HR-Structural Authorization-AUTSW ORGPD switch

Hi All,
We are facing an issue with our structural authorization.
Our HR user are unable to view details of the employee who is been terminated in PA20.
Background:
1)The user is terminated on 10/2009
2)when the user was terminated he was assigned to the org unit 10.
3)Later the org unit 10 also got inactive.like it is not in the org structure anymore this is from 02/2010.
4)From 02/2010 on HR users are unable to view the employee details (who is terminated and belongs to an inactive org structure) in PA20
Analysis:
1) When we see in the OOSB Information the HR user is not having authorization to view this org unit from the time it is moved out of org structure.I.e 02/2010.The endda is showing 02/2010 against the org unit in structural access of the Hr user.
2)Other observation is that after HR users give PA20 we have taken su53 and it shows taht P_ORGINCON missing authorization for D,infotype 0000,subtype termination.
3)we have done testing in Dev by changing AUTSW-ORGPD switch to 3 still no use.
4)We did AUTSW-DFCON to 3 as we ahve context authorization also it also did not work.With DFCON 4 it is working but HR users are able to view not only their counry employee but also other country employees org assignmnet in PA20 which not acceptable.
Requirement:
HR users should be able to view terminated employees with org assignment(IT 0001) but that org unit is not in validity date(i.e A 002 for org unit is delimited) .
Any suggestions or ideas to handle the terminated employees in the delimited orgunit will be of great help...
Regards,
Vani.

Hi,
We are using DFCON = 4 and it is working for us. Try this way. If the user terminate then fill the Org Key in IT0001 with some Value YYY and then use this value in P_ORGINCON Filed Value VDSK1 = YYY and also PA restriction.
Or Write a FM to get the terminate pernr to users structure and use the Context it may work.

Similar Messages

Structural Authorization: Difference Between AUTSW-DFCON and AUTSW-ORGPD?

Dear All,
Can anyone explain to me the difference between AUTSW-DFCON and AUTSW-ORGPD in tbale T77S0?
And what is the relationship between these two switches?
Thanks!!

HI Mr. potato,
working off dilek's informative post you may be considering ? context vs non-context?
this image explains how context problems arise in HCM. http://help.sap.com/saphelp_470/helpdata/en/b3/bfb83b5b831f3be10000000a114084/content.htm
I would say generally, when an organization decides to use structural authorizations, they also need to take into account a "context solution". This is most frequently used to "lockdown" how different parts of the HR organization has different authority access to different groups of employees (potentially overlapping). As an HR manager i might have full read access on IT0002 for the entire company (root org), but IT0008 view access only for a sub-org unit.
in this case you need to use the DFCON switch. the 'most restrictive setting for dfcon is value 2. the most iberal setting is, 4. Generally, you need to test all 4 to figure out what works for you.
settings for dfcon:
http://help.sap.com/saphelp_470/helpdata/en/56/db5bc71a64c94f9f2e3cb63e14c867/content.htm

Structure Authorization Issue

Hi guys,
I don't have structure authorization implemented or HR system implemented. I was playing with my sandbox system to learn structure authorization by using step by step tutorial. After I created a structure authorization for two users I deleted everything related to structure authorization but unfortunately, some t-codes related to org chart for example PPOME, PPOMW are not working properly, its not allowing to create new org char.
We have another team needs to create some org chart for prototyping but they can't create org chart its giving no authorization error when I ran SU53 it's not giving regular auth error its also give failed HR structure authorization error, this is the error in su53 coming (Date 10/01/2010 and time Plan version 01 Object ID 5000075 Action LISD) there are so many different object ID on the list.
They all already have SAP_ALL in the system. Can anybody give some kind of report so I remove structure authorization completely from the system.
Please help
Thanks

Structural Authorization Check
Structural authorizations are used to grant access to view information for personnel where HR OM has been implemented as we stated. The Access is granted to a user implicitly by the useru2019s position on the organizational plan.
On top of the general authorization check, which is based on authorization objects, you can define additional authorizations by hierarchical structures.
In each area, the combination of start object and [Evaluation Path|http://help.sap.com/saphelp_erp60_sp/helpdata/en/35/26c256afab52b9e10000009b38f974/content.htm] from an existing structure returns a specific number of objects. This exact combination, in other words the number of objects returned by this combination, represents a useru2019s [Structural profile|http://help.sap.com/saphelp_erp60_sp/helpdata/en/0c/49ba3b3bf00152e10000000a114084/content.htm]. So structural authorization check is therefore based on a Dynamic concept: The concrete objects that are returned by a structural profile change as the structure (under the start object) changes.
Steps to Perform to Set Up Structural Authorization Check in brief:
(Before start moving for str. auth profile it is assumed that the Switch AUTSW for HR General Authorization check is also activated in table T77S0. Structural Authorization won't give the access for accessing HR data as described in the last posts and works together with General Authorization - to remind you)
1. Integration: Control parameters for the integration of Personnel Planning and Development (PD) with other applications (such as Personnel Administration (PA) and Cost Accounting (CO), etc.) are specified in the "PLOGI" group.
2. Turn on PD PA switch: TCode used is OOPS. Ensure value registered for PLOGI u2013 ORGA is X. No other values need to be checked or changed.
(Note: PD and PA sub modules of HR are not configured to share data by default in the SAP delivered system. This switch must be on for data to flow between both modules.)
3. Turn on Structural Authorizations Main Switches : TCode is OOAC. Value for ORGPD is set to 1.
4. Create Org. Plan (check the first post).
(Note: Do not create your Organizational Plan without this switch on. If you do, structural authorizations will not work and some org and infotype setup will not work. You cannot turn the switch on and get structural authorizations on an organizational plan, that was created while it was off, to work..)
5. Create Personnel Master Record: Tcode is PA40. This is time consuming staff.
6. Create record for Infotype 0105 - TCode is PA30.
7. Create Structural Authorization Profiles u2013 TCode = OOSP
8. Create entry for IT 1017 - TCode is PO10 (Organizational Unit) or PO13 (Position).
9. Assignment of Structural Authorizations: The assignment of the Structural Authorization can be found with good details here in [SAP Help|http://help.sap.com/saphelp_erp60_sp/helpdata/en/97/27973b3ea3eb0fe10000000a114084/frameset.htm].
Please check and let us know for any query.
Regards,
Dipanjan

Error Occured when Applying Structural Authorizations in E-Recruitment

Dear Experts,
The E-Recruitment functionalities were working fine when no structural authorizations are applied. However, when structural authorizations are configured for the user on the backend SAP system (I configured structural authorizations for the user to have access to only his own department), the E-Recruitment module does not work.
When I tried to access requisitions-> maintenace, application management->applications, etc, (i.e. when the E-Recruitment module tries to retrieve data from the backend), the the following error message occurred.
Error when processing your request
What has happened?
The URL http://<hostname>:<port>/sap/bc/bsp/sap/hrrcf_start_int/application.do was not called due to an error.
Note
The following error text was processed in the system ABC : RAISE EVENT statement nested to deep. The error occurred on the application server XYZ and in the work process 0 .
The termination type was: RABAX_STATE
The ABAP call stack was:
Method: ON_CHANGE of program CL_HRRCF_INFOTYPE=============CP
Method: INSERT_RECORD of program CL_HRRCF_INFOTYPE=============CP
Method: READ_RECORDS of program CL_HRRCF_REQUISITION_INFO=====CP
Method: GET_RECORDS of program CL_HRRCF_INFOTYPE=============CP
Method: GET_RECORDS_BY_DATE of program CL_HRRCF_INFOTYPE=============CP
Method: ON_REQUISITION_UPDATE of program CL_HRRCF_REQUI_BL=============CP
Method: ON_CHANGE of program CL_HRRCF_INFOTYPE=============CP
Method: INSERT_RECORD of program CL_HRRCF_INFOTYPE=============CP
Method: READ_RECORDS of program CL_HRRCF_REQUISITION_INFO=====CP
Method: GET_RECORDS of program CL_HRRCF_INFOTYPE=============CP
Please advice if E-Recruitment supports structural authorizations. If it does, are there additional configuration required to enable structural authorization. Kindly enlighten me on how to resolve this error. Any help will be much appreciated.

Hello Louis,
I implemented e-recruiting with structural authorizations for a customer and encountered exactly the same error. Anything in the e-recruiting implementation leads to this problem. When you miss some object authorizations the implementation generates an infinite callstack which results in this short dump.
So be sure you assigned all necessary objects to recruiters and also candidates (NA, NB, NC, ND, NE, NF, BP, CP, P, Q, QK, VA, VB, VC) but this might be difficult esp. with the P object, when you use structural authorizations for other purposes, too. This usually generates problems in manager involvement (e.g. manager can't choose a recruiter to approve his requisition as he has not the structural authorization for the hr department members).
It is also a bit strange that candidates need for example change rights for the requisition (NB) although they won't actually change it but without it the relation application->requisition, candidacy->requsition cannot be created correctly.
Last but not least be always sure that you refreshed the authorization buffers after changing structural authorizations. They are usually switched on for better performance.
Best regards
Roman Weise
PS: be aware that using structural authorizations will keep you busy for some time. we needed ~2 months to set up the system in a way that e-recruiting worked as the custoimer wanted without interfering any other productive hr component (admin, org. mgmnt., managers desktop).

Support of structural authorizations in IdM?

I am currently working on an IdM implementation where structural authorizations are handled individually on the various backend systems. Would it be possible to implement a mechanism that would allow IdM to distribute privileges that in the backend system essentiall would translate into entries in the T77UA table? If not, would it be possible to make IdM call a customer RFC in the backend system?
Best regards,
Anders

Hello again, I can see now that it is evident that I am a little confused about structural authorizations in general
With our version of structural authorizations I meant that we have implemented a BADI to create a customer specific check of structural authorizations. In fact our implementation is not using the authorizations main switch table in HR as the requirement is to use structural authorizations in some areas of HR and not in other areas. When I wrote that we do not use position based security that is of course not true. What I meant to say, was that we do not use indirect role assignment, which I had confused with the position based assignement of structural authorization profiles. Sorry, about that....
It is probably our customer specific implementation that is causing the problems we are experiencing, so I will look more into that. Thank you for your explanations.
Best regards,
Anders

Talent Management (EhP4) - cannot find structural authorization profiles

Hi All, 
I have looked in 3 different SAP ECC6.0 EhP4 system for the Talent Management structural authorization profiles stated in the IMG documentation and on the help.sap.com website. The profiles are: 
TMS_PROFILE 
TMS_ALL 
TMS_MAN_PROF 
There are also several "sub" profiles for TMS_PROFILE. 
To take an example from help.sap.com on their Authorizations page (http://help.sap.com/erp2005_ehp_04/helpdata/en/7b/6f92413c3a2e7be10000000a1550b0/content.htm ), the SAP_TMC_SUPER_TALENT_MANA_SPEC clearly indicates the TMS_ALL structural authorization profile is in the standard system: 
Authorizations for talent management superusers 
For more information, see Talent Management Superuser. 
The structural authorization profile TMS_ALL is also available as a template for the Talent Management Superuser. 
For more information, see Customizing for Talent Management and Talent Development under Basic Settings ® Authorizations in Talent Management ® Define Structural Authorizations. 
So... does anybody know anything about these and where I can find them? Do they require some form of activation outside of the standard switch activations for Talent Management? I've looked in several tcodes (SU01,PCFG, OOSP etc) for them but no luck. 
Any help gratefully received and points will be awarded for helpful answers and solutions! 
Best regards, 
Luke

Hey Luke:
Could you do me a favor and look in client 000 (the SAP delivered client)? You generally need a basis person for this activity, and I can't find one now on my own end to confirm my theory. However I'm pretty sure if you went to OOSP in client 000, you'd see those profiles. They were either never copied over from 000 or your security friends deleted all the profiles that are SAP delivered in the clients you're looking at.
I could talk for a super boring amount of time about the security concept of "SAP delivers too much access with their roles so we don't use them" that a good number of security teams use - but that's a story for a different day.
Take a peek in 000 and let me know what you see. If they're there, you can always have your basis chums copy them over to your clients that you want them in (presumably your security config client).
Thanks,
Chris

Structural Authorization in e-recruiting

Hello all
We are implementing e-recruiting 603 ehp4 in standalone scenario. By customer requirements, the "recruiter" role was assigned to all manager therefore the standard service "Create requisition request" from MSS is not in use. So structural authorization we need for the manager to create requisition for his position only.
So, someone know how to perform this or tell me how to complete the table T77PR -the function module, evaluation path, object type and so on-
As always, thank you a lot
Regards
E. Ciotta

Hello Emilio,
Structural authorization in e-recuitng are a mess (although I have not found any official documentation which states "It won't work" and solution management says that there is no restriction sap support answers on customer request for that topic that it is not supported).
Trouble with your requirement is when you restrict the structural authorizatuion on positions for the manager and anywhen run internal job market the manager could not access the position information on a publication if he wants to apply as internal candidate anywhere else in the company. Could get quite tricky to solve this (next to all other issues on this topic).
If it is just about restricting the search I would exactly do this. Either per modification or by a customer development I'd restrict the search result by the structural information without actually switching on structural authorizations.
For getting the positions you should be able by using an evaluation path for direct and indirect positions of a manager or if not available use employees under a manager. If it does not skip the positions they should be contained in the result. If not copy it and remove the skip flag (and S-P relation as it is not needed). Unfortunately I cannot say which evaluation paths are really standard as most systems I use are enhanced here.
path should be like:
NR    Obj.    A/B    Rel.    P    Rel. Obj.    (Descr. Info)
10    P       B      008     *    S            (get position for employee)
20    S       A      012     *    O            (get org.units the position is leading position)
30    O       B      002     *    O            (get all other org.units under the org. unit assuming manager may see all levels)
40    O       B      003     *    S            (get all "normal" related positions in org.units)
50    O       B      012     *    S            (get all leading org.units - could be more than in 10 as we have several org.unit levels)
Best Regards
Roman

Exclusion Flag in PD Profiles (Structural Authorizations)

Hello, I have a question about the exclusion indicator in IT1017 (PD Profiles). We are upgrading from 4.6C to ECC 6.0. This indicator was not available in 4.6C. We are now concerned that users may inadvertently set this indicator and the recipientu2019s authorizations will get impacted.
The documentation only states that "This field allows you to exclude branch structures from structural authorizations."
We have found that if the flag is set (and RHPROFL0 runs), the impact to the user is that they can only see their own data. We have also found that, in order to remove the flag you must remove it from IT1017 and re-run RHPROFL0 with the "delete manually maintained authorization profiles" - PD Authorizations flag switched on.
Can anyone help explain, what the exclusion indicator is used for? And shed some light on itu2019s function?
Regards,
Gino

The exclusion is used to exclude a specific piece of a structural profile you assign to a user. Example: your user has a structural profile to see all HR infotypes within his/her department. However you don't want this user to see the managers data. You can create a separate structural profile that contains the manager's personnel number.
You assign both structural profiles to the user. Either directly "on the user" using transaction OOSB (Table T77UA) where you see an identical exclusion indicator. The "manager" structural profile will have the exclusion indicator set. That way the user has access to department data exclusive the managers data.
If you assign it on the position by IT1017 you set the exlusion indicator there. You will see that if you run RHPROFL0 that T77UA will be updated with the 2 entries for the user and one will automatically have the exclusion indicator set.
The concern that users inadvertently change this indicator should be very small since there should not be very many users that have access to PO13 and/or OOSB in a production environment.
Ruud Scheenen

Structural authorization - creation of employee number in webdynpro or abap

Hello Experts,
We are facing some problems with the combination of structural authorizations and the creation of a new employee.
When we use PA40 to create a new employee this does not give any problem.
In the webdynpro we first execute a call transaction PA40 to apply infotype 0000 and 0001. This works well.
Except that the call transaction does not set the connection between PA and OM. (so we did program this ourselves)
In PO13 and the table HRP1001 the same relations are made as when we use PA40 in the sap gui.
After this we do call transactions PA30 for the next infotypes.
When we check the SU53 it gives a message: problems with structural authorizations object P (with the employeenumber) starting at 01.01.1800, enddate is empty.
The employee is manager and connected with his userid in infotype 0105.
We use in the structural profile the function module RH_GET_MANAGER_ASSIGNMENT
We checked with transaction HRHAUTH.
User has been adjusted to the tables T77UA etc.
We do not use workflow in this webdynpro
We used the trace function when this was executed, but it did not give more information about missing structural authorizations.
This issue was before on SDN (Structural authorization - creation of employee number) but unfortunally there was no solution there for the issue!
Hope one of you can help me to find the solution!
With kind regards,
Rita Mensink

Hi.
After 2½ days of frustration I finally nailed this.
Function group RHAC, that handles the authority checks, initially buffers a table called VIEW containing all objects available for the user. As stated earlier in this conversation, SAP handles creation of relations in HRP1001 (links PA and OM). At this point the new employee number is appended to buffered table VIEW in function group RHAC.
When execution the PA40 activity through CALL TRANSACTION, the creation of the relations are not handled - and the same goes for updating the buffered table VIEW. The table can be updated using the function module RH_VIEW_ENTRY_INSERT from the same fundtion group:
This example might be useful
data: ls_view_entry type hrview,
        ls_related_object type hrobject.
ls_view_entry-plvar = '01'.
ls_view_entry-otype = 'P'.
ls_view_entry-objid = lv_pernr.
ls_view_entry-begda = '18000101'.
ls_view_entry-endda = '99991231'.
ls_view_entry-maint = 'X'.
ls_related_object-plvar = '01'.
ls_related_object-otype = 'S'.
ls_related_object-objid = lv_ny_objid.
call function 'RH_VIEW_ENTRY_INSERT'
    exporting
      view_entry     = ls_view_entry
      related_object = ls_related_object.
Best regards
Poul Steen Hansen
Senior Technical Consultant
EDB Consulting Group A/S, Denmark

BW/HR structural authorization in BI 7.0 version

Dear experts,
Can anyone please explain how to extract HR structural authorization from R/3 to BW 7.0, and how to configure the authorization in the BW, I hope everyone can give me a work flow.
Thanks.

Hi Auke, thanks for your answer.
Changes inside the user profile are working, but deletion don't. And yes, the meaning of this is that user should not have role anymore.
I saw help documents with some procedure using D_E_L_E_T_E user. I didn't understand. Do you know something about that? Is that maybe the right way?
Thanks,
Thiago

How To Create ABAP Code For HR Context Sensitive Structural Authorization

Hello,
We have created a HR Custom Program which IS NOT built off the PCH or PNP Logical Database. As a result, we need to manually create ABAP code for HR Context Sensitive Structural Authorization Check in our custom HR program. Via HR Context Sensitive Structural Authorizations, we are restricting access to personnel numbers and the underlying HRP* tables.
Any assistance would be greatly appreciated with the identification of the SAP standard function modules (Ex. RH_STRU_AUTHORITY_CHECK, HR_CHECK_AUTHORITY_INFTY, HR_CHECK_AUTHORITY_INFTY , etc) used in HR Context Sensitive Structural Authorization Check, how they are used to control HR Structural authorization (P_ORGINCON), and some sample code.
Thank you in advance for all your assistance,
Ken Bowers

Hello Ken
You can use the interface methods IF_EX_HRPAD00AUTH_CHECK to get the same structural authorization as you can see in PA20/PA30. You need to use the methods set_org_assignment and check_authorization for this purpose. For more information you can refer to include FP50PE21 from line 237 onwards till 270.
Regards
Ranganath

MSS genericiview and R/3 structural authorizations

Hi,
I have created some iViews based on par-file "eeprofilegenericiviewtable" to display R/3-queries. In R/3 we use also structural authorizations for the managers with functional module RH_GET_MANAGER_ASSIGNMENT.
The structural authorization is working in R/3 for a selected manager selecting a query directly from the R/3 via SQ01, but it doesn't in the iview. When the same user is viewing the "query"-iview, the message "No data selected" appears.
When I assign the user a structural authorization without the functional module RH_GET_MANAGER_ASSIGNMENT, e.g. only with some object types, the user can retrieve data without any problem using "query"-iview.
Probably the problem is in the functional module HR_INFO_GET_USING_QUERY used for retrieving R/3 query data from the portal and used by the iview eeprofilegenericiviewtable.
Has anybody met a similar problem? We are using EP6.0 SP14 and SAP R/3 4.6C.
Beata

Hi Dwayne (and others!),
Were facing similar problems with the error message "R3_CONNECT_FAILED". However, our difficulties are a bit strange because i only occurs on one of our two server nodes. We're running SAP EP 6.4, SP9.
Previously, we've had problems with the maximum number of connections towards our backend system, SAP R/3. But setting the environment variable CPIC_MAX_CONV helped us.
However, now we get the above error, but only on one of our server nodes. Do you (or anyone else) have any suggestions as to what might be wrong?
Thanks in advance,
Rasmus

SAP BI 7.0 Transport issue with HR Structural Authorization DSO

Hi,
I am trying to transport HR Structural Authorization DSO Objects in BI 7.0 from Dev to QA system. The Data sources are 0PA_DS02 and 0PA_DS03. ( I am sure that there are lots of changes in Authrorization concept in BI 7.0),.
1. Please suggest me if I need to make any changes and tests before moving these authorization objects to QA system.
2. Also, do I need to take any pre-cautions while activating business content objects 0TCTAUTH and 0TCTAUTH_T (Datasources look like are from 3.x) as I am getting issue with the activation of the transfer structure for these objects?
Thanks a lot for your valuable inputs.
Regards
Paramesh
Edited by: paramesh kumar on May 5, 2009 12:45 AM

Hi Paramesh.
You can use the DSOs 0PA_DS02 and 0PA_DS03 in BI7.0 as well. You just need to use the new generation of analysis authorizations in transaction RSECADMIN.
You can use 0TCTAUTH and 0TCTAUTH_T in BI7.0, however we have experienced som problems with the 0TCTAUTH_T extractor, which dumped because of a poorly designed SELECT statement that was unable to cope with 10000 records. We have replaced it with a generic data source that uses table RSECTEXT directly.
Regards,
Lars

R/3 reports related to structural authorization

Can anyone advise which standard reports/transcation codes in R/3 relate to structural authorization? are some better than others? I am interested in viewing allowable objects etc,.
Thank you,
Meghan

Hi Jim,
As you have mentioned you have worked a lot on structural authorizations,
I would request you to kindly help us on the below mentioned scenerio..
Issue : (Scenario)
C directly reports to B, and B Reports to A.
In the above scenario we have logged as B and did the compensation planning for C. A is the approver for the Cs compensation planning.
As C is HOD for HR Org unit. He will submit compensation plans of his subordinates to B for approval. That means B has to have approval authorization for Cs subordinates and he should not have approval authorization for his direct reporting employees.
In our scenario, B is able to perform the compensation planning as well as able to approve the same for his direct reporting employees. This shouldnt happen in our process.
How can achieve this, Please advice
Regards
Raghav

HR Structural Authorization DSO's

Hi,
I have developed HR module for the first time. I need to create the authorization objects for the HR reports.
I found 0PA_DS02 and 0PA_DS03 for structural authorizations in HR. I dont understand the purpose of these DSO's.
Can some one explain what is purpose of the 0PA_DS02 and 0PA_DS03 dso's and how to create authorizations in HR?
Thanks and Regards,
Pooja

HI Pooja,
Use "Rsecadmin" create a authorization object and in that click on the below tool bar infocube authorizations which gives you a option to choose the infoprovider either cube or dso .choose your dso and then navigate around according to your requirements with include option.
I think you need to load the DSO 0TCA_DS01 for Authorization Data(Values). Activate this DSO and try loading the data into this DSO as well and then try to generate the authorizations from this
Thank you

HR-Structural Authorization-AUTSW ORGPD switch

Similar Messages

Maybe you are looking for