More specific permissions assigned to user roles

We're looking for a new CMS like Bc, but it is lacking one thing that our current CMS has. We need to grant permission to only add or edit specific and simpler things like text and files on a page or module. This simplifies the UI for our clients and bullet proofs our wireframe and page designs. We don't want to grant them access to add modules to pages among other things. Is this or will this be possible in Bc?
There is also some UX issues where I did not grant access for the user to add a Web Form but the button is still enabled and shown. When the user clicks on it an Error is shown stating they don't have enough permissions for the action. In such cases the "Add a Web Form" button should just be hidden.
Thank you for any feedback.

Thanks Liam, for your quick response. I see what you mean with good training and site structure.
It's too bad though, these features would polish the UX for our clients (backend users), avoid us having to structure the site a certain way and simplify training. Maybe I'm asking for too much, but I think it'd be a key improvement on BC's service for us and other potential partners.

Similar Messages

Problem assigning internet user Role through portal

Hi All,
Please could someone help me with the following:
I am creating a registration process that creates a new CRM Business partner with contact person and internet user roles. When i run the Bapi from with in CRM everything works fine however when i run my jsp dynpage application and call the same bapi, the internet user that i create does not have any of the logon details or roles. Does anyone know why this is? i am using the same user when running in crm and the portal.
Many thanks in advance
Calvin

Hi Sunil,
Thanks for your reply. answers to your questions:
1. Yes, all portal users are maintained and have the same roles as CUA users. Portal authenticates against CUA.
2. Yes the user is created correctly on the backend. i have created a BAPI that creates users, BP's and assigns roles. This Bapi works perfectly when run in CRM but as soon as it is accessed via the portal the internet user role does not have all the required information.
Many thanks
Calvin

How to create new user and How can i assign end user roles

Hi,
I am new to SAP, please explain how to create end users and their roles
Thanks
ravi

Hi,
Roles are decided by IT managers. Suppose if Persons who are working in shopfloor or production side
give authorization to Production order create , change and Confirm like that etc
1. In role maintenance (transaction PFCG), choose the Authorizations tab page.
2. To change the authorization data for the transactions assigned to the role, choose Change Authorization Data or Expert Mode for Profile Generation. Otherwise, a dialog box appears in expert mode (see Regenerating an Authorization Profile After Changes).
Please take telp from Basis person also refer this link,
http://help.sap.com/saphelp_46c/helpdata/EN/52/6714a9439b11d1896f0000e8322d00/frameset.htm
Thanks

BW authorizations based on assigned PPM users/roles + inherited roles

Dear experts,
We using PPM 5.0 SP7, and we are having trouble defining authorizations for BW reports.
We would like to use the same authorizations as in PPM business client, so that BI would use/check the authorization from business client.
This check would include:
- users or roles gain access from direct assignment to an item
- users or roles gain access that is inherited in the bucket structure, both structure and classification buckets.
Users would have access to BW reports, but they could see data only from the same structures/classifications or direct assignments that are given to them in PPM business client.
Can we utilize the same authorization methods, or do we need to create and maintain this in another place (BW)?
If needed, how to create similar authorization model to BW?
Kind regards,
Antti Forsell

Hello,
Please see these docs,
[Field Based Authorizations in BW BEx Queries|https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/4753ed83-0e01-0010-e186-f98413f868cb]
[An Expert Guide to new SAP BI Security Features|https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/659fa0a2-0a01-0010-b39c-8f92b19fbfea]
[Advanced Features of SAP BW Reporting Authorizations|https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/1b439590-0201-0010-ea8e-cba686f21f06]
Thanks
Chandran

Help with adding a user copying permissions from another user $RoleDefinition.Name SharePoint 2010 Powershell

Hello,
I need to basically find everyplace 'ADUser1' exists and then add a new 'ADUser2' with the same permissions as the first group.
I have created a script that runs through an entire web app and finds everyplace the AD account is directly given access to and access via a group. I then need to add the new user and assign the permissions from the first ADUser, copy them. Below
is not the entire script, just where I'm trying to add the new user. The rest of the script works fine to find the first user. I'm stuck with this part: $role = $_.RoleDefinitions[$newRoleDef]. I get an error that I can call a method
on a null valued experssion.. I guess I don't know how to specify to copy the role from the first user, and use it to set the new user?
          #Get the Permissions assigned to user
           $WebUserPermissions=@()
             foreach ($RoleDefinition in $WebRoleAssignment.RoleDefinitionBindings)
                             $WebUserPermissions += $RoleDefinition.Name +";"
        $newRoleDef = $RoleDefinition.Name
          #write-host "with these permissions: " $WebUserPermissions
          #Send the Data to Log file
          "$($Web.Url) `t Site `t $($Web.Title)`t Direct Permission `t $($WebUserPermissions)" | Out-File C:\Apps\Scripts\Logs\UserAccessReport.csv -Append
    $assignment = New-Object Microsoft.SharePoint.SPRoleAssignment($account)
                $role = $_.RoleDefinitions[$newRoleDef]
                $assignment.RoleDefinitionBindings.Add($role)
                $_.RoleAssignments.Add($assignment)

Hi,
According to your post, my understanding is that you want to copy user permission to another user via PowerShell.
Instead of copy permission to another user, we can get the user permission, assign the permission to a group, then add the other user to the group. Now the user would get the same permssion as this user.
http://get-spscripts.com/2010/07/adding-groups-with-permission-levels-to.html
http://blog.thefullcircle.com/2013/02/create-a-sharepoint-group-with-permissions-and-add-an-ad-group-to-it/
We can also use the third-party tool to achieve the same scenario.
http://permissionsmanager.codeplex.com/
http://www.boostsolutions.com/blog/how-to-copy-permissions-to-other-users-in-sharepoint/
Thanks,
Jason
Jason Guo
TechNet Community Support

VL10 batch doesn't allow user role maintenance

A batch job to create deliveries is desired.
A user role was created using VL10CUA (copied from 5001).
Access VL10G to create a variant, but the User Role tab is completely display only.
According to OSS note 310022, step 2 indicates that user role can be maintained for background processing.
Currently using ECC 5.0. Why is the user role tab display only? What changes are necessary to create a variant using the new user role?
I also looked at the screen painter and the fields were "Possible" so that doesn't answer why they are display only when using VL10G.
Regards,
Bela

In VL10CUA, create a new user role from 5001 and click on Chg. Attributes and change F code to 5001.
Then assign the user role in VL10CUV to VL10 Scenario.
This will default the user role in VL10. Save the variant and then run VL10BATCH for the variant.

Use of "User Role" tab in T.Code - VL10G

Hi,
Can anyone help me in providing more information or document on "User Role" tab in T.Code-VL10G.
Rahul

This controls what type of documents are processed (orders vs purchase orders) and in what manner (i.e. actually execute delivery or just list delivery relevant items). Some key fields to note: Role, F. code profile, Dlv creation profile.

User role and Authority-check ?

Hello,
Could you please let me know how are the differences between User role and Authority-check. In a program I do not use Authority-check , And The user is not assigned to user role which contain this transaction ( for this program), Can the user execute this transaction OR he must be assigned to user role which contain this transaction to execute it . Supposing that we do not use any Authority-check in then program.
Thanks in advance

Hello Martin,
I think this answers the OP's question about user not being assigned the role which contains the trxn code. As you have explained in this case the default auth. check for S_TCODE will fail & user cannot execute the trxv. (If i remember correctly the tables for this are AGR_USERS & AGR_TCODES)
Anyways just to add to the OP's query. Auth. objects are added to profiles which in turn assigned to roles. So if you implement the auth. object in your program the user must also subscribe to the role containing the auth. obj. profile to be able to execute it.
@OP:
The transactions PFCG & SUIM might interest you. Also the tables dealing with these stuffs begin with AGR*. You can check the tables for better understanding.
BR,
Suhas

Authorization Assigned to User

Hi,
According to error message, I can't forward incident to SAP as a processor because of lack of authorization.
Right now, I'm having an issue regarding authorization assigned to each user.
I log on as my own ID and password and try to assign authorization.
There's no more authorization being assigned under user ID I'd like to assign.
I've done with the existing authorization and mark all I can assign.
Can anyone give me a favor for this issue?
Thanks

Hi George,
All related information for the above can be found here:
https://websmp104.sap-ag.de/instguides
 > SAP Components
 > SAP Solution Manager
 > Release 7.1
 > 4. Operations
> choose your SP level for
Security Guide SAP Solution Manager 7.1.
Regards,
Ruth

Assign user role to network group people

Hi everyone,
What user role should I assign to network people if they wan to be able to discovery(add) and manage their network devices by themselves. I have tried Advanced Operator and Operator two roles, but non of them came up with Discovery Wizard option. I really don't
want to assign them to Operations Manager Administrators group because I'm pretty sure they will mess up SCOM within couple mins!!!!!

Hi,
We can create runas account for discovery with the network discovery wizard, the runas account type is community string only.
Network devices that use SNMP v1 or v2 require a Run As account that specifies a community string, which acts like a password to provide read-only access to the device.
Regards, Yan Li
Hi Yan Li,
After reading your post couple times, I'm confused now. I did have two run as account created for community string and snmpv3 authentication. When I ran Discovery Wizard for network devices, I can select either one of them to run without problem,
and discover network devices. My account is under Operation Manager Administrators role, so I have full permissions to do anything I want.
My question is that how to configure or create User Roles for network group people, so they can also run Discovery Wizard and manage their network devices without putting them into Operation Manager Administrators group. Ex: there is not Administration
tab for them, they only see Network Monitoring folder under Monitoring. Because I don't want them to mess up those options under Administration.
Is it just like the previous post said that only two options? Thank you.
1) grant them as a SCOM administrators right
2) scom administrator help them to do network discovery

User with 2 permissions assigned via groups, not able to utilize the higher privilege

User has been assigned Publishing Editor, this was assigned by being a member of a group, where group's permission is publishing editor.
In addition, the user has been assigned Reviewer, this also was assigned by being a member of a group, where group's permission is Reviewer.
The issue: The user can only perform functions related to the Reviewer role, and can't perform functions available via the Publishing Editor.
Any Ideas what is going on?
*Removing the user from the Reviewer group is not an option.

Hi,
The easiest way is to grant the single user Publishing Editor permission of that folder directly, check if the issue persists.
Right click on the folder, Properties -> Permissions -> Add the user with Publishing Editor permission.
Regards,
Melon Chen
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs.

Error While Assigning Approval Management Roles to User

Dear All,
While assigning "Approvals Management...." Roles to the user through User management responsibility and Click on to Apply Button I am getting following Error.
oracle.apps.fnd.framework.OAException: java.sql.SQLException: ORA-01403
ORA-06512: at "APPS.UMX_ACCESS_ROLES_PVT"
Can anybody help me to get rid of this error.
Thanks In Advance
Jithindev

Hi,
Standard roles are not assigned to users directly.Make sure that copy the role from standard roles then change naming convention like your company specification.
Ex: standard role : SAP_BC_JSF_COMMUNICATION_RO
Step:1: go to t-code: PFCG and give the role name in role tab SAP_BC_JSF_COMMUNICATION_RO
Step:2: press copy button and change the naming convention.
Step:3: Assign to the user.
I hope it will help you.
kiran kumar.v

Error while assigning the fallowing role to the user

Hi,
ERROR 2007-01-18 14:13:25
CJS-30196 Role SAP_BC_JSF_COMMUNICATION_RO is not assigned to user SAPJSF
i am getting the fallowing error while trying to assigning the fallowing role to the user any body through some light in to it.
Thanks
kiran.B

Hi,
Standard roles are not assigned to users directly.Make sure that copy the role from standard roles then change naming convention like your company specification.
Ex: standard role : SAP_BC_JSF_COMMUNICATION_RO
Step:1: go to t-code: PFCG and give the role name in role tab SAP_BC_JSF_COMMUNICATION_RO
Step:2: press copy button and change the naming convention.
Step:3: Assign to the user.
I hope it will help you.
kiran kumar.v

Unable to assign all security roles to a user with a new custom security role

Dear All,
Happy New Year.!
I have a query regarding the assignment of Security Roles to new users in CRM. Normally we assign the security roles to new users via an Admin user who has 'System Administrator' security role assigned to him/her. This works perfectly fine, and we can assign
any desired security role to the new user.
However, in our case, we need to delegate the user creation rights to some of the client partners. We do not want to give them access to all the Administration functions; hence we created a new Security Role, lets say 'Support User Role'. We have provided
'Create', 'Append', 'Append To', and 'Assign' rights on 'User' entity for this new security role. With this security role, we are able to create new users now, but we are only able to assign 'Agent' security role, not any other security roles.
For example, if user 'x' has Security Role defined as 'Support User Role'. If 'x' tries to add a new user 'y', then 'x' is only able to assign 'Agent' security role to 'y', but not any other security role. As per business requirement, 'x' should be able
to assign some other security roles, including 'Support User Role', to new user 'y'.
I believe that there is something missing in Security Role configuration, which is causing the above problem. We compared both 'Support User Role' and 'System Administrator' security roles, but not able to figure out which minimum rights we can provide to
'Support User Role' so that users with this security role can only add new users (with any security role), and that they are not having access on any other Administration features as well.
Appreciate any help that you can provide on the above issue.
Thanks in anticipation.

Hi,
Can you check if you have organization level Read access for Securitity Role and Organization level Assign access for Security role.
Refer:-
http://www.magnetismsolutions.com/blog/paulnieuwelaar/2013/04/22/permissions-required-to-manage-roles-in-dynamics-crm-2011
Hope this helps!!!
Thanks,
Prasad
Make sure to "Vote as Helpful" and "Mark As Answer",if you get answer of your question

Portal: Tab displayed but not assigned to any roles of user

HI Experts,
I have a problem need your great help.
When I logon portal as a specific user, there are 5 tab in home page. When I check the role list, 3 tabs doesn't assigned to any roles this user owned.
Then I try to copy current user into a new user, and logon in . There are only 2 tabs left, which belonged to assigned role.
How those 3 tab assigned into this user? Can we assign iView/Page/Workset directly to user without role?
Any suggestion appreciate. Thanks so much!
Edited by: Jalyn Liang on Nov 13, 2009 9:29 AM
Edited by: Jalyn Liang on Nov 13, 2009 9:30 AM

Jalyn Liang ,
You can find if the user id belong to a particular group with the following ways,
Log in as an admin and go to User Admin -> Users- > Seach -> Enter the user Id and serach for the user -> Select the 5th icon with the tool tip ->Assigned Groups"
or
User Admin -> Group -> Search for the group.
or
You can use UME API to find out whether the is belowng to a group though coding.
Ram

More specific permissions assigned to user roles

Similar Messages

Maybe you are looking for