How to Set this roles-Authorisations

Question

HI,
I am creating a Role (folder) in which i can publish BW reports
Role-PGS BW Reports
In PGS role i creating 6 folders so that i can group reports accrodingly
PGS Reports
Finance Reports
COmplaints Reports
SLA Reports
Trading Reports
Etc
My requirment is for finance users it needs to be displayed as
PGS Reports
Finance Reports
For Complaint Users
PGS Reports
Complaints Reports
For Finnance & Complaints users
PGS Reports
Finance Reports
Complaints Reports
How can i achieve it
Thanks

Answer 1

Hi,
Maintain authorization to users finance and finance authorization...u can achive it by maintaining authorization to users...it can be achieved as...
Try to use the following approach:
You only come to a certain point by step (1) "analyzing documentation". After that you should (2) "try" your result and maybe (3) "analyse the authorization trace".
Steps (2) and (3) could also be done the other way around or in parallel.
Step (1) Analyse Documentation (simplified of course):
For S_USER_... objects this is how far I would get:
S_USER_AGR is used to manage access to roles.
S_USER_PRO is used to manage access to profiles.
S_USER_AUT is used to manage access to authorizations.
S_USER_GRP is used to manage access to users.
On top of this you will need to allow access to some transactions (SU01, SU10, PFCG) via object S_TCODE, but don't assume that this stops people from doing things you don't expect: Always use te other objects as well to stay in control.
Based on this I would build an initial set of authorizations for maintaining roles:
transaction PFCG
object S_USER_AGR with all activities except 22 (at least 01,02,03, 64)
object S_USER_PRO with all activities except 22
object S_USER_AUT with all activities except 22.
This setup should allow the user to maintain roles and to generate them (i.e. to create profiles and authorizations based on the role definition).
Step 2) Try:
Then perform some activities using this initial setup and see whether additional authorizations are necessary (use SU53 when you run into a limitation).
Step 3) Analyse Authorization trace:
If that works, switch on the authorization trace (ST01) and analyse its contents to get further confidence about the authorization checks.
One last hint on S_USER_AGR: If you later use the same approach to create authorizations for "assign roles to a user", you will notice that not just activity 22 (assign), but also activity 02 (change) is necessary. This seems to be due to SAPs philosophy that a role definition includes the list of users the role is assigned to - so every assignment of a role is also a change to the role. This is highly impractical: You don't want users that should just assign roles to other user-ids have change rights on the role.
Check SAPs OSS 312682 for a hint on table PRGN_CUST: Via this table you can change this unwanted behavior. If you add a line in table PRGN_CUST as described in the note, activity 22 "assign" is sufficient to assign roles (as it is with profiles).
This simplified line of thought of mine will probably trigger lots of other comments that hopefully will help you as well ...
Please also check Note 312682 - Checks when assigning users to roles
[http://help.sap.com/saphelp_nw70/helpdata/EN/43/2232580bb93fece10000000a11466f/frameset.htm]
With kind regards,
NR