Need organization level object

HI,
I am want to insert organization level in this S_ALR_87012294 report,
but in PFCG->Authorization->authorization change show no organization level,
is there any authorization object for giving organization level.
Best Regards
Dilip Pasila

The note says that you can apply it as a "download" via SNOTE ahead of the Support Pack (level), or apply the whole Support Packs up to that level (which will include the "corrections), or you can install a brand new ERP system on the highest current release and SP stack.... but in all cases the checks are not performed against these objects until you modify the code in a SAP standard include program to activate the check.
I can understand backward compatibility with existing role concepts, however a "normal" procedure to not perform such new checks is an approach something like the default values of PRGN_CUST are used for, where you can activate the checks via customizing views (for each of the three objects independently) when you need them or discover the gap. Then in some higher release you can switch the defaults to "ON" if the requirement / opportunity is there.
It also makes it easier to implement, transport and perform cross system comparisons of settings.
Forcing customers to make a modification to the standard system at each installation to close a security hole is about as elegant a software logistics solution as a frontal lobotomy is to peace of mind...
I will add this to the [Security Functionality Wishlist in the Wiki|https://wiki.sdn.sap.com/wiki/display/Security/SecurityFunctionalityWishlist-Topics] and suggest you check your systems to see whether your F_BKPF_BE* object security has a hole in the bottom of the bucket.
For me it is self-explanatory that this should be changed, but the inventors of it wanted to know whether it is just me or possibly a whole mob out there wanting it (and possibly not knowing about it either).
Cheers,
Julius

Similar Messages

"Setup encountered a problem while validating the state of Active Directory: Exchange organization-level objects have not been created, and setup cannot create them because the local computer is not in the same domain and site as the schema master. Run se

Team,
I am trying to Install Exchange on my Lab, getting below error
message.
The Schema Role is installed on Root Domain and trying to install
exchange on Child domain.
1 Root Domain - 1 Child domain. both are located on single site.
“Setup encountered a problem while validating
the state of Active Directory: Exchange organization-level objects have not been created, and setup cannot create them because the local computer is not in the same domain and site as the schema master. Run setup with the /prepareAD parameter and wait for
replication to complete.”
Followed below articles:
http://support.risualblogs.com/blog/2012/02/21/exchange-2010-sp2-upgrade-issue-exchange-organization-level-objects-have-not-been-created-and-setup-cannot-create-them-because-the-local-computer-is-not-in-the-same-domain-and-site-as-the-sche/
http://www.petenetlive.com/KB/Article/0000793.htm
transferred the schema roles to different server on root domain, still no luck.
can someone please help me.
regards
Srinivasa k
Srinivasa K

Hi Srinivasa,
I guess, you didn't completed the initial setup schemaprep and adprep before starting the installation. You can do it as follows:
1. Open command Prompt as administrator and browse to the root of installation cd and run Setup.exe /PrepareSchema /IAcceptExchangeServerLicenseTerms
After finishing this,
2. Setup.exe /PrepareAD /OrganizationName:"<organization name>" /IAcceptExchangeServerLicenseTerms
3. To prepare all domains within the forest run Setup.exe /PrepareAllDomains /IAcceptExchangeServerLicenseTerms. If you want to prepare a specific domain run Setup.exe /PrepareDomain:<FQDN of the domain you want to prepare> /IAcceptExchangeServerLicenseTerms
4. Once you complete all of the 3 steps, install the pre-requisities for Exchange 2013
5. Finally, run the setup program
Hope this will help you
Regards from Visit ExchangeOnline |
Visit WindowsAdmin

P_ORGIN object - converting VDSK1 field to Organizational Level field

Hi there,
SAP ECC 6.0 SAP_BASIS 701 0007 SAPKB70107 SAP Basis Component
Looking for input on changind the VDSK1 field in P_ORGIN object to Organizational Level field to use Role Master and subroles(derived) concept. We currently maintain a separate role for each set of Cost Centers and infotypes. On occasion the infotypes
change but means a great deal of manual changes for each P_ORGIN defined role. Our approach is all within the P_ORGIN object - no structural auth in place. Any input or experience appreciated. We separate the functional part of the HR acess in one role tcodes/other objects and separate the master data access p_orgin in another role - which is different for each user.
Thanks !

Dan,
I hope you already heard about PFCG_ORGFIELD_CREATE, using this we can convert auth field into a org field.
There are snotes aswell on this. Please do a search in SMP.
Thanks,
Brahmeshwar.

TEMPLATE FOR ORGANIZATION LEVEL ROLE

HI.
I HAVE MYSAP ERP VER 5.1 . BUT I DONT HAVE HR OR IDM IN MY SYSTEM.
I CREATED A ROLE FOR TRANSACTION FK01 AND FK02. IN THE AUTHORIZATION OBJECTS PUT VALUES 01 AND 02 FOR ACTIVITIES FIELDS AND ORGANIZATION LEVEL WERE LEFT WITH BLANKS.
I CREATED OTHER ROLE WITH THE SAME AUTHORIZATION OBJECTS CREATED MANUALLY WITH ORG LEVEL IVALUES IN THE AUTHORIZATION OBJECT AND NO VALUES IN ACTIVITIES FIELD
THE OBJETIVE IS MERGE BOTH ROLES WITH ADDITIVE EFFECT IN A USER ACCOUNT TO REDUCE THE NUMBER OF DERIVED ROLES.
BUT THIS DESIGN IS NOT WORKING PROPERLY. I NEED TO NOW WHY?

Hi,
As per your query you create a new role and assign to these objects value in the new one.
Anil

Authorizations....Sales organization level

Hi all
I want to create the authorizations for the sales organization level. I have made the Sales Organization Object authorization relevant. After that i created an authorization object based on the Sales org object. I created a roles and created a profile based on the authorization object which i created. i assigned the role to the user.
Now when i execute my query in web it is saying that
'No Authorization (Or Everything is Filtered Out)'
On the top of the query execution it is giving me a message as
'You do not have authorizations for component 0CRM_OPMO_Q001'
Now i would like to know, when we create profile in the role, do we need to add any other authorization objects apart from the one which we created. If so, what options do i need to give.
And second when we create a test user for the authorizations testing, what roles we need to give him, one would be the one which we generated. And what are the other roles the user will have.
Please help
answers would be rewarded
regards
vijaykumar

If sounds like you have another authorization object
"checked" on the infocube/ODS.
To check this, you have two options.
(1)RSSMQ, with the user id. Execute the query, then back up (using the green arrow). One page on the back up operation with give you what authorization objects are checked.
(2) Go to transaction: RSSM and enter the infoprovider. Uncheck the authorizations you don't want to have verified.
Also, you on the variable for the authorization object (query) you must enter a value here if you do not have an "*" object.
Cheers!
/smw

Organization level

Hi gurus
How can I get that an authorization object appear like an organization level?
Christian.

Hi Pole Li
Thanks for your help, I manged to create program to fetch from Organization level , Is that possible to see the description for Authorization-low and Authorization-high from any tables
As you wrote ,v can get description of Org Level from USVART , Like that if we need the same for Authorzation-low and High resp .
Regards
Piroz

DIR Authorization by Organizational Level

Hi fellows!
I would like to know if it is possible restrict access of DIR by organizational levels?
Example: I need that if User A from plant 1234, creates a DIR type AAA number 0001, the User B from plant 4567 shouldn't have to access this DIR type AAA number 0001. I want that the users only can access the DIRs created by the plant which they have access.
In the master roles of DMS I didn't find any object to help me in this scenario. I dont want to use the ACL to restrict the access of the documents. I want that this restriction has to be done by authorizations rules as in other areas.
Can someone help me with some idea or case about this?
Best Regards!
Daniel
Edited by: D Quintal on Nov 25, 2010 5:43 PM

Hi Daniel,
Its quite possible to achieve your requirement.
There is a field called 'Authorization group' in a DIR if you have observed.This enables you to restrict authorization at Document level in addition to authorizations at Document Type and Status level.Suggest you create Authorization Groups like Plant1234,Plant4567 and so on with the help of your ABAPer.Now assign the required users to these Authorization groups.
Once implemented,whenever a DIR is created and specific Authorization group is assigned, only those users part of this Authorization group will be able to process/access this DIR.Hope this addresses your requirement.
For details on implementing Authorization group in DMS,refer link,
http://wiki.sdn.sap.com/wiki/display/PLM/UsingAuthorizationGroupfieldin+DMS
Regards,
Pradeepkumar Haragoldavar

How to keep an application level object running with SunIDM?

We are working on intergrate a gmail project with SunIDM. We need an application level object running with SunIDM so it will maintain a token generated from Gmail side. In anther servlet project, I had this object saved in the attribute of the ServletContext, then other session level servlet could share this attribute anytime. Is there a way to store attribute in Servlet Context and have it shared by different user session in SunIDM? I have been reading documents and searched this forum, haven't find any topics related how to maintain an application level object live. Hopefully that I can get some hint here.
Thank you so much.

Paul, Thank you so much for the further explaination. I don't think it will work since the token generated from gmail will expire every 24 hours.
We are using the gdata library published from by gmail people, and I create a new UserService object and have it run in the application level. The UserService object will generate a token and renew it every 24 hours behind the scene. Here is how I implement it in my Servlet project:
//to have a UserService object running at the application level:
public class GmailUserService extends HttpServlet {
public void init(ServletConfig config) throws ServletException{
super.init();
userService = new UserService(myApplication);
config.getServletContext().setAttribute("gmailUserService", userService);
//to access this UserService object from other servlet in each user session:
UserService userService = (UserService)servletContext.getAttribute("gmailUserService");
Gmail will trigger an error if we create a new UserService object for each user. They recommend to have all the user to share one UserService object. I am looking for similar approach in SunIDM.
Thank you again, Paul, for trying to help.

Storage location on basis of Plant in organization level in MM01

Hello,
Here is the scenario.. I select a material in mm01 and click on the 'Organization Level' tab. In this tab(on the basis of view selection, i get Plant and Storage Location) , i give in a Plant, lets say suppose 1000. Now if i press F4 on the Storage location, instead of displaying all the location, can it display the stor.location of the specific plant, i.e 1000. Is this possible and if yes and then how to do it ?
Help Needed Big time.
Thanks,
Shehryar Dahar

HI,
yes it is possible.
use "F4IF_INT_TABLE_VALUE_REQUEST"..
example
FORM f_get_str_value .
SELECT lgort from MARD
    where werks = <your valuewerks>
into <IT_table>.
CALL FUNCTION 'F4IF_INT_TABLE_VALUE_REQUEST'
    EXPORTING
      retfield         = l_c_fieldname
      dynpprog         = sy-cprog
      dynpnr           = sy-dynnr
      dynprofield      = l_c_dynprofld
      window_title     = text-078
      value_org        = 'S'
      callback_program = sy-cprog
    TABLES
      value_tab        = <IT_table>
    EXCEPTIONS
      parameter_error = 1
      no_values_found = 2
      OTHERS           = 3.
IF sy-subrc <> 0.
MESSAGE ID SY-MSGID TYPE SY-MSGTY NUMBER SY-MSGNO
        WITH SY-MSGV1 SY-MSGV2 SY-MSGV3 SY-MSGV4.
ENDIF.
ENDFORM.
regards,
nazeer
reward if useful

Help - Item Assignment at Inventory Organization level from the Interface

Hi,
I have developed an Inventory Item upload Interface (MTL_SYSTEM_ITEMS_INTERFACE Table) for Oracle Apps R12.
It works fine in uploading the Items to Master Org which the template is created. But When I tried to upload at Inventory Organization level it returns an error says 'Template or Template ID is not assigned for the Organization'.
How can I assign/upload the Item at Inventory Organization Level? I have already tried the Organization Item Assignment Report, It works fine and assign the Items to relevant Organizations. But the parameters are Item Range which I cant use those parameters.
Please help me to Upload items at Inventory Organization level from the Interface.
Thanks

open any delivery.
1. select any delivery item number( double click).
2. go to text tabstrip of the item.
3. select the text type and double click on the blank space where we write some texts will give you new screen for writing text will give you text screen.
then in menu: goto->header will popup screen with details given below.
text name: delv+item num
Language: 'EN'
text ID: '0001'       " for first text type and so on.
Text Object: 'VBBK'
****CODE.
data: ist_text type table of tline,
      wa_text type tline.
CALL FUNCTION 'READ_TEXT'
EXPORTING
   CLIENT                        = SY-MANDT
    id                            = 'textid'
    language                      = sy-langu
    name                          = 'textname'   " its concatenation of Dlv no. and item number.
    object                        = 'VBBP'
tables
    lines                         = ist_text
EXCEPTIONS
   ID                            = 1
   LANGUAGE                      = 2
   NAME                          = 3
   NOT_FOUND                     = 4
   OBJECT                        = 5
   REFERENCE_CHECK               = 6
   WRONG_ACCESS_TO_ARCHIVE       = 7
   OTHERS                        = 8
IF sy-subrc <> 0.
MESSAGE ID SY-MSGID TYPE SY-MSGTY NUMBER SY-MSGNO
        WITH SY-MSGV1 SY-MSGV2 SY-MSGV3 SY-MSGV4.
ENDIF.
Reward points if helpful.
Regards
Ashok

How to find top level object on a given layer?

I need to assign it to a var...
var topLevelObj = app.activeDocument.layers.name("foo")... whatever is on top of that stack...
...this is probably not correct but you know what I mean

Jump_Over wrote:
Hi,
top level object is the first in a collection:
var fooLayerTopObj = app.activeDocument.layers.item("foo").pageItems[0]
Jarek
I'm not very good in ID-scripting, but I think this isn't good enough to find topmost item of a layer.
Why?
- create a new document
create a polygon
create a rectangle
create an ellipse
create a line
Run this script snippet:
var pI = app.activeDocument.layers.item(0).pageItems;
for (i=0; i<=pI.length-1; i++) {
pI[i].select();
alert (i);
pI[i].locked = true;
Do you see, which element pageItems[0] is?

Adding the organization level to one Role

Hi Experts,
                I have one role in PFCG, this role contains
some authorizations.
These role maintain the role.organization level values also.
now i want to include one organization level to this role
for example
                   company code----
> *
                   purchasing group------> *
                   division----
> *
now i want to add "Work center"
how can i include? is there any option is there?
Thanks is advance
sundar.c

Thanks for the Doc. This will be my Plan B.
I am still researching on How to Directly publish to Portal. I was able to do that from Query Designer using Publish to Portal and the report shows up as an iview in a PCD folder in the Portal. The Endusers have only Business Explorer Role and all they can see is the the Busineess Explorer tab of the Portal. So, I need to figure out a way to assign the iview to End user role.
In one of the threads,
Prakash Darji suggested
"The "publish into Role" from WAD saves to BI Roles which doesn't help you in web deployment, so I typically don't use this. I usually "Publish to Portal" and then will add my iView on the portal to a portal role that users are assigned to. This would make these iViews available to users on the portal. "
I am going to assign points for your suggestion though.

Changing Organization level for derived roles

Dear All,
Below is my query:
When there is any requirement to change the organization level of a derived role, we go to the role and change the organization level manually.
We have derived our roles, based on the units(company codes).
Now we have a scenario, where we need to add one unit in a particular derivation of all roles.
Please suggest if there is any way of updating the organization level in mass for a specific derivation.
Regards,
Reshma Vijayan.

Colleen Lee wrote:
At least with this option you are using the PFCG functionality and not hitting the tables directly
Hi Reshma, Colleen,
Some additional warnings about manipulating the downloads:
The downloadfile is a fixed record length text file, do not mess up the data positions.
Be aware of case (upper/lower) when manipulating the file.
Make sure you do a unicode download to preserve special characters in the menu texts.
There are very, very few checks done on the file contents when uploading again. It will allow you to pollute your AGR* tables in such a way you'll need an ABAP-er or SQL-savvy colleague to clean up the mess. It is very close to manipulating the tables directly.
I once managed to get entries into AGR_1251 which didn't show up in PFCG and wouldn't even disappear from the tables after I had deleted the roles in question.
And yes, I still use this method, but I won't advise it to anyone I cannot personally train to be aware of the pitfalls ;-)
Jurjen

Setting item attributes at organization level

where do i set the item attributes at organization level.
i just need the navigation path to set
regards
sudharshan

Inventory--Items--Organization items OR
Inventory--Items--Master Items-->Tools--Organization Assignments
Thanks
Nagamohan

How to add field to organizational level?

Hi Experts,
I want to add personnel area (PERSA) fied to the organizational level, what is right steps to do it?
Thanks a lot
shaoming

Hi,
This is answered in the FAQ's at the top of the forum. Please take a look there and if you need further clarification, let us know.
Cheers
Alex

Need organization level object

Similar Messages

Maybe you are looking for