell offered only two other?audio options, and this was the middle one; none of the other choices was ideal. This appears to be a bottom-of-the-barrel card, so can anyone recommend?a replacement?card for under $40-$00 that wouldproduce very high quality music for my new 5. wireless Dell speakers?Much obliged.

I've been fiddling around in the Device Manager and it has Other Devices and under it is Multimedia Audio Controller, I can choose to either reinstall the driver udate the driver, disable it, or uninstall it. Here's what comes up on properties
This device is not configured correctly. (Code )
To reinstall the drivers for this device, click Reinstall Driver.
Help would be appreciated here. I'm a big gamer and would like to have this up and running before our first CAL Match.

Diff between jre se v1.4.2_01 and jre se v1.4.2_13

i am working on clarity and trying to connect it to Ms Project 2002/3
i am clarity version 7.5.3
the connector behaved unpredictably based on the jre version _01 and _13
it works with _13 and needs _01 to be uninstalled..
whats the reason...

You'll have to figure that answer out yourself. Review the release documentation for each of the various Java releases 1.4.2_02 through 1.4.2_13 for changes that were made.

Diff betwn JSP 1.0, 1.1 and 2.0

Hi all,
Could anyone ellaborate on the diff between JSP 1.0, 1.1 and 2.0/2.1?
Rgds,
Seetesh

You will find that the conepts or approach is different. The direction appears to be to NOT put java code in the JSP, but rather use EL (expression language) tags to address common functions. You can read about them in various locations around the Internet if you do a google search for them.
The JSTL (JSP standard tag library) is a huge step in the right direction to simpliyfing JSP code. It provides a level of abstraction to the things like XML parsing, XSL transformations, getting access to the "core" request and response contexts in a page and database access. If you are not using that tag library, it will save you TONS of time and is well worth investigating.
You can still use Java code in your pages just as always. It's just the design philosophies have changed a bit. And in some ways, for the better.

Table that stores the business role and user id mapping

Hi,
i want to know the table that stores the Business role and the business role and user id mapping in CRM system.
Thanks in Advance.
Regards,
Pricy

Hi Mary,
There is no direct table but there is a way to find it.
HRP1263 is the table where business roles are stored when maintained at org level. These are stored against the Position.
For getting user ID and position linkage refer table HRP1001.
In HRP1001 table use below criteria to get the User and Position.
OTYPE = CP
SCLAS = US
SOBID = User ID
ENDDA = 31.12.9999
Get the OBJID
Query the HRP1001 table again with following
OTYPE = CP
OBJID = OBJID from above Query
ENDDA = 31.12.9999
SCLAS = S
SOBID = Thats Position.
Pass the position to HRP1263 as below.
OTYPE = S
OBJID = POSITION
PROFILE - Thats business role assigned for the given position and user.
Hope this is helpful.
Regards,
Naresh

Roles and Attributes Maintenance

Dear all, I am a little lost in a current project on this topic. When using ERP 2005 and not using the Virsa Access Enforcer, how and where are roles and especially their attributes maintained?
Do customers create the roles including the attributes usually in a development system and transport it to the productive environment or how is this process handled.
Any information on this would be highly appreciated.
thanks,
Stefan

It's probably best if you start by reading that fine manual [User Administration and Identity Management in ABAP Systems|http://help.sap.com/saphelp_nw70/helpdata/en/fa/f63f4222fab16be10000000a155106/content.htm] which leads you to the detailed description of the [Authorization concept|http://help.sap.com/saphelp_nw70/helpdata/en/52/671285439b11d1896f0000e8322d00/frameset.htm].

IDOC for roles and profiles

Hi Guru.
I need this: I wish to export the new and the modified roles and profiles to an external non-SAP system. This non-SAP system is able to receive iDoc message.
Is it possible? Can I find n the SAP system the change point and the iDoc to do this?
Regards
Manuel Chiarelli

not for roles. no. you can:
transport them
up-/download them
RFC-copy them
but not idoc them.

Hi this pandu can i know what is the diff between pnp &pnpce ldb

hi,
this pandu can i know what is the diff between pnp &pnpce logical database.
thanks and regards,
pandu.

pretty much the same.. except that PNPCE has additional functionality to deal with Concurrent Employment.. PL go through <a href="http://help.sap.com/saphelp_erp2005/helpdata/en/c6/8a15381b80436ce10000009b38f8cf/frameset.htm">SAP Help</a> for more info.
~Suresh

Relationship between Portal and back-end roles in business package

Hi all,
I wonder how technically works on the backend system when I install a BP for SAP EP. Let's say for example that I installed on the portal the business package for SRM. I will have on the Portal some roles configured (buyer, supplier, invoice manager, etc), and some iviews in them organized by pages and workest.
How can I see the relations with those roles and the roles on the SRM backend system? And then: if I modify a standard role on the Portal, adding new functionalites (iviews), I do update the backend role? We are going to implement SSO, and users will be the same on Portal and backend system. But that also means I need to assign users to backend roles on the backend system, isn't it?
I would be glad to you if someone can provide me also a link to a document explaining the relationshipe between backend roles management and portal roles management.
Thanks a lot,
Valentina

To add.. no, you will not update a backend SRM role if you update an iView on the Portal. The Backend roles will always be assigned to the user via PFCG and do not change automatically with the Portal roles.
This help document might help you understand the concept better (Look at the Permissions vs Authorisations section):
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/c605c690-0201-0010-e8b5-94677245a46b
Hope this helps. I am sure SAP/SDN library has many such documents that you can read through.
Sudha
Message was edited by:
Sudha Mohan

In LSMW, what is diff between LSMW-BAPI and LSMW-IDOC

hello all
In LSMW, what is diff between LSMW-BAPI and LSMW-IDOC

Hi Swamy,
The differences between IDoc and BAPI are as follows:
IDOC
IDocs are text encoded documents with a rigid structure that are used to exchange data between R/3 and a foreign system.
Idocs are processed asynchronously and no information whatsoever is returned to the client.
The target system need not be always online. The IDOC would be created and would send the IDOC once the target system is available (tRFC concept). Hence supports guaranteed delivery.
With asynchronous links the sub-process on the client can be finished even if the communication line or the server is not available. In this case the message is stored in the database and the communication can be done later.
The disadvantage of asynchronous links is that the sub-process on the server cannot return information to the calling sub-process on the client. A special way for sending information back to the client is required. In addition, a special error handling mechanism is required to handle errors on the receiving side.
IDOCs may be more changeable from release to release.
IDOCs are poorly documented.
BAPI
BAPIs are a subset of the RFC-enabled function modules, especially designed as Application Programming Interface (API) to the SAP business object, or in other words: are function modules officially released by SAP to be called from external programs.
BAPIs are called synchronously and (usually) return information.
For BAPIs the client code needs to do the appropriate error handling.
Problems with synchronous links occur if the communication line or the server is temporarily not available. If this happens, the sub-process on the client cannot be finished (otherwise there would be data inconsistencies).
Synchronous links have the advantage that the sub-process on the server can return values to the sub-process on the client that has started the link.
BAPIs are not totally immune to upgrades.
BAPIs are reasonably well documented.
Reward points if useful.
Best Regards,
Sekhar

Diff.between BW and R/3 roles and authorizations

Similar Messages

Maybe you are looking for