How do we restrict the user access for a particular G/L account

Question

Dear Experts,
At our customer site, we follow master / derived role concept for authorisations.
We have a requirement to restrictict user at G/l account authorisation level.
I am aware that every g/l account account has a authorisaition group. But g/l account authorisation is a non-org value for which the present value is * for brgru, we cannot restrict by user/org. At our customer site the authorisations are provided at master role level for a designation and derived role is restricted for a plant, BA etc..
Is there is any user parameter level restriction which can handle this requirement, i mean user parameter for specific g/l account, as we do LIF pid to restrict vendor level access.
Appreciate your suggestions ASAP.
Best regards,
M.Kumaran

Answer 1

Depends.
What are you trying to protect? GL account masterdata (FS00) or FI document creation for specific GL accounts?
Without knowing more about the design principles behind your roles, your release or other restrictions, I would suggest:
(1) grouping off the GL accounts you want to protect in authorization groups (maintained via FS00);
(2) deactivating either object F_BKPF_BES (if your trying to restrict FI document creation) or object F_SKA1_BES (if your trying to restrict access to GL account masterdata) or both in master/derived role;
(3) create several separate roles that would contain only the aforementioned objects with access to specific GL account groups;
(4) assign the roles from step 3 to users as required.
Hope this helps.