How to provide a same user SU01  for admin and display authority on PFCG

Hello Security Experts,
I am working on a requirement where I have to create a role for user administrator with Display access in PFCG but user should be able to use SU01 to do user administration meaning create , change user ( including role assignments) , delete , lock/unlock user.
First I have maintained S_USER_AGR as ACTVT 03,08,22  / S_USER_AUT as ACTVT 03,08,22 / S_USER_GRP as ACTVT 01, 02, 03, 05, 06, 08, 22, 78 / S_USER_PRO as ACTVT 03, 08, 22.
Disabled Objects S_USER_VAL and S_USER_TCD.
While testing the role I got authorization error where my SU53 and trace pointing at missing value in S_USER_AGR as ACTVT 02.
After assigning S_USER_AGR as ACTVT 02 the role assignment is allowed in SU01 however the role change is also enabled from PFCG where my test user is able to get in to the role in edit mode (however he cant do any changes in role or generate the role as I have disabled S_USER_VAL and did not provide 02 on S_USER_PRO ) and save the role.  This should not happen as per requirement.
How can I restrict PFCG to display and allow user to assign roles to end users ? Kindly suggest and help.
Thanks in advance for your help.
Regards
Murali

Hi
Run pfcg and try to go to change with your restricted settings then click on the error message to get the table entries in performance assistant. Put those in prgn_cust via sm30.
Then use 22 instead of 02 in newly called object S_USER_SAS.
Make sure you have at least one user with * in that object for full access across the landscape before transporting the table.
Cheers
David
Edited by: David Berry on Oct 23, 2010 10:25 AM
Edited by: David Berry on Oct 23, 2010 10:26 AM
Forgot to say - when you have the new object value 22 in your restricted role and assigned to test user prior to moving to PROD the only way to go into change mode is to first go to the USER tab and then press change. Anywhere else and you'll still get the 'you are not authorised' message.
Edited by: David Berry on Oct 25, 2010 8:04 PM

Similar Messages

  • How to provide an exchange user permission for Mailbox Archieve ??

    i want to grant a IT guy access to archive mailboxes. How to provide an exchange user permission for Mailbox Archive ??.
    Regards, h9ck3r.

    Hi,
    Per my known, if you want to access other user's personal archive mailbox, you need to assign full access permissions to primary mailbox first.
    There is no way to grant full access permissions to archive mailbox only.
    Best regards,
    Belinda Ma
    TechNet Community Support

  • How to use the same POWL query for multiple users

    Hello,
    I have defined a POWL query which executes properly. But if I map the same POWL query to 2 portal users and the 2 portal users try to access the same page simultaneously then it gives an error message to one of the users that
    "Query 'ABC' is already open in another session."
    where 'ABC' is the query name.
    Can you please tell me how to use the same POWL query for multiple users ?
    A fast reply would be highly appreciated.
    Thanks and Regards,
    Sandhya

    Batch processing usually involves using actions you have recorded.  In Action you can insert Path that can be used during processing documents.  Path have some size so you may want to only process document that have the same size.  Look in the Actions Palette fly-out menu for insert path.  It inserts|records the current document work path into the action being worked on and when the action is played it inserts the path into the document as the current work path..

  • Find My Phone - can I use same user + password for 2 phones?

    Just loaded the "Find My Phone" App on my new iPhone 4 and set it up. What a great tool for locating a lost iPhone. The only problem is that my wife and I have a joint mail and apple ID account.
    So, my question is can I use Same user name (mail account) and password for TWO iPhone 4's (mine and wifes)? I assume that would work since each phone has a different serial number, and it seems to be ok when connected to my computer to sync each phone separately.
    Any help would be appreciated, thanks.

    My phone was stolen a few days ago. It must be flat by now, I have had it locked by my service provider, Find my Phone still works but says it's in Sydney, I live in Melbourne. Is this accurate? How can it still find the phone if it's not on?

  • How to use the same services-config for the local and remote servers.

    My flex project works fine using the below but when I upload my flash file to the server I doesn't work, all the relative paths and files are the same execpt the remote one is a linux server.
    <?xml version="1.0" encoding="UTF-8"?>
    <services-config>
        <services>
            <service id="amfphp-flashremoting-service"
                class="flex.messaging.services.RemotingService"
                messageTypes="flex.messaging.messages.RemotingMessage">
                <destination id="amfphp">
                    <channels>
                        <channel ref="my-amfphp"/>
                    </channels>
                    <properties>
                        <source>*</source>
                    </properties>
                </destination>
            </service>
        </services>
        <channels>
        <channel-definition id="my-amfphp" class="mx.messaging.channels.AMFChannel">
            <endpoint uri="http://localhost/domainn.org/amfphp/gateway.php" class="flex.messaging.endpoints.AMFEndpoint"/>
        </channel-definition>
        </channels>
    </services-config>
    I think the problem  is the line
            <endpoint uri="http://localhost/domainn.org/amfphp/gateway.php" class="flex.messaging.endpoints.AMFEndpoint"/>
    but I'm not sure how to use the same services-config for the local and remote servers.

    paul.williams wrote:
    You are confusing "served from a web-server" with "compiled on a web-server". Served from a web-server means you are downloading a file from the web-server, it does not necessarily mean that the files has been generated / compiled on the server.
    The server.name and server.port tokens are replaced at runtime (ie. on the client when the swf has been downloaded and is running) not compile time (ie. while mxmlc / ant / wet-tier compiler is running). You do not need to compile on the server to take advantage of this.
    Hi Paul,
    In Flex, there is feature that lets developer to put all service-config.xml file configuration information into swf file. with
    -services=path/to/services-config.xml
    IF
    services-config.xml
    have tokens in it and user have not specified additional
    -context-root
    and this swf file is not served from web-app-server (like tomcat for example) than it will not work,
    Flash player have no possible way to replace token values of service-config.xml file durring runtime if that service-config.xml file have been baked into swf file during compilation,
    for example during development you can launch your swf file from your browser with file// protocol and still be able to access blazeDS services if
    -services=path/to/services-config.xml
    have been specified durring compilation.
    I dont know any better way to exmplain this, but in summary there is two places that you can tell swf  about service confogiration,
    1) pass -services=path/to/services-config.xml  parameter to compiler this way you tell swf file up front about all that good stuff,
    or 2) you put that file on the webserver( in this case, yes you should have replacement tokens in that file) and they will be repaced at runtime .

  • How can i obtain a user guide for the ipod nano 16GB 5th gen. with out printing it off the computor

    How can i obtain a user guide for the ipod nano 16GB 5th gen. without printing it off the computor.

    You can't, at least not the one provided by Apple.
    B-rock

  • I have set up two users, one for myself and one for children.  The computer automatically logs in for the children with no password required.  When the children go to spotlight and type in a search criteria all of my files show up.  How do I prevent this?

    I have set up two users, one for myself and one for children.  The computer automatically logs in for the children with no password required.  When the children go to spotlight and type in a search criteria all of my files show and open up.  How do I prevent this?

    Log in to your account, and move all your files to your home folder. No other users should be able to access them there and they won't show up with a Spotlight search.
    Make sure your kids' account(s) do not have admin privileges.

  • How to use the same email address for outgoing email on two iPads?

    How to use the same email address for outgoing email on two iPads?.   My wife and I both use the same email address.  We receive the same incoming email on both iPads but are unable to send email from my wife's iPad.  She is using an iPad 2 and is usng IOS 6.0.1

    Hi Creaturekeeper,
    If you've added the account into the iPad and you are unable to send email from it, then please follow the troubleshooting in the article below.
    Get help with Mail on iPhone, iPad, and iPod touch - Apple Support
    Take care,
    Alex H.

  • How to find the exact user exit for our requirement?

    Dear Mr. keerthi,
    can you please explain me how to find the exact user exit for our requirement?

    Hi sandip
    There is more than one method in which you can check for user-exits.The following method is used very often.
    <b>How to find the exact user-exit for your requirement.</b>
    1.     You can check the user exists using transaction SE85.
    2.     Repository Information System -> Enhancements -> Customer exits
    3.     You can search the user-exits by package name.
    4.     Double click on each exit name to check the function module exits.
    <b>The procedure to find the package name.</b>
    Execute transaction SE93 
    Enter the tcode of the transaction for which you want to check the user exit.
    Example: if you want to find the user-exit for purchase orders while changing, enter ME22n  and press display.
    You will get to see the package name
    But you need to confirm that the user exit will get triggered at the appropriate event.
    ( example: you might want some validations to be done ON SAVE of a purchase order)
    <b>Checking if the user-exit is getting triggered or not.</b>
    1.     Open the user exit function module (that you have got in step 4) in Tcode SE37.
    2.     Click on where used button. In the pop up that immediately appears choose only programs .
    3.     You will get a list of programs. Double click on the program name.
    4.     You will get the list of location where this function module user exit is used.
    5.     Place session break points at each of these location ( at each CALL FUNCTION statement)
    6.     Now go to your transaction ( say change purchase order tcode:Me22n) and check if the user exit is getting triggered on appropriate event.
    regards,
    Prasad

  • How to find the appropriate user exit for invoic02 idoc in idoc_output_invo

    Hi all,
    I am new to this community p
    i have issue regarding  the How to find the appropriate user exit for invoic02 idoc in idoc_output_invoic function module.........
    thanks,

    Hi ,
    welcome to SDN.
    You can select the appropriate Customer exit accrding to the available parameters .
    The list of exits available are 
    EXIT_SAPLVEDF_001
    EXIT_SAPLVEDF_002
    EXIT_SAPLVEDF_003
    EXIT_SAPLVEDF_004
    For Example , if you want  to modify the Idoc data(EDIDD) you have to use the EXIT_SAPLVEDF_002. accodingly you can select the user exit according to the avaialable parametres.Use Table MODSAP fto get the Enhancement name.
    Hope this Helps
    Rgds
    Sree
    Edited by: Sree on Jul 23, 2010 12:11 PM

  • How do i download a user guide for a samsung lll ?

    How do I download a user guide for my samsung lll ?

    ^That's a Samsung Intensity user guide. This is a Galaxy S III forum.
    Here's the link for the SIII user guide from Samsung. A quick google search found it. http://downloadcenter.samsung.com/content/UM/201207/20120706131108550/VZW_SCH-i535_English_User_Manual_LG1_F5.pdf

  • How do I find a user quide for pages on my iPad

    How do I find a user quite for pages on my iPad?

    http://help.apple.com/pages/ipad/1.6.1/

  • How can I get a user manual for my inherited Blackberry ...

    How can I get a user manual for my inherited Blackberry Curve 8330?

    Hi and Welcome to the Forums!
    Here is a link to the manuals:
    http://na.blackberry.com/eng/support/docs/subcategories/?userType=1&category=BlackBerry+Smartphones&...
    Cheers!
    Occam's Razor nearly always applies when troubleshooting technology issues!
    If anyone has been helpful to you, please show your appreciation by clicking the button inside of their post. Please click here and read, along with the threads to which it links, for helpful information to guide you as you proceed. I always recommend that you treat your BlackBerry like any other computing device, including using a regular backup schedule...click here for an article with instructions.
    Join our BBM Channels
    BSCF General Channel
    PIN: C0001B7B4   Display/Scan Bar Code
    Knowledge Base Updates
    PIN: C0005A9AA   Display/Scan Bar Code

  • How can I get a "user guide" for Elements 8?

    How can I get a "user guide" for Elements 8?

    See here (scroll down.):
    http://muvipix.com/products.php?subcat_id=44http://muvipix.com/products.php?subcat_id=44http://muvipix.com/products.php?subcat_id=44
    and here (Scroll to the bottom of page 2):
    http://www.amazon.com/s/ref=sr_pg_2?rh=n%3A283155%2Cn%3A%211000%2Cn%3A5%2Cp_27%3ASteve+Gri setti&page=2&ie=UTF8&qid=1370352322

  • How do I change the User Agent for Safari on my iPad?  I need this for a specific website for work.

    How do I change the user agent for Safari on my iPad?  I know how to do it on my desktop version, but I need it for my iPad.

    You can rename the iPad here:
    Settings - General - About - Name
    For Siri make sure he has himself as a contact in the Contacts app then:
    Settings - General - Siri - My Info and select his contact info

Maybe you are looking for