Issues with Analysis Authorization checks in APO

Hi Friends,
I am facing an issue with Analysis authorization checks in APO.
We have setup user access based on Management Entity (Analysis authorization - AGMMGTENT and 0TCAACTVT) and core APO authorizations (based on the work profile - e.g: Demand Planner).
Scenario: Consider User A has access to India and Australia Management Entities with 0TCAACTVT - *
This user also has display access to all management Entities (AGMMGTENT - * and 0TCAACTVT - 03). This scenario works very well in Quality where the RSECADMIN trace shows check on both Characteristics. However in Production the RSECADMIN trace shows up only against AGMMGTENT (*) and by default takes 0TCAACTVT as (*).
In Quality the Characteristics that get checked are as below : and it works as expected. Display access for Management Entities that are supposed to be displayed only and change access to only the Management Entities that it should.
However the Trace for Production shows the following : As a result it is allowing the user to change access to all management Entities. Which is not desirable..
Resultant trace results are as below: This should not happen..
I have compared all Analysis Authorizations and it is same across both Instances. The Demand planner access is consistent too..
Will it be possible for you to advise on what could I be missing.

Hi All,
If it helps, in Quality: the Authorization checks are listed as: Subselection (Technical SUBNR) 1
while in Production it checks Subselection (Technical SUBNR) 1 in one place, however where it fails - the check happens as Subselection (Technical SUBNR) 0.
Is there a way we can change this to SUBNR 1. Is there any table entry that I can look at to check if the Authorization check is functioning incorrectly..
Please advise.. Thanks..
Regards,
Prakash

Similar Messages

Issues with Analysis Authorization on Infoset

Hi all
We are facing an issue with Analysis Authorization on Infoset, it doesnt seem to throw authorization error when we access a record that is outside the authorization. We tried to use the same authorization set up from the same user we try to access the a record that is outside the authorization it behaves correctly.
Here is my setup
0CRM_MKTELM__0CRMCAMPTYP = ZA11
0TCAACTVT = *
0TCAIPROV = *
0TCAVALID = *
When I tried to access ZA12 it should throw an authorization error but for infoset it doesnt seem to work. Is there anything that we should take note for Infoset?

Hi Chee,
I am getting similar issue.
I believe navigational attribute was already a authorization relevant in your case.
What and where did you set it as authorization relevant to make it work on infosets.
Regards,
Ramz

Issue with Analysis Office Add in

Hi,
User are having an issue with Analysis Office and giving the error.
From Analysis Office-> Open workbook->after Login to AO using BW connection
After opened the report ->when refresh the report, getting the error
"An Exception occurred in one of the data sources. SAP BI Add in has disconnected
Nested Exception. See inner exception below for more details
Initial RANGE-LOW for customer exit variable ****_EXIT_001 corrected ..
Under details
An exception has occurred in one of the data sources.
SAP BI Add-in has disconnected all data sources.(ID-111007)
We are using BO AO for MS Office Add-in 1.4 SP3 in BO server.
Please let me know the reason for this error and how to fix this.
Thanks in advance.
Jayakrishna

Hi Krishna,
Thanks for the reply. The Sales office field is directly mapped in the transformation and does not have any routine. Its the Key field.
The Billing Document Condition infocube is being feed by the DSO '2LIS_13_VDKON - Billing Document Condn' and datasource is '2LIS_13_VDKON'.
The Open Orders infocube is being feed by the DSO Document Order item / Delivery; below which we have another 3 DSO.
1st DSO has the Datasource '2LIS_13_VDITM'
2nd DSO has the Datasource '2LIS_11_VAITM'
3rd DSO has the Datasource '2LIS_11_V_SSL'
The Sales Office 7 has txn records for the month of April & May.
The report built on top of a Multiprovider and the for the months June and July, we have txn records fine for the sales office 01 - 06.
Please help me, if i am missing anything here and make me to understand better.

Problem with analysis authorization- 0BI_ALL always needed

Dear all:
we have a serious issue on so-called "analysis authorization" now. We have auth-restricted user who only have authorization to access data on one company code. We also create a BI-authorization in analysis authorization and assign the following auth-relevant object to this authorization-
0TCAACTVT = 01-03
0TCAIPROV = ALL
0TCAVALID = ALL
0TCAKYFNM = ALL
0COMP_CODE = A001
And we create one query with only company code and number of employee in the row and column. But everytime we execute this query, there s always message" No Authorization". We used ST01 to trace and the result shows we need to have "0BI_ALL" in auth object S_RS_AUTH. If we added 0BI_ALL, all company code data will display, which definitely no auth restriction at all. Is there any specific authorization setting we need to do?
We are stuck here pretty bad. Thank you all in advance if any input.
BR
SF

Hi,
I guess the Authorization profile is active , and in the Tcode PFCG -> Role name -> User tab page ( user comparision is done ).
Check if any of the tab page shows red light .
And assignment of 0BI_ALL is not a solution , as any user can do anything in the system.
Also do not forget to log - off and log-in into system after changing into any of the authorization profile to see changes that had happened.
Hope that helps.
Regards
Mr Kapadia
Assigning points is the way to say thanks in SDN.

Scheduling issue with Analysis for Excel

Hi,
I am trying to schedule a workbook in Analysis for Excel from CMC. The schedule always fails when I uncheck the APPLY DEFAULT FORMATS in the components tab of the Display Analysis. The schedule works fine if this box is checked. Has anyone come across this issue?
Analysis Excel Version: 1.4.5.2837
Thanks,
Kal

Hi Tammy,
Sorry for getting back to you so late. We are right now BIP-add on SP5 for Analysis Office. We are planning to have BIP-add on SP6 next week. Dont know if this will solve my issue but something to try.
Thanks,
Kal

[CUA] Compatibility with Analysis Authorizations (RSECADMIN)

Hello,
I have two questions for you, BI experts :
1) Could someone please confirm that it is not possible to centrally maintain Analysis Authorizations (trx RSECADMIN) from the CUA ?
2) Does it make sense to start a CUA project now with the Identity Management solution coming soon ? What are the pros & cons of each ?
Thanks in advance.
Best regards,
Guillaume

Hi,
I had a look at the Roles and Profiles tables used by CUA.
I found that it uses special tables such as :
USRSYSACT     CUA: Roles in Distributed Systems
USRSYSACTT     CUA: Roles in Distributed Systems
USRSYSPRF     CUA: Profiles in Distributed Systems
USRSYSPRFT     CUA: Profile Text in Distributed Systems
USLA04          CUA: Assignment of Users to Local Roles
USL04          CUA: Assignment of Users to Local Profiles
There is no analogous table for RSECADMIN tables such as :
RSECAUTHGENERATD     BI AS Authorization Reporting: Generated Authorizations
RSECLOG               Storage for Authorizations Logs xml
RSECTXT               Authorization Texts
RSECUSERAUTH          BI AS Authorizations: Assignment of User Auth
RSECVAL               Authorization Value Status
This, I conclude that it is not possible to maintain BI analysis authorizations from the CUA central system.
This kind of authorizations has to be performed in the child system directly.
Unless, SAP has something to draw out of its pocket soon...
I indeed read that some development was done on the CUA, parallel to the SAP NW Identity Management solution.
Best regards,
Guillaume

Issue with the SNP Extractor in APO-BI.

Hi Experts,
I am facing an issue with SNP Extractor. I have a SNP Extractor in APO system, and it has 4 datasources connected to it.Out of the 4 datasources, we are getting display of records for relevant selections in only one data source, but for the other three data sources, given what ever be the selections, it gives a message saying " 0 records available ".
Please could you suggest, what can be the issue and also indicate a solution to resolve it. Do we need to apply any SAP Note to resolve the issue?? And where can we see the Current Support Package that is installed in the system??
Replies in this regard, would be very helpful.
Thanks and Regards,
Bhargava

Hi,
you can see the Current Support Package in this way:
Log on in your BW system --> System --> Status --> Component Information (hand lens) -->
near the SAP_BW software component and release, there is the level (for example 0006).

Issue with the storage check if files are uploaded...

There is an issue with (photo) updloads to SkyDrive filling the temporary items. When I started to upload photos to Skydrive, I had about 2.4 GB free space on my Lumia 820 and after a while the whole memory was full. I uploaded successfully about 600MB of photos, but the same time the phone filled the temporary items to 2.4GB and thus went to full stop with all memory gone. And I haven't had any success of freeing up the temporary items.
Basically, whatever I upload to the Skydrive it goes to the temp files and that cannot be cleared using Storage check option.
Can you please help me on this?

cjlim wrote:
No worries with the 925. It comes with at least 16gb internal storage. Have a good holiday.
16GB without a micro-SD card slot isn't enough for many users especially those who have a large music collection. (Note: Cloud storage is NOT equivalent to local storage). In any case 16GB will only postpone but not get rid of the problem of the 'Other' folder.

Template - issue with validity area - check on multiple usages at once

Hi all
One customer requirement Iu2019m trying to solve, and I donu2019t find a solution, is the following:
<b>When we have two or more validity areas in the generation variant, we want to check on both at the same time in order to get the data on the SDS.</b>
<b>Is this possible or not and, in case it is possible, can someone explain me how to do this?</b>
Thanks in advance.
Two examples.
In the generation variant we have validity areas:
A.     REGION                SE
                     USE_CAT             IND
B.     REGION                NO
                     USE_CAT             IND
C.     REGION                NO
                     USE_CAT             FER
In the specification data of one VAT we have several instances. The usages added to these instances are:
1.     REGION                SE
                     USE_CAT             IND
2.     REGION                SE
                      USE_CAT             FER
3.     REGION                NO
                     USE_CAT             IND
When I use generation variant A, I only want to see instance 1 on the SDS.
When I use generation variant B, I only want to see instance 3 on the SDS.
When I use generation variant C, I donu2019t want to see any instances on the SDS.
I donu2019t find how to solve this.
When I donu2019t use a repeating group type G for validity area, using generation variant A, I get instances 1 and 2. Using generation variant B or C I get instance 3 on the SDS.
When I use a repeating group type G for validity area USE_CAT, using generation variant A or B, I get instances 1 and 3. Using generation variant C I get instance 2 on the SDS.
Similar with the exclude check put.
In the generation variant we have validity areas:
D.     REGION                SE
                     USE_CAT             IND
E.     REGION                NO
                       USE_CAT             FER
In the specification data of one VAT we have several instances. The usages added to these instances are:
4.     REGION                SE
                     USE_CAT             IND        excl
5.     REGION                REG_EU
                      REGION                SE           excl
                      USE_CAT             FER
6.     REGION                NO
                      USE_CAT             IND
When I use generation variant D, I donu2019t want to see an instance on the SDS.
When I use generation variant E, I donu2019t want to see an instance on the SDS
I donu2019t find how to solve this.
When I donu2019t use a repeating group G for validity area USE_CAT, using generation variant D, I get instance 4 on the SDS. Using generation variant E I gent instance 6 on the SDS.
When I use a repeating group G for validity area USE_CAT, using generation variant D, I get instance 6 on the SDS. Using generation variant E, I get instance 5 on the SDS.
Kind regards,
Luk

Hello Luk
You wrote: When I understand the documentation of the validity area's correct, options subset, superset, 1:1, ... always reflect to the relation of the entry in the generation variant and the usage that is maintained one on the data.
This is exactly how the link is done between data in EH&S and the data which show up in WWI document (please exclude the topic of G group at the moment; this is special). Therefore the validity area entered in GenVar is the "Leading" validity area.
Regarding you questions some "basic" work is needed. May be this help you to find new options to solve your issue:
SAP EH&S uses the "validity area type" and the "validity area". Common used are the validity types:
REGION
DGREGION
PLANT
It seems that you have created a new validity area type USE_CAT with validity areas wich you have defined by your own.
I will give you only an overview about the "normal" use of REGION. In this case the validity area is normally a 1:1 relation to a country (defintion is done via customizing). A "special" validity area is REG_WORLD (please refer to SAP docu). REG_WOLRD contains automatically (without further doing) all other validity areas of type REGION. Now it is always possible to generate new "fictive" validity areas. E.g. you Could define the validity area "NAFTA" which would have a link to the countries: US, MX etc. These validiyta areas can be used in data maintenance and in the GenVar as well.
As I have no knowlede how you have defined the USE_CAT" validity areas I can not provide you hints. But I would like to provide further hints in using the "Excl." Flag of usage of the VAT
Example: if you use Rating 1 in combination with REG_WORLD, DE excluded and the GenVar has the leading validity area DE this value is not used in WWI report. But if the genVar would have the leading validity area BE it would be used.
Please check really carefully the topic of "subset, superset, 1:1,.." because this is the "key" issue if or if not a VAT will show up in WWI.
Now back to your next question:
when on the data a validity area is excluded and the same validity area is present in the generation variant, data should not be displayed even when there is a positive match prasent as well. (e.g. positive match on region, negative match on use category).
Now as explained above: if in VAT level a validity area is excluded but the same validity area is used as leading Validity area in WWI report the value will not show up. The same should be true if you have used "G groups" with discrete validity areas
Next question:
when you defined the data as relevant for region EU and use category industrial, data should only be displayed when the generation variant contains both a region related to EU AND this industrial use.
Here I would need more information. The GenVar contains by default only one leading validity area. Therefore any further "logic" must be applied by using "G Group" in the template and now things get "worse" in some sense.
If I remember correct the following should be true:
If you have used properly the G Group with "Use_CAT" in your WWI document this should work:
You have defined the VAT as : Rating + DE + IND. Now in a special section of your WWI report you have used the G Group. By using this the value should be printed but not a parallel VAT value with Rating + DE + FER.
If you have used this logic in your whole template I really salute because the WWI template is in my opinion very complex to understand and the logic how to retrieve the data from EH&S into the WWI report is complex too and the length of the report should have increased by at least 20 % or something like that
Now you have mentioned a further option you are using:
"Currently we solve this by creating multiple characteristics (use category specific) and selecting only on validity area region based on the generation variant."
If I underdstood your explanation correct you have done the following:
If necessary you have entered a further characteristic in the Class called "use CAT" which must have values. Then using the "if else etc." logic of WWI you select only those VATs into the WWI report which does have the correct "Use Cat".
Once again:hard work which you have done. In my opinion you should go on with this approach. In doing so you have implemented an "and" logic. Only if the Value does have DE and the UseCat (in characteristic) Is e.g. FER the value will be printed.
It is complex yes but the "G Group" is much complexer
Natural solution of demands like this is using further ratings to select the data properly. It seems to be you have excluded this option.
With best regards
C.B.
Edited by: Christoph Bergemann on Sep 4, 2011 5:50 PM
Edited by: Christoph Bergemann on Sep 4, 2011 5:54 PM

Issue with FI Validation check Screen

Hello Friends,
I am having an issue with creating FI validation, specifically the check tab. I need to input BSEG-GSBER = 'EES', but I dont see BSEG in the list of structures. How can I add it?
Thanks.
Zack

Hi,
I have asked to check whether the BSEG structure is allowed to be used in the Pre-requisits part of the validation or not.
Also check that you are defining the validation step at level 2 (Line Item level) or at level 3 (Complete Document Level).
As level 1 (Header Level) does not allow the BSEG structure.
Regards,
Gaurav

Issue with Dreamweaver CS3 Check username behavior

Let me start by saying that I'm not a developer, and I may be in over my head on the project I'm working on.
I'm creating a page to register new user's information into aa Access user table. I've created a registration form, and added the Insert Record behavior. That works fine, no problems. However, when I add the Check New User behavior, I get some strange results.
If the new username is valid (not a duplicate), the form processes and goes to my "thank you for registering" page. Great.
If the new username is not valid, the behavior redirects to the "sorry, pick a different username" page. Great.
When the user goes back to the registration page to change the User Name and tries to submit the form, and error message appears thet the connection (MM_rsKey) is still open. When I look at the code (with my very limited knowledge of actual code), it looks like the behavior doesn't close the connection unless the selected User Name is valid. If the redirect happens, and the user goes back to the registration form page, the connection hasn't been closed, and the form simply won't process.
I've even tried splitting the registration into 2 parts... I created a form with only the User Name field and a submit button, thinking I'll just make the second part of the process an update, where the additional information is added to the existing record that matches the user name, but still no joy.
I even checked to see if the code that closes the connection resides on the redirect page, but I don't think that's the case.
I'm probably missing some perfectly simple step, but I just can't seem to figure it out.
I appreciate any help with this. Thanks in advance.
Ken

Yes, that's really how that behavior is meant to be used. You could even take it a step further and have a password field on the first page.
The only issue I have with that scenario is is for some reason, the user doesn't complete step two - then you essentially have the account created but not complete. So then you have to add some sort of check upon login and direct the user back to step 2 if he never filled out that part.
So you may want to start thinking about eventually building a registration page where it's all containined on the same page. The prococess would be something like this:
1. User enters all required information, including username and password.
2. The page is submitted, but before the insert record occurs the check new username runs, or some variation of it.
3. If it passes, the record is inserted and rediects to the confirmation page.
4. If it doesn't pass the check, instead of a redirect like the behavior does, it displays a message.
5. the tricky part here is not to lose all the other entered information. That can be retained in a session, and bound back to the input fields.
That's just an overview, and i'm sure you've seen enough web forms to recognize the workflow - usually with registration forms and online shopping and checkout forms.

Issue with Analysis Connection

Hi to all! I have installed BoBj 4.1 edge edition.
When I try to open OLAP connection in CMC I receive the following error:
Analysis, edition for OLAP encountered an unexpected exception at 18:14 that has caused it to close.
The following reasons may have caused the unexpected exception:
Analysis, edition for OLAP has timed out. Your workspace may have been automatically saved to your Favorites folder as an "autosave" file.
A fatal exception has occurred. Log on again to Analysis, edition for OLAP.
If you repeatedly see this error, contact your administrator.
Have anyone experience the same problem? All BI platform servers are running properly.

Hi,
please clarify this a bit.
Does this error occur when you try to modify an exisiting OLAP connection in the CMC or does this happen when you try to open an Analysis for OLAP Workspace?!
If the second one please check
http://service.sap.com/sap/support/notes/1962431
Regards
-Seb.

Issue with the authorization

Dear all,
There is one multiprovider. It points 2 cubes. Activity cubes and Opportunity cubes.
Now reports works fine and if a person has SAP_ALL access. if a user has only access few roles then keyfigures from Activities cube is not being displayed.
Key figures from Opportunity cube is being displayed.
Additional information:-
In Opportunity cube we have one authorizatio object but in Activity cube there is no authorizatio object. I am not sure if we need to have authorization object defined for activity cube too.
We have recently migrated the old authorization(3.5) to new authorization(7.0).
This is highly critical. Appreciate your immediate inputs.
Thanks & Regards,
Anup

Hi Anup,
As there is a Authorization object in a Cube, it means this object is most probably there the Multiprovider as well.
The InfoObject Authorization restrictions are applied at the Infoobject level and not at the Cube/multiprovider level, meaning say 0Plant is authrization relevant, then whenever it is being used ( cube/multiprocider) it will be restricting the user access and asking for roles. No matter if the 2nd cube has this object or not still it will be restricted as its there in multiprover.
So better provider users with that roles.
Regards,
Pratap Sone

Issue with storing authorization information, trying to start Home Sharing

I am currently attempting to set 'Home Sharing' up on my iTunes so that I will be able to share music and videos between two computers in my household. Both computers are on the same network, my home network. When I attempt to start Home Sharing, the following phrase pops up after putting in my iTunes username and password:
"There was an error storing your authorization information on this computer." (followed by other writing)
If anyone can help me to correct this issue and to start my Home Sharing it would be greatly appreciated.

Hello \'CUSE FAN,
I would recommend taking a look through the following article.
Troubleshooting Home Sharing
http://support.apple.com/kb/TS2972
Cheers,
Allen

Issue with Referential Integrity check in Oracle VPD Policy

Hi,
Lets assume I have two tables - Customer and Order, with cust_id in Order table referring to primary key of Customer table.
Example Data;
Customer
cust_id Name
1 abc
2 def
3 ghi
Order
Order_id cust_id Order_type
1 1 A
2 2 A
3 1 B
Now I have policies defined on both the tables;
- for "Select, Insert, Update" queries on Customer table.
- for "Select" queries on Order Table.
Policy 1 on Order Table;
Irrespective of the user, predicate = 'Order_type = ''A'''
Policy 2 on Customer Table;
Irrespective of the user, predicate = '(select count(1) from order o where o.cust_id = customer.cust_id and o.order_type = ''B'') > 0'
My intention is to show only those customers who have atleast one order of type 'B'. And this policy works fine in case a user tries to read data from customer table. (for example, record for cust_id = 2 will not be returned as it don't have any orders of type "B")
However, when a user tries to insert record in Order Table, because of the existing referential integrity constraint, the Policy on Customer table is also getting triggered. And an exception is being raised "ORA-28113: policy predicate has error".
Could someone please explain why this is happening ?

I'm afraid, there is no such a mean.
At least I do not know about it.

Issues with Analysis Authorization checks in APO

Similar Messages

Maybe you are looking for