Hierarchies in Authorisation

Hi Experts,
The guys who are in thiead are very help and I appriciate that.
Can any body tell me how to set up the Authorisation on Heirarchy basis
For Exampl - A user creates the PR then .The created PR needs to be Approved by the Purchase Department head.After Department head approves then it should be approved by the finance Department then only the PR has to be relesae to PO.In this way the PR should have the step by step Authorisation with out having a work flow concept.
Any inputs greatly appriciated..............
Regards,
Sri Devi

Hi,
Similar process for PO.
SPRO -> Material Management -> Purchasing -> Purchae order -> Release Procedure
-> Define Release Procedure.
As well as creating this, you would need to make sure you assign the authorisation profiles correctly. So if you create 4 levels of release process, then the user roles need to match this so only the correct user has access to release.
Your basis guy can help, but in summary the following auth objects can be help. Use SUIM to analyse.
Purchasing Group = M_BEST_EKG
Purch Org in PO = M_BEST_EKO
Plant in PO = M_BEST_WRK
Release Code and Group = M_EINK_FRG (most important one).
Thanks.

Similar Messages

Hierarchies on master data

Hi BW Experts,
i have to create the hierarchies for master data for some info objects, are hierarchies done only on master data or any other and how to do it .pls guide me on this.
any one send the hierarchies and authorisations ,how they are done in reports .
send me some documents on it, (as i have never done authorisations) . i would be very thankful if you would send me any of the screen shots to [email protected]
sherwin

Hi ,
are hierarchies done only on master data
yes
hierarchy authorization
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/b849e690-0201-0010-9b88-c00cca40736f
creating hierarchy
http://help.sap.com/saphelp_nw04/helpdata/en/80/1a6736e07211d2acb80000e829fbfe/content.htm
cheers,
Swapna.G

BW Authorizations Hierarchies

Greetings All;
This is yet another question regarding BW Authorizations.
I have two fields 0COMPANY and 0PROFIT_CTR, both Authorization Relevant, both containing hierarchies.
I need to allow a user to see all profit centers for a given company <u>and</u> also selected profit centers for another company ...
example - All profit centers for company A and
Profit Center 1 for company B
... this must be an AND condition.
I've been through RSSM and PFCG but can't get it right.
I created an authorization object with ...
1KYFNM, 0COMPANY, 0PROFIT_CTR, 0TCTAUTHH
... and tried specifying a role with ...
Key figure = *
Company = ' '
Profit Center = *
Unique ID for Authorization = Y_COMPANY_A
... and ...
Key figure = *
Company = 'B'
Profit Center = *
Unique ID for Authorization = Y_COMPANY_B
... this shows me everything for both companies. As soon as I add ...
Profit Center = '1'
... to the second grouping I get an authorization failure.
It's possible I haven't specified the Authorization Definitions Y_COMPANY_A and Y_COMPANY_B (in RSSM) correctly, but I've followed all the documents I've found in SAP HELP and SDN.
Is it an issue with both the fields having hierarchies?
Any, and I do mean any, help would be greatly appreciated.
Regards
Jim

Hi Jim,
If you replace '' with '1' in the second authorization, the variable (auth-based) is filled with '' from the first auth and with '1' from the second auth --> result is still no restriction in the ProfitCenter-Variable ('' and '1' = ''). Try to filter the query with company 'B' - do you see know a result? (At the moment your CompCode-Variable is filled with CompCode 'A' and 'B' but you don't have authorisation for all ProfitCenters combined with Company 'B').
I hope, this will help you.
Best regards,
Thorsten

Multiple hierarchies for 0ORGUNIT ?

We currently extract the hierarchy ORGEH from SAP R/3 (HR). A new organizational structure is now being created in R/3 which needs to be extracted in to BW (v3.5). However, with the mixture of users we have, some still want to use the old structure while others want to use the new structure. This poses a few questions:
1) Can you have more than one hierarchy associated with 0ORGUNIT? I assume you can.
2) For any reports that use the old hierarchy but now need the new hierarchy, is it a case of changing the hierarchy in the query or is it more complicated than that?
3) For some existing reports, there is a requirement to report historical data but this would mean using both hierarchies. Is this possible and if so how?
4) Could the change in hierarchy structure mean changes are required to roles & authorisations? How can we identify if changes are needed or not?
Any advice will be welcome.

You can't have both hierarchies of a single infoobject displayed on a non structured report at the same time (i.e. in cases where you aren't using a structure and just drilling in 0ORGUNIT).
You can however, setup a variable so that as part of the report parameters, the user selects the hierarchy for viewing meaning they can view the data in the old hierarchy and then click refresh/change variables, select the old hierarchy and compare.
Alternatively, you will need to have a fixed structured report. In such a case, you can have a selection within the report that displays the same KF against each of the hierarchy. In such cases, you are usually only displaying a single node of the hierarchy at a time which is less flexible.
e.g.
HIER1 OTHER CHARS KF1
HIER2 OTHER CHARS KF1

BW / HR Authorisations errors

We have managed to implement structural authorisations in BW however we are still getting authorisation errors. When running the query using RSRT in the back end, we can see the correct employees and org units are being passed to the query from the ODS 0PA_DS02(values).
A couple of points which could explain the problem.
1. When I generate the authorisation object in RSSM the following errors can be seen.
InfoObject/field 0AP_CRIT does not exist in the system
InfoObject/field 0AP_SCHEME does not exist in the system
2. When running the query the folllowing errors are displayed.
No authority for the node from characteristic 0ORGUNIT, hierarchy ORGEH (
WYou do not have authorization to read object ZBW_HR_SA 'BW HR Structural
Do the users need to have the auth object within a role within their user ID? And is so what values should it have?
regards,
Sanjay

Guys,
Just to let you know we managed to get it working, and the main problems were due to validity dates not filled in the ODS's for Values and Hierarchies. Second issue was we needed to create 2 auth objects one for Org unit and Org Hierarchy and the 2nd for Position and Employee. We are now able to switch between org hierarchy view and flat list view, although are still in testing phase to see it this really is working as it should. Thanks for all your help. And good luck.
regards,
Sanjay

Authorisations in BW for different Queries and one InfoObject

Hi,
we have a problem regarding Authorisations in BW.
Some of our users have different rights on different queries e.g. for the Info-Object 0PLANT. For the query ABC he should see data to more plants than for the query XYZ.
Our idea was to build an Authorisation-Object containing 0PLANT, TCTQUERY, TCTIFAREA and TCT ICUBE and to set the authorization for 0PLANT regarding the detailled name of the query (TCTQUERY). But this doesn't work because when starting the query SAP doesn't check the name of the Query. And so the user can always see the sum of plants set in both authorisations.
Maybe someone of you has useful hints.

Hi Andreas,
In your case you need to use hierarchical authorizaton object to provide data restriction on the queries. Thus everyone can have the same query and they view what ever they are supposed to. Please find the how to document called: "How ToWork With Hierarchy Authorizations" You will find detalied information and businees scenario about the topic. Please let me know if I can assist you further
Regards

Values not getting displayed in the selection screen for Hierarchies?

Hi All,
Our system was upgraded from BW 3.1 to 2004s. The quality system displayes values when query result is filtered for a hierarchy infoobject but the production system does not display any values and sometimes throws an error 'The operation failed because of a server error. See system logs.' There is no changes done for hierarchies in both the systems.
Please let me know if anyone has had similar problems.
Thanks,
Krishna

Hi All,
Our system was upgraded from BW 3.1 to 2004s. The quality system displayes values when query result is filtered for a hierarchy infoobject but the production system does not display any values and sometimes throws an error 'The operation failed because of a server error. See system logs.' There is no changes done for hierarchies in both the systems.
Please let me know if anyone has had similar problems.
Thanks,
Krishna

Vendor Open items Authorisation

Hi Peers!
Is there any report were i can authorise the payments to which vendor and which invoice i can pay today like that.
Ex: Say my higher authority wants to select the open items vendor wise to pay the due. so that i will check that invoices and pay through outgoing payment.
Pls reply soon, Its urgent
Thanks
Murali

Hi
There are so many age wise analysis reports are there for analysing the customers or vendors open items. out of those, F.41 for vendor open items there you can find all the relevant data including business area level also satisfied because in some cases higher management wants the particular business area wise required for analysis. similarly f.21 for customers.
I hope it will be suffice your requirement.
Regads
madhav

Report performance with Hierarchies

Hi
How to improve query performance with hierarchies. We have to do lot of navigation's in the query and the volume of data size very big.
Thanks
P G

HI,
chk this:
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/1955ba90-0201-0010-d3aa-8b2a4ef6bbb2
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/ce7fb368-0601-0010-64ba-fadc985a1f94
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/4c0ab590-0201-0010-bd9a-8332d8b4f09c
Query Performance Is "Aggregates" the way out for me?
/people/vikash.agrawal/blog/2006/04/17/query-performance-150-is-aggregates-the-way-out-for-me
° the OLAP cache is architected to store query result sets and to give all users access to those result sets.
If a user executes a query, the result set for that querys request can be stored in the OLAP cache; if that same query (or a derivative) is then executed by another user, the subsequent query request can be filled by accessing the result set already stored in the OLAP cache.
In this way, a query request filled from the OLAP cache is significantly faster than queries that receive their result set from database access
° The indexes that are created in the fact table for each dimension allow you to easily find and select the data
see http://help.sap.com/saphelp_nw04/helpdata/en/80/1a6473e07211d2acb80000e829fbfe/content.htm
° when you load data into the InfoCube, each request has its own request ID, which is included in the fact table in the packet dimension.
This (besides giving the possibility to manage/delete single request) increases the volume of data, and reduces performance in reporting, as the system has to aggregate with the request ID every time you execute a query. Using compressing, you can eliminate these disadvantages, and bring data from different requests together into one single request (request ID 0).
This function is critical, as the compressed data can no longer be deleted from the InfoCube using its request IDs and, logically, you must be absolutely certain that the data loaded into the InfoCube is correct.
see http://help.sap.com/saphelp_nw04/helpdata/en/ca/aa6437e7a4080ee10000009b38f842/content.htm
° by using partitioning you can split up the whole dataset for an InfoCube into several, smaller, physically independent and redundancy-free units. Thanks to this separation, performance is increased when reporting, or also when deleting data from the InfoCube.
see http://help.sap.com/saphelp_nw04/helpdata/en/33/dc2038aa3bcd23e10000009b38f8cf/content.htm
Hope it helps!
tHAK YOU,
dst

BW hierarchies issue with BOBJ Reporting tools

Hi All,
Brief about the requirement:
Our client was using Mainframe and other tools for their reporting. Now as they have planned to go for SAP, purchased SAP BW 7 and SAP BOBJ XI 3.1 for warehouse and reporting purposes.
Initial Road map planned for implementation was
o     to use Crystal for operational and formatted reporting
o     to use WebI for Ad hoc and interactive reporting
o     to use Xcelsius for Dashboards
Once we started analysing the requirements, we observed that client requires hierarchies extensively for reporting and they donu2019t want to compromise in that for reporting. At this situation we have explored the options and came to know from the SAP sites that BO got limitations in case of BW hierarchies. But we not able to articulate the what is the exact issue. Is it with only WebI or Crystal also?
What we have articulated is we cannot report the hierarchies in BO in terms of nodes - > Sub nodes -> sub nodes instead we can do as fixed columns. Please add me if i am missing anything else.
And also please let us know options. Options that we were thinking are Implement with BO XI 3.1 considering Advanced analysis tool then upgrade to BO XI 4.1.
Please suggest us, what is the BW & BO hierarchy issue and right tools to use.
Thanks & Regards,
Bala

Our client uses XI 3.2 but is experiencing issues with Hierarchical BEX queries returning blanks - the mdx is fine - just webi that seems to have a problem and I'm also trying to determine in exactly which instances this occurs.
XI 4.x supposedly resolves mots issues but here again details are not known.
I.e. hopefully someone can point to an info source that describes in more detail what issues are likely to occur re hierarchies and webi.

How can I use one hierarchical table as a node of another hierarchical tabl

I have a requirement where I have two hierarchical tables and one table should work as node for other table . How to achieve this??
To elaborate more the structure is like
Main Table (Company Structure)
Sub table Consolidation Groups which has got hierarchical structure
Sub table Entity which is also hierarchical.
The Entity table should act as a node for table Consolidation Groups
How can I achieve this functionality??
Thanks
Suvarna

you misunderstood me apparently. I said you can't organinze to tables so one serves as a node's value of the other. Let me show you wnat I suggested by an example.
First table has such values:
-A
|-B
|-C
and the second one is
-x
|-y
|-z
-p
|-r
|-s
I thought you wanted to confine relationships between them so fo B node be able to select only x's branch and for C - only p's branch. If it's similar to the truth then let's create another table with two fields. Field one points to table containing capital letters and field two - lower case letters. Both fields are of type lookup pointing to an hierachial tables. Now when you populate this table you'll create records like (I list two columns):
B - y
B - z
C - r
C - s
from your orinal table from now you should point to the above table. So instead of having two fields each pointing to its own table and compeling you to think how to organize two hierarchies, now you have only one field pointing to a table with all valid combinations. When you populate this table though YOU have to decide what such combinations are. It may make sense (if you have different users) to restrict access to this table on read-only level for regular users to preserve the valid combinations.
Hope it helps but if I understood your wrong give a concrete example.

Is there a way of finding out what has been accessed on my MacBook Pro whilst in the possession of an apple authorised service centre?

Hi Guys,
I'm a bit new to this discussion group thing although I've been using Macintosh computers for many years (showing my age).
I handed my MacBook Pro to be repaired at an authorised apple service centre. When I handed it in they said they needed to keep hold of it to run some diagnostics and requested my password. I've owned various models of mac for the the past 17 years and this is the first hardware problem I have encountered, hence I have never bothered to set up user accounts.
As I live in quite a remote part of Sweden I am paranoid that some untrusted technician is going to make a copy of my music (11,000 tracks) or share some of my personal information (scanned copies of my birth certificate, passport, certificates, photos, etc.) on the web. Is there a way of finding out what activity has taken place whilst they've had it in their possession?
I appreciate any advice you guys can offer.
Thanks!
PS: I've already thought about the 'recently opened' menu and The machine in question is a MacBook Pro 17" (2011) running OS X 10.6.8 (need Rosetta).

I am paranoid that some untrusted technician is going to make a copy of my music (11,000 tracks) or share some of my personal information (scanned copies of my birth certificate, passport, certificates, photos, etc.) on the web.
If you put your info into the computer and hand it to another, you have to assume they will copy everything.
Why are you putting scanned copies of valuable identity information into a computer than can be hacked, stolen, lost or compromised by a dirty tech?
Have you lost your mind?
Is there a way of finding out what activity has taken place whilst they've had it in their possession?
No. The tech would just deny it if he did, or tell the truth which the answer would be "NO" in either case.
The employer won't ask that sort of questions without solid proof, less they make a enemy of the employee and/or risk being sued for defamation of character.
It's not like they bother to have a team of people watching over his shoulder that he doesn't stick a USB thumb drive of your data into his pocket to take home.
I am paranoid that some untrusted technician is going to make a copy of my music (11,000 tracks)
If it's iTunes music, it has your personal ID embedded into the song files. Most IT techs know this though.
I appreciate any advice you guys can offer.
Too late now, all you can do is not worry about it.
Take your personal info out of the machine and if you need it, burn cd/dvd copies, a few USB thumb drives, Iron Keys or self encrypting external storage drives with key and/or keypad.

Error in SRM: a user with enough authorisation level is miss

Hello,
We are on SRM 5.0 and our users get the following error in SRM when creating a shopping cart:
No user assigned to object a user with enough authorisation level is missing.
Anybody any idea ?
Thanks as ever

Hello Can anybody helpe me please ?

I have rented a movie on apple tv and wish to finish it on my mac book air. When I open iTunes on my mac book air I can not see the movie in iTunes. It is an authorised device and I can see other purchases just. How do I fix it?

I have rented a movie on apple tv and wish to finish it on my mac book air. When I open iTunes on my mac book air I can not see the movie in iTunes. It is an authorised device and I can see other purchases just. How do I fix it?

Rented movies downloaded to an Apple TV can't be transferred to any other device.
(86941)

HR Authorisation Management for different companies in the same client

Hi,
Could anyone please help in this....
My client has two companies. They want to restrict the authorisation to both the companies so that no one can see each other companies data and at the same time access tha data.
For Eg, there are two payroll officers, each in both the companies, If i give authorisation to run Payroll driver(PC00_M40_CALC), anyone of them can run payroll for any of the companies. (though,their Payroll area is different). There are many restrictions to be maintained like Maintance of Master data, Maintanance of OM structure as assignement of position, running Payroll, viewing the payslip etc...
How can this all be restricted so that, the respective companies can view and access their own data without interfering in to the other company.
I could only find object P_PYEVRUN which helps me restrict to view the created documents of posting for other company code.
Can anyone put light on how i should proceed further... I heard we can restrict HR master data, but what all i know is we can restrict at infotype level. My problem is, two persons should access PA30(each from different companies), but should not be able to edit other companies data.
Thanks
--Pranitha

Hi ,
If you are creating the another company undar the same client . then you can not use different no. range.
or if you are going different client for different compnay code then you can use different number range for material master.
SAM

Hierarchies in Authorisation

Similar Messages

Maybe you are looking for