FD32 restrict users based on a schedule of authority

All,
I have a requirement within FD32 to restrict users based on a schedule of authority. For example, only allowing credit limits to be changed in a user's authorized dollar range. I was able to restrict the Credit Limit field (change/display) by using field groups, but I have an extension of the requirement for a schedule of authority. Can someone please help?

You could use F_KNA1_BED, I guess - but that would mean excessive maintenance of both: BEGRU and customers, if I understood your scenario correctly and you really, really want to break that down to single customers.
It would be even more excessive to utilize F_KNA1_GRP. Can be done, though.
Both solutions are completely un-elegant and I am not happy proposing them. But I am curious as a cat: what exactly is the business process expecting you to restrict access to customer data down to a single customer?
Edited by: Mylène Dorias on Mar 24, 2010 8:39 AM

Similar Messages

Restrict users based on Customers

Hi ,
In ECC system, we have general requirements to restrict users based on customer account group where customer account group is represented as Site/Store.
Possible values for Customer Account group -
- Reference Store
- Head Store
- Wholly Owner Store etc.
Till this point everything is fine. However, Client has few additional External Stores which are represented as one Dummy Site and Customers belonging to that store are actual external Stores.
Example, we have additional Value for Customer Account Group -
- Dummy Site
And now all the Customers part of dummy site is actual stores and we are needed to drill down our restriction to this Customer (So called Stores).
To restrict used based on customer account group/Stores, we can utilize F_KNA1_GRP with filed KTOKD (Customer Account Group). However, is it possible to create roles based on individual customers of these Stores?
If yes, how can we do that?
P.S. I had a look at authorization object F_KNA1_BED with filed BRGRU. Can this object help us in fulfilling our requirement? Or there is any other SAP provided authorization object which can help us to restrict on Customer values?
Thanks,
Sheenam

You could use F_KNA1_BED, I guess - but that would mean excessive maintenance of both: BEGRU and customers, if I understood your scenario correctly and you really, really want to break that down to single customers.
It would be even more excessive to utilize F_KNA1_GRP. Can be done, though.
Both solutions are completely un-elegant and I am not happy proposing them. But I am curious as a cat: what exactly is the business process expecting you to restrict access to customer data down to a single customer?
Edited by: Mylène Dorias on Mar 24, 2010 8:39 AM

Restricting Users based on GL Authorization Group

Gurus,
I have got requiremnt from our finance consultant/team for restricting users from accesing particular GL accounts in a company code. There are some GL which users are not supposed to view.
We have created authorization group in FS00 -Control data , but we cannot see that group in object F_BKPF_BES(Account authorization for GL accounts).
Please help.
Regards

Hi,
Step1: Create Tolerance Groups
Step2: Assign Users to Tolerance Groups
Step3: Remove/Add T Codes in Users Master Data (T Code: SU01)
Thanks
Chandra

Restricting user based on Delivery Block in VA02

Hi ,
     As per my bussiness team I am suppose to restrict the user depening on delivery block in transaction VA02 .There are no SAP pre-defined feilds to restrict at delivery block level from PFCG .Please kindly help .Thanks in advance .

Hi,
Can you please assist, with the Issue below?
1)     Tcode : VA02
2)     I have created authorization Object for field level authorizations for
Delivery Block   --- LIFSK
Billing Block -
 FAKSK
                           Maintained Field Level SD Authorizations                                ZV_FIELD
Maintained Field Level SD Authorizations                                T-ED49128000
                    Activity                       02, 03                                                                      ACTVT
                    Billing block in SD document   Z3                                                                          FAKSK
                    Delivery block ( document heade ZH                                                                          LIFSK
3)     Now I want to restrict to a particular Delivery Block and a Billing Block, but I am able to change to other Delivery Block and Billing Blocks even though I have restricted to Z3 and ZH ( this case)

Is it possible to restrict user based on personal information workset ?

Hi Experts,
I have a requirement in which I need to allow other worksets in ESS to be accessed only if one workset "Personal Information" is completed.
In this workset "Personal Information", there is an iView "Certify Own Data". In this ivew there are couple of checkboxes which need to be ticked and saved. this checkboxes will automatically be checked when the user enters required data in other related ivews such as "Address", "Family Details", "communications" etc.
All I want to achieve is to allow the user only if he fills all his personal information and certify's his own data. After clicking on SAVE button only he would be able to access other worksets such as "Attendence".
Please someone suggest me how to achive this functionality. Do i need to develop new application or i can achieve this functionality by just maintaining some kind of iview validation.
Earlier response would be much appreciated.
Thanks
Uday

you can do a badi validation
BADI HRPAD00INFTYBL and HRPAD00INFTYDB for new framework of infotype.
Please refer the SAP Note 864910 BADI HRPAD00INFTYBL and HRPAD00INFTYDB
But to control the workset would be difficult in standard, probably you can do a modification
you can control services using proxy classes though

How to Restrict users to change password

Hi All,
I would like to restrict user to change password only defined number of times in a day, Is it possible to do it through group policies.
Please note i am already aware of "Minimum Password age" feature, however i do not want to use it as the minimum value that i can set here is 1 day. I would like to restrict users based on password reset threshold e.g. User can reset his password
in a day only twice or thrice.
Thanx & Regards,
Wasim Parkar

If you want to limit the user to have his/her password changed for a specific number of time every day, I have to say
NO thats not possible. PSO's as other mentioned,can be used to have different password policies. Maybe you can set the msDS-MinimumPasswordAge
to 00:04:00:00 which is equal to 4 hours. It means every 4 hours a user will be able to change his/her password. So in each day a user can change the password 6 times, since a day is 24 hours.
Do not forget a day start from 00:00 AM up to 11:59 PM. So in a 9 to 5 job, a user may change the password 2-3 times.
Hope it helps.
Mahdi Tehrani Loves Powershell
Please kindly click on Propose As Answer or to mark this post as
and helpfull to other poeple.

Restrict users from scheduling job

Hi All,
Now our users are able to schedule the job from SM37. By default I think the job is running on the main server and the performance of the system is effected badly.
Is there any way we can restrict the users to schedule the job on a particular server and try to avoid them from scheduling the job on a particular server.
Thanks.

This can be done with a small work around.
When you run a job what actually runs is the program which you set it as steps
Now, set authorisation for that particular program so that only few users who are authorised can run the job.
Now, while scheduling the job, in SM36 you can specify the target application server on which the job has to run..
Hope it helps
Thanks,
Babu Kilari

Retrieving ALL values from a single restricted user property

How can I retrieve ALL values of a single restricted user property from within
a .jpf file?
I want to display a dropdown list within a form in a JSP which should contain
all the locations listed in the property 'locations'. I ever get just the default
value when I access the property via
ProfileWrapper pw = userprofile.getProfileForUser(user);
Object prop = pw.getProperty("ClockSetup", "Locations");

Well, the code you've got will retrieve the single value of the property
for the current user. You're getting the default value because the
current user doesn't have Locations property set, so the ProfileWrapper
returns the default value from the property set.
I assume you want to get the list of available values that you entered
into the .usr file in Workshop. If so, I've attached a
SetColorController.jpf, index.jsp, and GeneralInfo.usr (put in
META-INF/data/userprofiles) I wrote for an example that does just this.
It uses the PropertySetManagerControl to retrieve the restricted values
for a property, and the jsp uses data-binding to create a list from that
pageflow method.
For a just-jsps solution, you can also use the
<ps:getRestrictedPropertyValues/> tag. I've attached a setcolor-tags.jsp
that does the same thing.
Greg
Dirk wrote:
How can I retrieve ALL values of a single restricted user property from within
a .jpf file?
I want to display a dropdown list within a form in a JSP which should contain
all the locations listed in the property 'locations'. I ever get just the default
value when I access the property via
ProfileWrapper pw = userprofile.getProfileForUser(user);
Object prop = pw.getProperty("ClockSetup", "Locations");
[att1.html]
package users.setcolor;
import com.bea.p13n.controls.exceptions.P13nControlException;
import com.bea.p13n.property.PropertyDefinition;
import com.bea.p13n.property.PropertySet;
import com.bea.p13n.usermgmt.profile.ProfileWrapper;
import com.bea.wlw.netui.pageflow.FormData;
import com.bea.wlw.netui.pageflow.Forward;
import com.bea.wlw.netui.pageflow.PageFlowController;
import java.util.Collection;
import java.util.Iterator;
* @jpf:controller
* @jpf:view-properties view-properties::
* 
* <view-properties>
* <pageflow-object id="pageflow:/users/setcolor/SetColorController.jpf"/>
* <pageflow-object id="action:begin.do">
* <property value="80" name="x"/>
* <property value="100" name="y"/>
* </pageflow-object>
* <pageflow-object id="action:setColor.do#users.setcolor.SetColorController.ColorFormBean">
* <property value="240" name="x"/>
* <property value="220" name="y"/>
* </pageflow-object>
* <pageflow-object id="action-call:@page:index.jsp@#@action:setColor.do#users.setcolor.SetColorController.ColorFormBean@">
* <property value="240,240,240,240" name="elbowsX"/>
* <property value="144,160,160,176" name="elbowsY"/>
* <property value="South_1" name="fromPort"/>
* <property value="North_1" name="toPort"/>
* </pageflow-object>
* <pageflow-object id="page:index.jsp">
* <property value="240" name="x"/>
* <property value="100" name="y"/>
* </pageflow-object>
* <pageflow-object id="forward:path#success#index.jsp#@action:begin.do@">
* <property value="116,160,160,204" name="elbowsX"/>
* <property value="92,92,92,92" name="elbowsY"/>
* <property value="East_1" name="fromPort"/>
* <property value="West_1" name="toPort"/>
* <property value="success" name="label"/>
* </pageflow-object>
* <pageflow-object id="forward:path#success#begin.do#@action:setColor.do#users.setcolor.SetColorController.ColorFormBean@">
* <property value="204,160,160,116" name="elbowsX"/>
* <property value="201,201,103,103" name="elbowsY"/>
* <property value="West_0" name="fromPort"/>
* <property value="East_2" name="toPort"/>
* <property value="success" name="label"/>
* </pageflow-object>
* <pageflow-object id="control:com.bea.p13n.controls.ejb.property.PropertySetManager#propSetMgr">
* <property value="31" name="x"/>
* <property value="34" name="y"/>
* </pageflow-object>
* <pageflow-object id="control:com.bea.p13n.controls.profile.UserProfileControl#profileControl">
* <property value="37" name="x"/>
* <property value="34" name="y"/>
* </pageflow-object>
* <pageflow-object id="formbeanprop:users.setcolor.SetColorController.ColorFormBean#color#java.lang.String"/>
* <pageflow-object id="formbean:users.setcolor.SetColorController.ColorFormBean"/>
* </view-properties>
public class SetColorController extends PageFlowController
* @common:control
private com.bea.p13n.controls.ejb.property.PropertySetManager propSetMgr;
* @common:control
private com.bea.p13n.controls.profile.UserProfileControl profileControl;
/** Cached possible colors from the User Profile Property Set definition.
private String[] possibleColors = null;
/** Get the possible colors, based upon the User Profile Property Set.
public String[] getPossibleColors()
if (possibleColors != null)
return possibleColors;
try
PropertySet ps = propSetMgr.getPropertySet("USER", "GeneralInfo");
PropertyDefinition pd = ps.getPropertyDefinition("FavoriteColor");
Collection l = pd.getRestrictedValues();
String[] s = new String[l.size()];
Iterator it = l.iterator();
for (int i = 0; it.hasNext(); i++)
s[i] = it.next().toString();
possibleColors = s;
catch (P13nControlException ex)
ex.printStackTrace();
possibleColors = new String[0];
return possibleColors;
/** Get the user's favorite color from their profile.
public String getUsersColor()
try
ProfileWrapper profile = profileControl.getProfileFromRequest(getRequest());
return profileControl.getProperty(profile, "GeneralInfo", "FavoriteColor").toString();
catch (P13nControlException ex)
ex.printStackTrace();
return null;
// Uncomment this declaration to access Global.app.
// protected global.Global globalApp;
// For an example of page flow exception handling see the example "catch" and "exception-handler"
// annotations in {project}/WEB-INF/src/global/Global.app
* This method represents the point of entry into the pageflow
* @jpf:action
* @jpf:forward name="success" path="index.jsp"
protected Forward begin()
return new Forward("success");
* @jpf:action
* @jpf:forward name="success" path="begin.do"
protected Forward setColor(ColorFormBean form)
// set the color in the user's profile
try
ProfileWrapper profile = profileControl.getProfileFromRequest(getRequest());
profileControl.setProperty(profile, "GeneralInfo", "FavoriteColor", form.getColor());
catch (P13nControlException ex)
ex.printStackTrace();
return new Forward("success");
* FormData get and set methods may be overwritten by the Form Bean editor.
public static class ColorFormBean extends FormData
private String color;
public void setColor(String color)
this.color = color;
public String getColor()
return this.color;
[GeneralInfo.usr]
[att1.html]

User based uninstall collections - Dynamic

Hi Guys,
I have been looking for sometime at how User based uninstalls are done and I see that mostly people do an Exclude on the collection and deploy an uninstall to basically everyone who DOESNT have the application deployed to them. The issue with this is
if you have a high number of apps (500 lets say) you deploy 400 either uninstall or install deployments to everyone which dramatically slows down deployment of apps on new machines etc.
With APP-V the queries are fairly straight forward and we have dynamically changing uninstall collections that only show users that have the app for them in a compliant state on a workstation in the estate, when they are fully unpublished they drop
out of the collection based on compliance state.
I am trying to achieve the same method for uninstall collections where physical installs are used. Unfortunately there isn't a class like the APP-V AppClientState for Physical apps, or from what I can see at least and just wanted to see if anyone had
achieved uninstall collection for physical apps in a more dynamic way than doing Include/Exclude on the collections which I see as very static and uneconomical.
Many thanks,
Adam

Hi Hican, Torsten,
Thanks both for your replies. below is the query i have used. I'll just be clear that this may not suit a lot of environments because of users moving around etc.
select SMS_R_USER.ResourceID,SMS_R_USER.ResourceType,SMS_R_USER.Name,SMS_R_USER.UniqueUserName,SMS_R_USER.WindowsNTDomain from SMS_R_User where uniqueusername in (select distinct SMS_G_System_SYSTEM_CONSOLE_USAGE.TopConsoleUser from SMS_G_System_ADD_REMOVE_PROGRAMS INNER JOIN SMS_G_System_SYSTEM_CONSOLE_USAGE ON SMS_G_System_SYSTEM_CONSOLE_USAGE.ResourceID=SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID WHERE SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = '<ARP DISPLAYNAME>' and TopConsoleUser not in (Select SMSID From SMS_CM_RES_COLL_XXXXXXX))
This query basically finds all workstations with a specific Display name in ARP, it then looks at the topconsoleuser in the SystemConsoleUsage class for that workstation. The User resource is then pulled back based on that username and the uninstall is deployed
to the user alongside the install.
When the machine tied to that user no longer has that software installed the user drops out of the collection. I have these collections scheduled to do an update overnight at random intervals.
You will note at the end i use a "NOT IN" clause so i can exlude specific accounts from being included in the uninstall collections. The reason for this is we have a couple of service accounts that gets used heavily in various places
and end up getting registered as the top consoleuser in some instances. This is put in as a safeguard.
the only bits in the query that change is the <DisplayName> section which is what gets added in ARP.
SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = '<ARP DISPLAYNAME>'
Again you need to be careful here as a program may have the same displayname as another if it hasnt been versioned correctly. in this case it may be better to use another attribute such and Product GUID.
Lastly if you choose to have an exclude collection like myself the collection Class will also need amending:
and TopConsoleUser not in (Select SMSID From SMS_CM_RES_COLL_XXXXXXX)
Somone may say there is an issue with doing it this way. obviously if users roam a lot you could end up stripping software off peoples machines which is why i say it may not suit some environments but this goes quite well where we are.
Some users may also not show if they are not yet registered as the TopConsoleUser of their workstation yet as this is a 3 month calculation (if i remember rightly). If this is being put in with a new not yet deployed app it looks clean from a returned list
of users standpoint, if however you have an estate where applications have never been unstalled and workstations have changed hands, initially you will see a lot of users in the uninstall collections which werent in the install. These applications will uninstall
for them and they will drop out of the collections.
Hican, like i said adding the software metering part in to the above query could prove even more economical as the uninstall deployment wouldn't actually be deployed if the software was active. If i get a chance i will look at this.
Hopefully the above makes sense, obviously this is just my take on how to do some uninstall collections and if somone decides to try it they are doing so at their own risk. retrofitting uninstalls is painful and risky.
Thanks,
Adam

Need to restrict users from adding or modifying folders or reports

Requirement: Need to restrict users from adding or modifying folders or reports through Info view and to reflect the modifications only thriough LCM.
Issue: Customer wants to restrict users from adding or modifying existing reports from Infoview and need to force users to do make the changes through Life cycle manager tool.
As per my understanding LCM can only be used to to promote folders and objects from one environment to another and to schedule the promotion of these jobs on a daily basis.My query is:
Can we add or modify existing reports or folders using the LCM tool?
Could you please help me out in this issue and provide me your suggestions.
Thanks in advance.
Prashanthi Rayaprolu.

You can not restrict that using LCM. Need to modify the rights at the folder level.
Explicitly remove the following rights for the user group,
Add objects to the folder
Edit objects
Delete objects
Copy objects to another folder (check this if required)
Once the above four are denied then users wont be able to Edit/Add/Delete reports in that folder.

User Based Security in Power BI (Power Pivot / Power View)

I am looking for a way to implement User based security (based on user access needs to restrict data) for my Power BI reports. Is there any way implement this kind of security. We have this support in traditional OLAP cube by creating roles and manage them
at different dimensional data.
Any help would be highly appreciated.

Hello,
You want to implement this functionality using the Power BI Preview or using the Power BI reports integrated in an application?
Hugs!
Bruno Destro
Dicas de programação em .net, C# e SQL - http://smcode.com.br/blog.aspx

User based authorization to create Purchase Orders out of Purchase Req.?

Hello,
I have the following requiment for my client:
User based authorization to create Purchase Orders out of Purchase Req.?
I am told the same can be achieved using same standard menu path in IMG/Customizing.
Please advise with the menu path and detials, Usefull answers will be rewarded.
Thanks

Using OMET Function Authorization, you can restrict users to create Purchase orders without Purchase Reqn.
Using OMET trxn code Create one Function Authorixation Called pr and in General Parameters tab Select the Field Selection and in Possible reference Objects Tab Mark the With ref to Prs check box and save.
Next, you've got to associate via SU01
Click Parameters, insert a new parameter id EFB to the authorization code.
Type in Parameters value you want e.g. XX
You have to assign the control for ALL the SAP buyers via thier SAP users id.
Logoff and login again. Then try to create a Purchase Order without a reference.
From Next time whenever you try to create with out referring PR it will not allow you to Save PO.
Regards,
Ashok

Restricting User from creating new records using when-validate-record

Hi,
I have a requirement for which I have to restrict he user from creating a record in the Supplier Master form if the suppliier type is 'Affiliate Supplier'.
I have done the following setups
Seq 10
Description Restricting user from creating Affiliate records
Level Function
Enabled Yes
Condition:
Trigger Event WHEN-VALIDATE-RECORD
Trigger object VNDR
Condition "${item.VNDR.VENDOR_TYPE_DISP_MIR.value} is NOT NULL
and
${item.VNDR.VENDOR_TYPE_DISP_MIR.value} LIKE 'Affiliate%'
Processing Mode BOTH
Context
Level User
Value User Name
Action Sequence 1
Type Message
Action Description Saving Affiliate record
Language ALL
Message Type Show
Message Text You Cannot Create Affiliate records Here
Action Sequence 2
Type Builtin
Action Description Stop Proceesing
Language ALL
Action Enabled Yes
Builtin Type RAISE FORM_TRIGGER_FAILURE;
This is working good on one instance but when I moved it to another instance
when I query the form and try to navigate to the bank accounts tab of the form which is based on a differnt block i.e VNDR_USES block, the when-validate-record trigger fires there also and stops the processing.
Any suggestions on this would be higly appriciated.
Thanks in Advance.

Hi Srini,
Yes, it does work...but in a Form Session if i Create more then one Item, in some cases it fires for the first records and not sleeps for the second.
Sometimes it doesn't give any response.
Appreciated if you divert to the link to check the Pacthes for 11.5.10 on Form Personalization.
Please share any ideas/example if yiou have to achieve the below requirement.
Requirement:
Once New record is created , a Custom Procedure should be invoked.
with out closing Form i am able to create n number of Items, so for every Item it should invoke Custom PLSQL Code on Save.
Let me know if i can achieve the same in Custom.pll .....as i can use either of Options.(Form Personalization/Custom.pll)
Thanks & regards,
Edited by: user632004 on Mar 16, 2010 7:50 PM
Edited by: user632004 on Mar 16, 2010 8:09 PM

How to produce different outbound delivery based on different schedule line

Hi,
I want to create different outbound delivery based on different schedule line time,but system automatically create a combining delivery document with a sum number.
For example,
schedule line
date               goods issue time   qty
2011.08.24     08:00:00                1
2011.08.24     10:00:00                1
when I create the outbound delivery, system create only one document with quantity 2.
But I need two documents with quantity 1 in every document.
How to solve this requirement?
Thanks.

Hi,
I viewed the item requirement in VOFM, found that they are status check for the copy control, not the split control.
Could you please give me a example?
In the copy control--header--conditions----order requirement ( or combination requirement )
They are like this :
(001)
bp_subrc = 0.
Check that reference document is an order (if not, issue error)
if cvbak-vbtyp cn vbtyp_auft.        "Auftrag?
    perform message_handling in program (programmname)
                                       using cvbap-posnr
                                         '003'
                                         'E'
                                         'VL'
                                         cvbak-vbeln
                                         space
                                         space
                                         space.
    bp_subrc = 1.
    check 1 = 2.
endif.
Check the status of the Fonds-Management
IF CVBUK-FMSTK EQ 'A'.
    PERFORM MESSAGE_HANDLING IN PROGRAM (PROGRAMMNAME)
                                       USING CVBAP-POSNR
                                         '889'
                                         'E'
                                         'VL'
                                         CVBAK-VBELN
                                         SPACE
                                         SPACE
                                         SPACE.
    BP_SUBRC = 1.
    CHECK 1 = 2.
ENDIF.
Check that order is not blocked by the automatic credit check
if cvbuk-cmgst ca 'B' and
     cvbuk-abstk ne 'C'.
Credit check is irrelevant for correction deliveries
    if v50agl-sofauftrag eq charx       and
       tvak-lisof       eq space       and
       likp-lfart       eq tvak-korli.
    else.
      perform message_handling in program (programmname)
                                         using cvbap-posnr
                                           '060'
                                           'E'
                                           'VL'
                                           cvbak-vbeln
                                           space
                                           space
                                           space.
      bp_subrc = 1.
      check 1 = 2.
    endif.
endif.
Check the user status from the order header
if not cvbak-objnr eq space.
    call function 'SD_STATUS_VBAK_CHECK_INTERN'
      exporting
        i_objnr              = cvbak-objnr
        i_vrgng              = vrgng_sddn
      exceptions
        allowed_with_warning = 01
        not_allowed          = 02
        object_not_found     = 03
        others               = 99.
    if sy-subrc ne 0.
Fehler nicht bei MODKZ = '2' (Erlaubt mit Warnung)
      if sy-subrc gt 1.
        bp_subrc = 7.
Else ist nötig, da Routine mit "changing sy-subrc" gerufen wird
      elseif sy-subrc eq 1.
        bp_subrc = 0.
      endif.
Check Global delivery flags
line deleted: "n_911988
        perform message_handling in program (programmname)
                                           using cvbap-posnr
                                                 sy-msgno
                                                 sy-msgty
                                                 sy-msgid
                                                 sy-msgv1
                                                 sy-msgv2
                                                 space
                                                 space.
Bei Fehler: Bedingung verlassen
      check bp_subrc ne 7.
    endif.
endif.

Expire OIM User based on End Date

This is a query on expiring an OIM User based on end date.
Does OIM need any configuration for it to expire the user based upon end date?
The start date seems to work well as expected but the end date doesn't.
Even after the end date has arrived the OIM User is not being expired.He is still able
to login into OIM without any issues.
Thank you

Theres a scheduler task that has to be run to check the date and deactivate the users.

FD32 restrict users based on a schedule of authority

Similar Messages

Maybe you are looking for