Issue with authorization objects

Hi,
We are running on ECC 6 . There is an issue while adding t-codes to a role.
When we add a transaction code in the Menu tab, for eg, a Z transaction code, it throws up a whole lot of open authorization objects under the authorization tab (open authorizations under FI, MM, so on). The open values proposed are all the default values in SU24. This happens even if we use the 'Read old status and merge with the new'. Our check indicator maintenance for all t-codes seem to be fine. Pls advise.
Cheers!!

> The default values (SU24 values) are once again populated if they were not maintained during the earlier maintenance.
They are populated again if they were deleted during the earlier maintenance or are in a changed status of the original authorization where new values in SU24 are proposing something different.
That is why you should never delete standard or maintained authorizations and try to avoid the copy & change strategy by maintaining SU24 to meet your needs.
It shounds like SU24 is not as "fine" as you have stated before hand.
Cheers,
Julius

Similar Messages

Issue with authorizations for BPS

Hi Experts,
There was an issue with authorizations for BPS. We have a large number of agents that need to enter plan data via a layout. In order to control the necessary authorizations, we would like to filter via something similar to a user exit using a function module in order to avoid having to define authorization objects for each of the agents who have access to the systems. Right now, we are not sure if there is user exit concept available as it is for BW variables. Any body experienced similar issue may share their experience.
Regards,
Ankit

Hi,
In BPS, you can use user specific variables or you can set up a Variable of type exit. You can also have a variable of type authorization which uses the security / authorization of the BW system.
Hope it helps...
Cheers,
Tanish

Red Light with Authorization Object in PFCG

Hello All - I have a question with authorization objects, there are three roles with red lights 'ON' in authorization object screen in our PRD. However users who are using these roles have no auth issues, standard procedure is to make all lights green in PFCG by maintaining these auth objects.
Big question is "what is the down fall by leaving these objects RED, I need to support my theory when I say all lights green with auth objects.
Why best practise says maintain all lights to green?
Please suggest, appreciate your suggestions.
Thanks.
Edited by: AJ on May 12, 2009 9:44 PM

Hi,
> "What will be the difference between leaving that red lights 'ON' vs "disabling" these red objects? (I am bit confused on this).
Red Object: As you know that authorization Objects comprises of Authorization fields. There are certain fields, which are known as "Organization Level" fields and need to be maintained Centrally. If you miss this fields, then the traffic light icon is RED. For all other authorization fields, light will be Yellow if you miss any blank field to maintain. During check, these fields will provide missing authorization (but you may not get error if same object is present in the role with all fields maintained status).
Disabled Object: If you make any Object Disable, then during check, this Object will not be treated for checking Authorizations. But profile generator will keep this in mind, so you don't get Standard Objects repeatedly (if already present in Deactivated status also) whenever you go to "..Merge with New Data".
You all other questions are very nicely answered already.
Regards,
Dipanjan

Association of authorization group with authorization object

Dear Colleagues,
We are using ECC 6.0 system. There is a transaction EMMAC2 where in the user would pick the case categories & view/make changes as required in the cases.
However, we would like to have a user to pick only those case categories for which he/she is authorized & view/change the data.
This EMMAC2 is controlled by authorization object B_EMMA_CAS & this authorization object has field BRGRU (Authorization Group) along with ACTVT (activity).
We would like to control this via authorization groups
We would like to create authorizations groups based on case categories & those authorization groups would be assigned in this BRGRU field.
Meaning, the end result should be such that, when that new authorization group is added in BRGRU field & that role is assigned to an end user, the user should be able to see data only for those case categories for which the new authorization group has been created
If I use SE54 to create authorization group, it automatically associates itself with authorization object S_TABU_DIS & this does not solve my purpose.
But we would like to create a new authorization group & associate it with authorization object B_EMMA_CAS.
Can someone please let me know the steps on how to achieve it or any other method to achieve it(for above underlined text)?
Does a developer or functional consultant also need to be involved in this?
PS: I tried to search in Google & our forums but could not get any answers

Dear Aninda,
Thanks for the help.
I created an auth group via SE16 in table TBRG & associated to B_EMMA_CAS
A case category was then assigned to this auth group
We tested it - below are the results:-
1. The user is allowed to 'change' and 'display' the case for the case category for which the user is authorized: this works as per requirement.
2. The user is not allowed to 'change' case for the case category for which the user is not authorized: this works as per requirement.
3. However, he is able to 'display' cases for the case category for which the user is not authorized: this we do not want.
If I remove activty 03 (display), then the user is unable to display the case for the case category for which the user is authorized.
How to resolve this?

Program with authorization object

Hi Experts,
I have an issue regarding rules and authorization.
I have created a program with 2 radio buttons transfer and backload. The requirement in authorization is not all users can access both; some can only access transfer and some can access backload only. (r_trans,r_back)
The basis told me that they need an authorization object in order for them to block/separate the transaction for transfer and backload.
Is there a way for me to modify the program and put an authorization object with my radio button? or is it possible to do this with the current program?
Thanks!

Hi,
Thanks for the reply,
Our basis is using PFCG for roles and authorization , how can they check if my authorization object was created using that code?
Here is my code: Im getting sy-subrc = 12.
IF r_trans EQ 'X'.
   AUTHORITY-CHECK OBJECT 'ZACTIVITY'
                ID 'ACTVT' FIELD '01'.
   IF sy-subrc NE '0'.
     MESSAGE 'User not authorized' TYPE 'S'.
     LEAVE LIST-PROCESSING.
   ELSE.
     MESSAGE 'User is authorized' TYPE 'S'.
     LEAVE LIST-PROCESSING.
   ENDIF.
ELSEIF r_back EQ 'X'.
   AUTHORITY-CHECK OBJECT 'ZACTIVITY'
                ID 'ACTVT' FIELD '02'.
   IF sy-subrc NE '0'.
     MESSAGE 'User not authorized' TYPE 'S'.
   ELSE.
     MESSAGE 'User is authorized' TYPE 'S'.
   ENDIF.
ENDIF.

Performance issue with Business Objects Java JRC API in CRXI R2 version

A report is developed using java JRC API in CR XI release 2. When I generate the report in the designer, it took less than 5 seconds to display the results in crystal report viewer inside the designer. But in the QA environment, when I generate the same report from the application, it takes almost 1 to 1.5 minutes to display the same results in PDF. I also noticed that if the dataset contains bigger volume of data, then the reports are taking even longer almost 15 to 20 minutes.
While generating the report from the application, I noticed that most of time is taken during the execution of the com.crystaldecisions.report.web.viewer.ReportExportControl Object method as shown in following line of code
exportControl.processHttpRequest(request, response, context, null)
We thought the delay in exporting the report to PDF might be the layout of the report and data conversion to PDF for such a bigger volume of data.
Then we investigated the issue and experimented quickly to generate the same report with same result set data from the application using XML, XSL and converted the output XSL-FO to PDF using Apache FOP (Formatting Objects Processor) implementation. The time taken to export the report to PDF is less than 6 seconds. By doing this experiment, it is proved that the issue is not with conversion of data to PDF but it is the performance problem with Business Objects Java JRC API in CR XI R2.
In this regard, I searched for the above issue in the SAP community Network Forums -> Crystal Reports and Xcelsius -> Java Development -> Crystal Reports. But I did not find any answers or solutions for this kind of issue in the forums.
Any suggestion, hint in this matter is very much appreciated.

Ted, The setReportAppServer problem is resolved. Now I could able to generate the report with hardcoded values in the SQLs in just 6 seconds where as the same report was generated in CRXI R2 in 1 minute 15 seconds as mentioned in the earlier message.
But, our exisiting application passes the parameter values to the SQLs embedded in the report. For some reason the parameters are not being passed to the report and the report displays only the labels without data.
As per the crj 12 samples codes, the code is written as shown below.
1. Created ReportClient Document
2. SetReportAppServer
3. Open the report
4. Getting DatabaseController and switching the database connection at runtime
5. Then setting the parameters as detailed below
ParameteFields parameterFieldController = reportClientDoc.getDataDefController().getParameterFieldController();
parameterFieldController.setCurrentValue("", "paramname",paramvalue);
parameterFieldController.setCurrentValue("", "paramname",paramavalue);
byteArrayInputStream = (ByteArrayInputStream)reportClientDoc.getPrintOutputController().export(ReportExportFormat.PDF);
6. Streaming the report to the browser
Why the parematers are not being passed to the report? Do I need to follow the order of setting these parameters? Did I miss any line of code for setting Params using crj 12?
Any help in this regard would be greatly appreciated.

Issue on authorization object

hi all,
in me52n transaction, in account assignment tab there is field called costcenter. its field name is kostl and strucutre is cobl. now i have requirement to create an authorization object on this costcenter. that is for example , if i try to make any changes in the cost center field it should allow me to do it. but if some others are using it should not allow them to make any changes. plz let me know the solution how to do step by step. points will be awarded . this is urgent requirement. plz reply fast.
thanking u in advance,
a.srinivas

Hi deniz,
Use this to set up the autherisation object
      AUTHORITY-CHECK OBJECT '<objectname>'
                      ID 'ID FIELD SY-UNAME.
      IF SY-SUBRC NE 0.
        MESSAGE S999 WITH 'You are not Authorised to change entries'.
        EXIT.
      ENDIF.
Inform the Basis team to assign the role only to ur id...so that no other person wil u autherized
Award points if useful
Regards
Gowri

Weblogic 10.3.0 issues with remote object calls.

All:
I was wondering if anyone has experienced any issues with Weblogic 10.3.0 dropping initial remote object calls over AMF Secure Channel. Here are the issues we are experiencing.
1. FLEX applications fail consistently on the first remote object call made across the AMF Secure Channel. Resulting in the request not returning from the application server; which has had varying affects on the different applications including missing data, application freeze and general degrading of the user experience.
2. FLEX applications require a browser/application refresh once the application has been inactive for a certain period of time. In our experiences the behavior occurs after 30 minutes of inactivity.
I've deployed this same code to Weblogic 10.3.3 and the behaviors go away. Are there any patches to 10.3.0 that might take care of this issue that we are not aware of?
Thanks for you help,
Mike

Hello,
I found the problem. But I needed change the target of all my datasources until discover that one of my datasource didn´t answer and no errors was trigged.
My server was waiting this datasource, and not get started.

Restricting infoobject in query designer with authorization object

Hi,
We have to restrict CUSTOMER infoobject with a authorization object in query designer.
How to do this task ? Request kindly suggest.

thr RSSECADMIN tcode. Search with this key word you will get good docs & Wikis in SDN
bhaskar

Display users with authorization objects assigened to them

Hi,
How can I display list of users with company code assigned to them?

hello Rajesh,
What you want is not straightforward. There is no SAP report for this as such. You need to find roles assigned to the user first then go to table agr_1252 anf give the value $BUKRS along with the role names.
You will find out the company codes assigned to the user.
This is not a very efficient way really and will involve too much of effort. If I needed such an information I would have written a simple ABAP report using joins of table AR_DEFINE and AGR_1252. Also check tables UST12 and AGR_1251.
Hi Ben,
Company code is present in several authorization objects other than F_BKPF_BUK. Check F_SKA1_BUK..There are several of them. So we need to check on basis of field BUKRS.
Regards.
Ruchit.

BEx Query RRI with authorization object

Hi,
I have two queries linked using RRI (Sender and Receiver).
Queries have authorization object.
Both queries work fine with authorized user if I use them separately.
(Query Sender works fine with authorized user, Query Receiver works fine with authorized user)
Using BEx in Excel:
- when an authorized user jumps from the Sender to the Receiver, system tells him he doesn't have the authorizations, and Receiver query doesn't appear.
Using Web:
- when an authorized user jumps from the Sender to the Receiver it works fine and user can see the results in the Receiver Query
Could anyone help me?
Thanks in advance
Fede
Edited by: Federico Carta on Jun 23, 2009 2:53 PM

Hi Mohan,
I checked the authorizations and S_RS_COMP, S_RS_COMP1, S_RS_MPRO, S_RS_ICUBE are correctly set.
The strange thing is that if user calls the Receiver query from the web (BI web server), it works fine. The problem is only if user executes them by BEx in Excel. If he uses Receiver query directly without using Sender query, it works fine!!!
Best Regards
Federico

Issue with Info Object Transport after changing Data Type

Hi Experts,
We have a DSO which is running past 5 years. And recently(3 days back) we added new fields into that DSO. Delta loaded for last three days and new info object (Say XXX) data populated into DSO.
Now the problem is, We identified that, info object data type is not correct. We used data type NUMC instead of CHAR.So Character information is missing for that field.
Example:
Data from ECC: ABC123
Data Loaded to DSO: 123 (Missed character ABC)
So we deleted data from DSO and changed the info object data type in Development system.
And also I have deleted only last three days delta records from DSO and transported my info object to Production. But its giving error as: Info object contains data in DSO".
But that info object field is empty in DSO. I have already deleted last three days delta.
Do I need to Delete all 5 years data from DSO to change the data type of recently added new info object ?
Please give me your solutions and ideas to solve this issue.
Thank you,
Best Regards,
Santhosh

Hi Raman,
Thank you for your answer.
When I changed the data type of info object in Dev, I deleted the content of DSO. And same thing transported to QA as well. Before importing changed info object, I just deleted the content of DSO from QA. So transport done successfully QA.
But in Production we have a history of past 5 years. So I cant delete all contents of DSO.
So just deleted only the delta request's which contains data for that info object(3 days back, we moved that info object(NUMC data type) to production,So last 3 days delta only loaded for that info object). And tried to transport it. But it was failed. I am sure we need to drop all data from DSO, if I am interested to go with same info object.
I have some comments on your first approach,
1. If we delete info objects from Dev DSO and transport to Production will give transport failure, Why because, my previous transports errors clearly saying that info object contains data in DSO . So it wont allow to remove that info object from DSO.
2.We are using same info object technical name in BO Data federator also. So if we change add new info objects again we need to make changes with BO as well. I am thinking this point as my last option if i cant find any other solution.
Thank you.
Best Regards.

Issue with Authorization sync job in GRC 10.1

Hi,
I am facing below issue while running the authorization sync job in 10.1 after importing the configuration data as part of migration from 5.3 to 10.1.
we have GRC server and plugin system on the same SP level 04.
Error:
Error in GRCAC101EC; Reason Error in RFC; 'Function module "/GRCPI/GRIA_AUTH_G
PFCG authorization sync failed with errors
Thr RFC connection is working fine and the connector settings are done in GRC. Also the RFC user has SAP_ALL.
Regards,
Giridhar

the sp seems a little low
have a look at Error in RFC; 'Function module "/GRCPI/GRIA_PROF_GET_RANGES" not'

IS-U: Migration- Issue with DEVICE object using EMIGALL

Hello Friends,
I need a quick help. The issue is here below.
I am using the object DEVICE to create Device/Equipment. I could able to create an Equipment however I found that in EQUI table the field SERNR is not updated. Actually this field should have the value of EQUNR.
I had tried many times wih differenct possible options but this field is empty in all the trials. I am also using the auto structure CONTR and its sub strucutures COMMIT, UPDATE, INDIV, CONV filling with 'X' but the result is only this field SERNR is not updated in the table EQUI.
Without this field SERNR being field I cannot perform Device Installation (Full/Technical/Billing).
Please share your ideas.
Thanks in Advance,
Vijay.

Hi Vijay
That's possible...
I assume transaction IQ01 and EMIGALL are using the same function EQUIPMENT_INSERT.
If NEW_VEQUI-EQUNR contains already a number, the function does not get a new number from the number range object, for example with external numbering. In case there's no EQUNR given, a new number is taken from the number range object, internal numbering.
If no SERNR is provided when calling EQUIPMENT_INSERT, there won't be a SERNR in EQUI. Just check if IQ01 provides the serial number when calling EQUIPMENT_INSERT.
This means another possible solution is to get a new number for EQUNR in EMIGALL and populate EQUNR and SERNR before calling the service function module ISU_M_EQUI_INSERT. Call function module NUMBER_GET_NEXT for object EQUIP_NR.
This can be done on field level by setting the Processing Type to 4 = Rule (check which of the two fields comes first - EQUNR or SERNR - to assign the number from NUMBER_GET_NEXT and copy the value for the second field) or via events see menu item Utilities: Event, when you're in the object maintenance screen.
Yep
Jürgen

Text Highlighting issue with TextSnapshot object

Hi,
I am working with a digital book application. I make use of swf loader to load swf pages created from pdf. I use TextSnapsot to draw inline text highlight on the pages. The highlight is thoroughly retained on the respective pages throughout the session and later it can be updated/deleted without any problem. Everything was working great till I made the following changes in the swf loading approach to enable page caching:
I am now loading swf loader object into application memory and while doing jumping from one page to other page I am just copying the content of the next page to the current swf loader which is on the display to the user. There are two sets of swf loaders - one for displaying the page and other to cache the next/previous page(s). On the caching side, I load the swf into application memory and after getting it loaded I pick all the contents of the loaded swf page (the children of it's movie clip) into an array collection. While changing the page I copy the cached content into the swf loader's movie clip which is displaying the page.
Now when I highlight on the page on display and navigate back/forth from the page and comeback again to the page where I did the highlighting: It shows the highlight I did. But as soon as I try to draw another highlight on that page, the previous highlight is instantly disappears from the page.
I suspect that the Textsnapshot object which draws highlight while navigating (to the target display page) is different from the one which redraws/update the highlight on the same page next time. Although the Textsnapshot object id for both the objects is same.
Here are some code snippet:
For copying the content from the swf loader object cached in application memory:
      private function copyPageContent():void
            var contentCollection:ArrayCollection = new ArrayCollection();
            _pageContentVO = new PageContentVO();
            _pageContentVO.contentHeight = MovieClip(_swfPageLoader.content).height;
            _pageContentVO.contentWidth = MovieClip(_swfPageLoader.content).width;
            var count:int = MovieClip(_swfPageLoader.content).numChildren;
            for(var i:int=0;i<count;i++)
                var dispObject:DisplayObject = MovieClip(_swfPageLoader.content).removeChildAt(0);
                contentCollection.addItem(dispObject);
            _pageContentVO.pageContentCollection = contentCollection;
            _swfPageLoader = null;
For copying the content to the swf loader which is displaying the page:
      private function copyContent(pageContentVo:PageContentVO):void
            for(var i:int = 0;i<pageContentVo.pageContentCollection.length;i++)
                var dispObject:DisplayObject = pageContentVo.pageContentCollection.getItemAt(i) as DisplayObject;
                MovieClip(this.content).addChild(dispObject);
            this.content.height = this.height;
            this.content.width = this.width;
after this I dispatch swf loader's complete manually and in the handler of that event I take the text snap shot object.(highlightManager.as)
Code I use to draw highlight manually(using mouse drag on the page).
       public function setHighlight():void
            removeAll();
            if(_textSnapShot!=null && _textSnapShot.getText(0,_textSnapShot.charCount)!="")
                if(_isCoveredTextSelectedAtAnyInstance)
                    _textSnapShot.setSelected(_beginIndex,_endIndex+1,false); //this is the global variable to the class
                else
                    _textSnapShot.setSelectColor(0xfff100);
                    _textSnapShot.setSelected(_beginIndex,_endIndex+1,true);
                if(saveHighlight)
                    countHighlightedSegments();
Code I use to redraw previously drawn highlight when I return to the page:
       public function showHighlights(textSnapShot:TextSnapshot,currentPageNum:int):void
            if(currentPageNum >= 0)
                textSnapShot.setSelected(0,textSnapShot.charCount,false);
                var pageVO:PageVO = _model.eBookVO.eBookPagesVO.getItemAt(currentPageNum) as PageVO;
                var objColl:ArrayCollection = new ArrayCollection();
                objColl.source = pageVO.highLightSelection;
                for(var i:int=0;i<objColl.length;i++)
                    var highlightVO:HighlightVO = new HighlightVO();
                    highlightVO.beginIndex = objColl.getItemAt(i).beginIndex;
                    highlightVO.endIndex = objColl.getItemAt(i).endIndex;
                    setHighlightedSegment(textSnapShot,highlightVO.beginIndex,highlightVO.endIndex);
        private function setHighlightedSegment(textSnapShot:TextSnapshot,beginIndex:int,endIndex:int):void
            textSnapShot.setSelectColor(0xfff100);
            textSnapShot.setSelected(beginIndex,endIndex,true);
Looking forward to your support to resolve this issue.
Regards,
JS

Hi, I've resolved this issue.
It was a textSnapShot GC issue.
I just added the textsnapshot object into an array to avoid GC and that resolved my issue.

Issue with authorization objects

Similar Messages

Maybe you are looking for