Manual migration to analysis authorization-4

hello BI experts,
When authorizing InfoProvider via analysis authorization by using 0TCAIPROV with *. Is it still possible to authorize correctly and sharp data via authorization relevant InfoObjects?
regards
Imberaureus

Its possible considering the user will be able to look in to the data of all data targets.

Similar Messages

  • Manual migration to analysis authorization-5

    hello BI experts,
    How works special InfoObject 0TCAIFAREA for external hierarchy characteristic?
    regards
    Imberaureus

    Hi,
    please search the forum first before posting questions. You didn't get any response, since the topic has already been discussed multiple times in this forum.
    Please check this thread.
    <a href="https://forums.sdn.sap.com/thread.jspa?threadID=193027">https://forums.sdn.sap.com/thread.jspa?threadID=193027</a>
      Cheers
         SAP NetWeaver BI Organisation

  • Analysis Authorization Migration Question

    Analysis Authorization Migration Question
    This is detail Question
    1)     I am testing Analysis Authorization Migration in NW2004s SP9 and have applied all OSS notes that are relevant to SP09 and are coming in SP10.
    2)     We have 2 Info object flagged as Authorization relevant 0COMP_CODE and 0COSTCENTER
    3)     We have Object level security set-up in BW 3.x system and for a role we have specified values like 0COMP_CODE has value 1000, 1800. “:”. In the same role we have specified 0COSTCENTER value 130001 to 180001, “:”  and hierarchy node.
    4)     When we migrate to Analysis Authorizations, using RSEC_MIGRATION, this program creates 2 Authorizations ZCOCODE00 & ZCOSTCTRH00. Both of them have 0COMP_CODE and 0COST_CENTER Objects.
    5)     ZCOCODE00 authorization gets value 0COMP_CODE values 1000, 1800. “:” and 0COSTCENTER Value “:”.
    6)     On the same line ZCOSTCTRH00 gets value 130001 to 180001, “:”  and 0COMP_CODE “:”.
    1st Question:
    1)     Why does it create 2 Authorizations?
    2)     During Checking it does not pass the authorizations, because it seems to me that it fails in Optimization process.
    3)     I manually merge the authorizations in “ONE” object then authorization check passes.  In other word if I combine ZCOSTCTRH00 & ZCOCODE00 then Query authorization check passes.
    Any one is struggling on this.
    Please note, I am doing Migration so that it updates existing Profiles (Roles now from SP9).
    Any comments will be very help full.
    Pankaj Gupta

    Hello Pankaj
    There are some basic misunderstandings on your side.
    Let me try to clarify:
    First we should distinguish between migration of authorizations and of what a query does with them.
    You had 2 auth objects before migration (in 3.x).
    Of course, they must be migrated to 2 new analysis auths.
    There is no general possibility to combine authorizations to a single one as the may appear in different roles and users. Moreover this would kill performance and finally, nobody would recognize the origin.
    Only in very restricted cases one could think of a combination of auths which come out of migration. But, then people loose overview about what goes on.
    Before the corrections in note "Migration IV" the : had not been inserted but now it is for good reasons.
    Now, accept for the moment that you receive 2 auths.
    Then, you cannnot (must not) combine the 2 resulting authorizations!
    <b>Authorization 1</b>
    COMP_CODE : 1000, 1300, “:”
    Cost Center : “:”
    <b>Authorizations 2</b>
    Comp_Code “:”
    Cost Center : 3100001-31999999; “:” plus a Hierarchy Node.
    This means that e.g. combination
    COMP_CODE 1000
    COST_CENTER 3100001-31999999
    <u>is not allowed!!!</u> Therefore, they must not be combined!
    Also, the query and its optimization is comepletely independent of the migration. And here, during query run time the auths cannot be combined. It is no failure!
    Moreover, the merging optimization is just a performance optimizaiton and has nothing to do with whether the query result is authorized or not.
    If you combine them manually you have authorized different combinations.
    Well, now you may wonder why you get 2 auths at all which leads to a "no auth" result in the query execution.
    The reason is, that in 3.x where you got a result with your 2 auth objects the modeling was wrong.
    If you want to authorize any combination of characteristic values, you should combine these characteritics together in one auth object, not in 2!
    (In BI7.0 it works like that but not in 3.x)
    But you defined 2 which may be valid even in several other InfoProviders independently and not even at the same time. Moreover, the auth objects may come from different roles and may be assigend to different users which then have completely different auth content. In general it is not possible to combine different auth objects or to find out those special situations which nevertheless allow for such optimizations. If you re-do a migration with more objects and users you could even receive different results which is also not satisfying.
    Therefore, instead, the mechanism was introduced to insert a : auth to those characteristics that are auth relevant (and checked now with 7.0) but not in the currently processed auth object.
    In you special case it may have made sense to combine them but not in general. And a migration can only try to work as general as possible.
    For your application you may combine the 2 auths manually if you want to allow also the crossover combinations
    COMP_CODE 1000
    COST_CENTER 3100001-31999999
    Best regards
    Peter John
    BI Development

  • Analysis Authorization not working - Empty demarcation

    Can someone help me on this Analysis Authorization? I read many threads in SDN, it seems that I followed the correct steps. The restriction on S_RS_COMP is working well but the restriction on the Analysis Authorization is not working. Surely I'm making some mistake, but can't find what's wrong.
    I'm a User (say USER_00) in a test system, assigned to a Role (say Z:BI_USER). This is a broad role:
    - S_RS_COMP and S_RS_COMP1 have full authorization (*) to all the fields,
    - S_RS_AUTH has the BIAUTH field with Name of Authorization = *.
    Also I have an InfoArea (ZIA_TEST) and an InfoCube (ZIC_TEST). The IC has some characteristics and key figures. The only authorization relevant characteristic is ZCA_CLI (client). The IC has only 5 lines, one for each client ("CLI_01" to "CLI_05").
    Also there's a query (ZQR_TEST) on this IC, with an Authorization Variable (VAR_AUTH_CLI) restricting the characteristic ZCA_CLI.
    I'm trying to create a new User and restrict him to this IC and only to the data of client "CLI_01". If it works I'll apply to a production system.
    What I did:
    1) With tcode SU01 created a new User (USER_01) with no Role neither Analysis Authorization.
    2) With tcode PFCG copied the Role Z:BI_USER as Z:ROLE_TEST then made some changes:
    a) S_RS_COMP
    - Activity = 03 and 16
    - InfoArea = ZIA_TEST
    - InfoCube = ZIC_TEST
    - Type of report component = *
    - Name of report component = *.
    b) S_RS_COMP1
    - Kept * to all fields.
    c) S_RS_AUTH
    - I inactivated and deleted this Authorization Object.
    (I don't want to keep characteristic values restriction inside the role. The idea is to associate different users to the same role, allowing them to see the same ICs and execute the same queries. And differentiate wich characteristic values each one can see by manually associating different analysis authorization to each one.).
    3) With tcode RSECAUTH I created an Analysis Authorization (Z_AA_CLI_01) to restrict access only to client "CLI_01":
    - ZCA_CLI = "CLI_01"
    - 0TCAACTVT = "03"
    - 0TCAIPROV = "ZIC_TEST"
    - 0TCAVALID = "*".
    4) With tcode PFCG I assigned User "USER_01" to the Role " Z:ROLE_TEST" and made Complete Comparison.
    5) With tcode RSU01 I manually assigned Analysis Authorization " Z_AA_CLI_01" to User "USER_01".
    It seems to me that these steps are enough. But:
    a) When I log as USER_00 and go to tcode RSRT2, searching by InfoAreas I can see all the InfoAreas and all the InfoCubes, select and execute the query. That's OK.
    b) When I log as USER_01 and go to RSRT2, searching by InfoAreas I can see only ZIA_TEST and under it I can see only ZIC_TEST. That's OK. Then I select and execute the query.
    Wich means that S_RS_COMP is OK and each user is assigned to the correct Role.
    c) The problem is that in both cases the query brings data from all Clients.
    Under Information and Variable Values (when I run with HTML display) the message is "Empty demarcation".
    I changed the variable to be Ready for Input, just to see wich values it brings. In both cases (as USER_00 and as USER_01) in the Variable Screen it brings all the 5 Clients from the IC and I can select and execute any value.
    So the problem is with the Analysis Authorization or with the Variable, but I can't find what's wrong.
    Any help will be very appreciated.
    César

    OK Marc, it worked.
    Sorry for not answering earlier, but I could get back to this front only some days ago, then began testing your suggestions.
    1) Security Concept
    Authorization Mode was set to "Obsolete Concept with RSR Authorization Objects" (it would never work with this setting).
    I changed to "Current Procedure with Analysis Authorizations".
    Anyway, what's the function of this setting? Do old Reporting Authorizations work with "Current Procedure with Analysis Authorizations" setting?
    2) Variable Representation
    With "Multiple Single Values" it really led to problems.
    With "Selection Option" it worked well.
    3) 0TCAKYFNM
    I don't understand why, but if the AA doesn't have the char/dimension 0TCAKYFNM, when the User tries to run the query (tcode RSRT2) it accuses "You do not have sufficient authorization".
    Info Cube ZIC_VE95 has two KFs (ZKF_QTL95 and ZKF_VLT95). These KFs are used only on this IC (also in the KF Catalog, but it doesn't impact). This IC is used only on Query ZQR_VE95 (also in Transformation and DTP, wich doesn't impact).
    Well, I inserted 0TCAKYFNM and it worked, either with CP, "*" or with EQ, the two KFs.
    4) Authorization Policy Definition
    The situation I'm working on is very typical. Ex.: Some users are Administrators, Managers, Operator 1, Operator 2 and so on. Each Role needs authorization to access some queries. At the same time, they can access information only of the Cost Centers to wich they are related.
    There are many ways to implement it (I tested some of them and they worked well). My point is to define a most practical way, easy to understand and to maintain.
    I'm now sympathetic to this way:
    a) Create functional Roles (ex.: "Administrator", "Manager", "Operator 1", "Operator 2" and so on) defining only the Queries (or Info Areas, Info Providers, etc) each Role needs. No S_RS_AUTH definition.
    b) Create Char Value Roles (ex.: "CC_100_to_199", "CC_200_to_299", etc), only with S_RS_AUTH definition, each one associated with a corresponding AA (ex.: AA for CC 100 to 199, AA for CC 200 to 299 and so on).
    c) Create Composite Roles associating functional and char value Roles. Ex. Composite Role "Administrator for CC 100 to 199", composed of the Roles "Administrator" and "CC_100_to_199".
    d) Associate Users to the Composite Roles.
    Anyway, I'd appreciate if you could indicate some literature (blogs, articles, etc) on this theme.
    Well, thank you very much for your answers. Now I can go on with my studies on this subject.
    César Menezes

  • Analysis Authorization with SEM-BPS

    Hi,
    We have performed technical upgrade from BW 3.5 to BI 7.0. We want to migrate to BI 7.0 functionality phase wise.
    We have SEM-BPS and now we want to migrate to Analysis Authorization of BI 7.0.
    Once we have igrated to Analysis Authorization, will there be any impact on SEM-BPS? Can we still use SEM-BPS with New Analysis Authorizations? We do not want to move to BI-IP in near future?.
    Please advise.
    Best Regards,
    UR

    Dear UR,
    Iu2019m going to try helping you,
    In difference of reporting functionality, in planning, the data of an InfoCube is not just read; it is also changed or created.
    There are two planning tools in BI: BW-BPS (Business Planning and Simulation), and BI Integrated Planning.
    There are two main tcode: BPS0 and RSPLAN
    There are three authorization objects to manage Integrated Planning:
    S_RS_PL_ADMIN - Planning Administrator
    S_RS_PL_PLANNER u2013 Planner
    S_RS_PL_PLANMOD_D u2013 Planning Modeler (Development System)
    The main object in the planning scenario is InfoCube real-time, where can available writing in small package that arrive in parallel. In some cases the security requirements for reporting and planning can be merging. In this case you need authorization object for checking planning, as authorization object above, and you need authorization object for using a query for planning requires as S_RS_COMP.
    In addition to authorization for displaying data, the authorizations for changing data you need analysis authorization (the analysis authorization focus in the InfoProvider, no in Aggregation Level).
    In your analysis authorization design for reporting stuff, you should use in 0TCAACTVT characteristic 03 value. In the planning stuff, you should use in 0TCAACTVT characteristic 03 and 02 values. As explain following:
    Using the characteristics 0TCAACTVT (activity), you can restrict the authorization to different activities. Read (03) is set as the default activity; you must also assign the activity Change (02) for integrated planning.
    http://help.sap.com/saphelp_nw70ehp1/helpdata/en/b1/0c9441b8972e7be10000000a1550b0/frameset.htm
    I hope this suggestion can help you answer question,
    Luis

  • Analysis Authorization & its compaitbility with BW 3.5 Query

    Hi,
    We have technically upgrade our system from BW 3.5 to BI 7.0. Now we are planning to upgrade to Analysis Authorization.
    1. Is it necessary to Migrate BW 3.5 query to BI 7.0 so that it will work with Analysis Authorization? If not, then how Analysis auth will treat authorization variable defined in the query?
    2.What are pro & cons of two approach: Fresh Implementation of Analysis Authrization v/s Migration using tool ?
    Please advise.
    Best Regards,
    UR

    Dear UR,
    Iu2019m going to try helping you,
    In advance a give you some ideas about migration process regarding authorization system.
    Currently you can use the old concept of authorization (reporting authorization object) in the 7.0 2004s environment. You can set up in Tcode: RSCUSTV23 what authorization mode, you would like use. 
    When have you migrated whole queries but you keep the old concept, this doesnu2019t impact the authorization system functionality.
    When you change the authorization mode to current procedure with analysis authorizations, you need be careful with the attribute navigational. Because, in the old mode, the attribute navigational get setting of its characteristic. Example if you use 0COMP_CODE__0COSTCENTER, and de 0COSTCENTER is relevant authorization, all of attribute navigational com from 0COSTCENTER are relevant authorization. Otherwise, in current procedure with analysis authorizations, where each navigational attribute has the same level of a characteristic.
    When you migrate to analysis authorization, SAP best practice recommend keep in each reporting role all of reporting authorization object for a short period of the time.
    In my experience the main thing was list above.
    Try to get more information in:
    SAP BI - User Management & Authorizations
    OSS Note 923176
    I hope this suggestion can help you,
    Luis

  • Scenario in Analysis Authorization to check

    Hi Gurus,
    I am doing a POC for Migration of Analysis Authorization Migration. In which there isone scenario that we want to check.
    The Scenario is for Single user.
    User having access to 2 different Cubes:-
    Cube 1                                                   Cube 2
    Company Code:- XYZ                           Company Code :- *
    Now How can we acheive this scenario in Analysis Authorization.Please guide.
    Regards,
    Amit

    Try this
    AA #1
    0TCAACTVT                                               03
    0TCAIPROV                                                 Cube1
    0TCAVALID                                                 *
    0COMP_CODE                                             XYZ
    All other objects auth-relevant for Cube1   :
    AA #1
    0TCAACTVT                                               03
    0TCAIPROV                                                 Cube2
    0TCAVALID                                                 *
    0COMP_CODE                                             *
    All other objects auth-relevant for Cube2   :

  • Migration from BW 3.x to BI v7.0 Analysis Authorizations

    Hi All!
    We are converting our security from BW 3.x Reporting Authorizations to BI v7.0 Analysis Authorizations. My questions are as follows:
    We you make the IMG change in BI v7.0 in IMG transaction RSCUSTV23, does your old BW Reporting security disappear from roles or is it still there?
    Are there any other IMG settings, etc that need to be done in order for the new BI v7.0 Analysis Authotizations to work?
    If I ran a test query on a role that only had the old reporting authorizations after I switch the IMG transaction RSCUSTV23 to the new Analysis Authorizations, will it still run or should it just error out?
    thanks in advance for your help!

    Hi,
    Here are the answeres for your questions
    1) We you make the IMG change in BI v7.0 in IMG transaction RSCUSTV23, does your old BW Reporting security disappear from roles or is it still there?
    The old Reporting security disappears but the objects are still exists. If need you can switch back to the old concept
    2) Are there any other IMG settings, etc that need to be done in order for the new BI v7.0 Analysis Authotizations to work?
    RSCUSTV23 is the only setting need to be set to choose the authorization method
    3) If I ran a test query on a role that only had the old reporting authorizations after I switch the IMG transaction RSCUSTV23 to the new Analysis Authorizations, will it still run or should it just error out?
    Unless you create the Analysys authorizations (or do migrate) the authorizations are not affective.

  • How to Move Migrated Analysis Authorization across the landscape?

    Hi,
    we have migrated existing 3.x obsolete authorization concept to 7.x Analysis Authorization with the SAP delivered program RSEC_MIGRATION. Unit test is completed in the Development. What is the process to move the changes to quality.
    Any help is greatly appreciated.
    Thanks!

    Hi Tony,
    what about the roles that are updated during the migration process. How do I identify them and Do I need to collect them and transport too? Is there a way I can use the tables you mentioned in the above discussion for this.
    First you should decide on whether you wish to use direct AA assignment or use S_RS_AUTH authorization object (This is referred as indirect AA assignment).
    If you wish to assign AA directly, you doesn't require the roles to be transported and just need to transport the AA, since the AA works independently.
    If you with to implement indirect AA assignment, you should identify the roles (from the tables I've provided in my last post) and findout the roles based on query's. Further the AA that were related to the queries should be added using S_RS_AUTH and these roles require a transport.
    Hope this helps!!
    @Arpan - Those tables are required to quickly find out the roles Vs queries Vs InfoAreas/InfoCubes information to work on the AA.
    Regards,
    Raghu

  • Analysis Authorization (Role, Profile and Direct Assignments)

    <b>Analysis Authorization Question:</b>
    1)     In BW 3.x environment, customers have used Role Maintenance Process to assign proper object level security and then assign to the users.
    2)     Most of the places R/3 security team takes over support/administration function of BI Security and they continue to use Role method to assign “Reporting Authorizations” as per the process defined in BW 3.x system.
    3)     Customer sometime have 100 + Roles to have 3.X “Reporting Authorizations”. This is Managed, assigned, approved using role concept.
    <b>
    Migration Options:</b>
    1)     New Analysis Authorization makes process of Role Maintenance like "hierarchy authorizations" of BW 3.x. You have to create Value in other transactions and assign them in Role as a pointer or link object. With Analysis Authorization concept, Actual value of the Object Assigned “Like Company code 1100” not visible in Role Maintenance PFCG transactions. It is only visible in Transaction code RSECADMIN.
    2)     Analysis Migration Tool - RSEC_MIGRATION does not update “ROLES”. It creates or changes “PROFILES”.
    3)     Profiles are assigned to the users and Roles does not reflect any Impact by Analysis Authorization migration.
    <b>Questions</b>
    a)     This means customer need to update all the roles by hand. If they want to use Roles to manage the assignment of the Security to users. Migration Tool does not update Roles, it only updates PROFILES.
    b)     Does any one use direct assignment to Users? It is good business practice?
    c) Is <b>Profiles</b> recommended method of Authorization Maintenance?
    d) Can we run migration tool to create Analysis Authorizations, but not assign to the users as a Profile. But stop at creating Analysis Authorizations. If Customer wants to use Roles maintenance process then, they can do not have delete profile assignments from all users before updating Roles using Analysis Authorizations.
    Just want to check how other folks have done migration that can be supported going forward.
    Pankaj Gupta

    Hey Pankaj,
    In general, assigning the analysis authorization directly to user makes a lot of sense for granular levels of authorization. For example, if you had 3,000 users, 3,000 specific authorization combinations, and 3,000 roles, using roles is a lot of additional overhead. If you had 12 roles and 3,000 users, your role concept makes a lot of sense.
    Therefore, the recommendation is that it varies on what makes the most sense logically. Authorization groups can be created to group analysis authorizations and combine them. Also, you have the ability to generate analysis authorizations using the Content Datastores for this. That is an option as well.
    RSEC_MIGRATION does use profiles as you've stated. If you want, there would be manual work to convert to roles afterwards. In case you haven't seen Marc's presentation on security, it's pretty good and covers how to generate authorizations from the datastore.
    https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/media/uuid/ac7d7c27-0a01-0010-d5a9-9cb9ddcb6bce

  • Analysis Authorization mass maintenance

    Hi All,
    During the migration, due to Complexity of our complex BW 3.5 authorization setup we are end up in BI 7 New Design where we have to maintain new Cube to more than 150 Analysis Authorizations each time when we have new Cubes comes.
    Do you guys know any method where you can update the new cube to large no of Analysis Authorization (for ex 150) instead of doing manually? Due to complexity of the old design itu2019s very difficult for us to change the new design.
    Looking forward for expert opinion.
    BR,
    Deepak

    Hi,
    As per my knowledge, it is always recommended to maintain the Analysis authorizations individually. However, you may refer the below thread:
    Analysis Authorization Mass Maintenance
    and also the below link:
    http://help.sap.com/saphelp_nw73/helpdata/en/c4/057a2de519451faf1819dba4092887/content.htm
    Hope this helps!!
    Rgds,
    Raghu

  • Analysis Authorization Issue

    Hi:
    I created an analysis authorization ZCO_CODE to trstrict it by a company code.
    I added following objects in authorization with values.
    0COMP_CODE = 1000
    0TCAACTVT = 03
    0TCAIFAREA = *
    0TCAIPROV = *
    0TCAVALID = *
    Then I created a role Z:00:BW_REPORT, where I added following authorization objects S_RS_AUTH and restricted it by value ZCO_CODE. Then I assigned this role to a user test01.
    When I execute a program RSEC_MIGRATION for this specific user, I do not see authorization object ZCO_CODE on 2nd step of this program. Any Idea Why? I think this object should show up as I want to migrate this specific object.
    Help will be appreciated.

    Hi Sachin:
    Okay here is my issue.
    I have a Reporting authorization Object created earlier which is ZCOCODE. I though I'll have to create a new Analysis authorization object e.g. ZCO_CODE and then restrict it with other chars. as mentioned in Marc Bernards presentation and then you have to migrate it.
    In selection list I can see old Reporting authorization object. If I select it and use option "Enhance existing profile" then It will update profile and not role? right....
    How can I see whether it has updated existing profile?????
    Do I need to create new Analysis Auth. for Company code or I can use old Reporting authorization for company code?
    For testing purpose, I created a test user and assigned all reporting roles but It will not show up in RSEC_MIGRATION step???

  • Impact of Analysis Authorization on Users using old Authorization

    Hi All,
    I have question regarding Analysis Authorization. Our system has old authorization concept and as part of our project we decided to go for Analysis authorization for Cost Center object. We activated analysis authorization for cost center, assigned it to test user id and found that its working fine in Dev. But it has impacted other users in the system. They are not able to access any other reports and data providers which were not even referring cost center. What is the proper way to activate analysis authorization without impacting access to existing users.
    - Som

    Hello Andreas,
    Sorry to ask you directly here, I didn't get answer from this forum. We will migrate to the new analysis authorization from old reporting concept. I have read the book "An Expert guide to new SAP BI security features" by SAP Lavs, but still confused with some parts. My questions is:
    Are there two ways to create authorizations as follows?
    1. we can type tcode rsecadmin>Maintence button>create a new authorization.
    2. the following part taken from the book:
    Steps for Generating Authorizations
    1. Activate Business content
    2. Load Datastore objects
    3. Generate Authorizations
    4. View Generation Log.
    In the first step, OTCA_DS01 to OTCA_DS05 and OCCA_O01 to OCCA_O03 are Datastore objects required to be activated.
    In the second step, tcode rsecadmin-->generation button --> type OTCA_SDS01 to OTCA_DS05 into respective filed. Should we always type these 5 objects everytime when we create authorization?
    When we should use the second way to create authorizations? and what is the diffrence between them?
    Any answers will be appreciated. Thank you very much in advance!
    Haifeng

  • Issue w RSCUSTV23 Analysis Authorization System after upg from BW3.5 to BI7

    We set it to "Obsolete Concept with RSR Authorization Objects" and we do no understand why from the suddenly changes to
    "Current Procedure with Analysis Authorization" from no where - any ideas why from the sudden this changes by itself?
    still were not not migrating our security to the new version...we will do it around april...but in the meanwhile i would like ot understand why is happening by itself.
    thanks,

    Note that the logging will probably only help you if you activate it in the transport tool profiles (STMS) as it sounds to me as if imports of the customizing are making this setting.
    Did you set the value in DEV and transport it through or did you use one of the "BW utility reports" to change it (in which case you do not always have change documents and inconsistent customizing is "by design"...).
    Cheers,
    Julius

  • Problem wih analysis authorization for two scenarios on same data provider

    Dear all,
    I am looking for a solution on the following authorization scenario (using the new analysis authorization). Unfortunately everything that I tried did not work out as expected:
    User A is allowed to manually access query 1 (based on cube A) with authorization on all sites A-Z
    The same user A shall get an email distribution automatically (derivation of the filter in the query out of the authorization) for query 2, which is as well based on cube A, but this time the authorization shall be limited only to site A.
    As both queries are based on the same infoobject (0PLANT) and the same infoprovider (0TCAIPROV) I always get the result for all sites A-Z. The 0TCAACTVT is in both cases 03 (display), so I have no chance to distinguish between reporting and email distribution.
    Probably the only chance would be to derive the values for the email distribution scenario not from the authorization directly, but using a customer exit to fill the filter - but I would prefer a "standard" solution...
    Any ideas??
    Thanks,
    Andreas

    Dear Andreas,
    Before give you an alternative for you problem, Iu2019d like to comment the combining authorization concept:
    http://help.sap.com/saphelp_nw70/helpdata/EN/46/98cd87f37d19ace10000000a11466f/frameset.htm
    For this reason I suggest you which combing restriction through authorization and query filter. For query 2 try to use in 0PLANT characteristic the single value u201Csite Au201D, this restriction give you only authorization for see this value.
    Otherwise, you have to use customer exit.
    I hope that alternative help you to find a solution,
    Luis

Maybe you are looking for