New Org Level impact in existing roles

Hi,
I would like to set/create 2 fields as organizational levels. For example KLART and DOKAR. Checking these I realized there is a big amount of roles "affected" by this change.
Because I plan to use the organizational level only for new roles , I would like to know which impact could have this change for existing roles, should one modify the existing roles after creating the Org Levels ? or in contrast they still work as always an no changes / adjustments is needed?
Thanks and regards
FedeX

Thanks Bernhard,
I have a question
As I mentioned before my goal is that the existing roles keep working after running that program... and do not want to perform any adaptation....only if there is a real error that avoid work correctly.
In these 2 cases the role will keep working properly ( I mean restricting in the way that it uses to do).
1) In case field is copied to the Orglevel area after running the program and the value(s) will stay in both places (OrgLevel and Original place)
2) In case field is NOT copied to the Orglevel area after running the program but the value still in the original place .
right?
Thanks
FedeX

Similar Messages

How to create new org.level and further actions?

Hi experts!
I need help on the follwing situation.
For better separation of industries for the marketing staff we do use the branch (e.g. food, energy, ...).
For that we want to adjust the authorizations to branch specific.
The questions are:
1) Is it possible to create a new organisational level "branch"?
2) If I have a new org.level I think I have to adjust existing authorization objects. Do I only have to extend the belonging auth.objects with the new org.level?
3) What else do I have to do if a new org.level branch is created to check authorizations on that?
Thanks for your help in advance.
Regards,
Alex

If I read your question correctly I think you want to create a new authorization field. To get that to work you'd need to adapt a lot of software. Definately not a path to follow.
All authorization cheecks need to hard-coded into the software. Changing SAP standard software is something one wants to stay away from as long as possible. It'll keep haunting you when patching, upgrading etcetera.
If you want to 'upgrade' an existing field to become organizational a forum serach on PFCG_ORGFIELD_CREATE should give you pointers.

Question on org level values in derived roles

I have a set of derived roles for a retail org.
They have set the org level for the WERKS object to the store number i.e. 0012. in the M_MSEG_LGO, M_MSEG_WMB, and M_MSEG_WWE but set it to "" in the M_MRES_WWA and M_MSEG_WWA. Needless to stay the "" is overiding the site restriction.
My question is, how can they allow store to store transfers and goods issues for other sites but only do POs and goods receipts for their default store?
If the transactions in the role are using the same object, it doesn't seem like it can be done but I am told it can! I can't figure it out. Can anyone assist?
Thanks

If you are talking about straight authorization object ( then your design cannot go with derived role concept )
If your controls are only through the organizational object only then derived role design will help
If its a mix of both standard object + organizational level object derived role will not help you.
Please note
the WERKS is the organization level in your case the plan value is 0012
do not set the values in parent role and also do not populate this value were its "$werks"
what is TCODE you are using ?
Edited by: Franklin Jayasim on Jul 21, 2010 11:45 PM

Create new user same as a existing roles and Privileges

Hi Team,
I am a junior DBA. New user Joined in Application team. So, Client requested me.....
Crerate new user with same privileges as like as existing user.
As of now i am creating user like "create user username identified by "password". Then grant privileges to that user. earliar I never comapare or copied users.
Please suggest any one how to create new user as like as existing user roles and privileges.
Thanks,
Venkat

For basic cloning:
select dbms_metadata.get_ddl('USER', '...') FROM DUAL;
SELECT DBMS_METADATA.GET_GRANTED_DDL('ROLE_GRANT','...') FROM DUAL;
SELECT DBMS_METADATA.GET_GRANTED_DDL('SYSTEM_GRANT','...') FROM DUAL;
SELECT DBMS_METADATA.GET_GRANTED_DDL('OBJECT_GRANT','...') FROM DUAL;
SELECT DBMS_METADATA.GET_granted_DDL(‘TABLESPACE_QUOTA’, ‘...’) FROM dual;
Then just replace the username with the new one you want to create.

Side - effect of new org level

Hi,
we have parent - derived role concept.
few roles were added to the system ( 4.6 - > 700) "upload"
now in 4.6 system one field was maintained as 'org level', which is not in our system (WAS 700)
uploaded have value $FIELD , however this field is maintained in our system as FIELD with value *
now if i create FIELD as org level in my system, what are the side effects...
please advice.
regards,
Surpreet

Martin,
thanks.
please advice what is purpose of checkbox 'Test Mode'..
regards,
Surpreet
Going through SAP note 323817 & 754836........... also
Edited by: Surpreet Singh Bal on Oct 28, 2010 12:00 PM

HT5616 Will new apple id impact on existing files?

My email address is expired because i am retired from my company. So i want to change my Apple id. Is there Any affect on my existing files in keynote, pdf, ibook, etc? And how to change apple id?

I will make this clear - DO NOT CREATE A NEW APPLE ID!
CHANGE the email associated with your current Apple ID or you will create headaches you will hope never to recover from. :-)
Before following the instruction JimHdk provided, be sure to also create security questions if you haven;t already done so, and add a recovery email address. This is insurance in case something goes wrong. I really suggest you do not skip these two steps.
Good luck.

GRC BRM: Update Org Levels of derived roles

Dear GRC experts,
we are using the GRC BRM Master Derived concept and have around 100 Master roles in place.
I understand that the Org Levels of derived roles are only once set per Org Value Map during the initial (Mass) Derivation.
If we add a transation like VA01 to a Master role this also adds some new Org Levels to the Master role. Via "Propagate to Derived roles" the new transaction and object values are added into the Derived roles.
For the new Org Levels these are added also but the values are not the one from the Org Value Map of the Derived role but exactly the same values of the Master Role.
Using "Derived Role Org. values Update" does not help us here to update the corresponding Derived roles as no change to the Org Value Map has been done.
In case a Master role has 40 different Derived roles associated this would require to update manually any of the Derived roles for adjusting the new Org Levels.
Does anybody know how to automate this task?
Many thanks for your help!
Regards,
Markus

Hi Markus Richter
Once you maintain the imparting role and propagate to the derived role, the derived roles will inherit the new org values from the imparting. So that at least has the org values in the derived roles but not the correct values
Next up is to try to use the Mass Maintain Roles to update the derived roles with correct values from the org map (ensure org maps were updated first) mentioned in post
Mass Child role Org value update in GRC 10
Does this work for you as an approach?
Regards
Colleen

Authorization in APO: org level concept (parent role -- derived role) ?

Hello experts,
we want to introduce some authorization / roles in APO using the typical R3 concept of having a "parent role" and derive "single roles" from such a parent role and change the "org levels" inside the single role. Testing this with master data objects like C_APO_LOC (location in APO) it seems to me that APO doesn't know about "org levels".
Whenever I create a parent role (lets say "Z_PAR_ROLE_LOC_MASTER") to access /SAPAPO/LOC3 (Location master data) and create a single role out of it (derive it into Z_SINGLE_ROLE_LOCMASTER_1234") and enter the location ID 1234 ... regenerating and populating a change from the parent role "Z_PAR_ROLE_LOC_MASTER" does immediately wipe out the location ID 1234 maintained before in the single/derived role "Z_SINGLE_ROLE_LOCMASTER_1234".
My question: is this by design that APO does not know about "org levels" or is there something special I have to consider using PFCG correctly in SCM (I can see the "Org Level" button but it says there are no org levels) ?
Regards
Thomas

I got the solution - the profile generation was missing !

Basic Information about Organizational Level & Org. level value.

Hello Experts,
I am new to the field of SAP and security. I have the following questions:
1. What is an organizational level & org. level value? What do they represent? How do they matter in PFCG?
2. What is a derived role and what is its usage?
I appreciate your help regarding this. If you could point me to some documentation regarding this that will be very helpful.
Regards, Ben

Ben,
I am new to the field of SAP and security. I have the following questions:
1. What is an organizational level & org. level value? What do they represent? How do they matter in PFCG?
if you want to restrict on region vice (best use org level & values (plant,company code, sales org)
In role u will notice them in red color
2. What is a derived role and what is its usage?
Derived role inherits menu struture and the function from the parent role. Derived role do not differ in their functionalities(identical menu & trans) but have different characterticts with regard to Org levels.
Eg1; Master role
PFCG -> role name -> create->menu->enter tcodes-.Auth tab->export mode->read old status and merge with new data->Pop for org levels (give a full access)->see to that everything is green->generate it.
http://e-mory.blogspot.com/2007/12/sap-pfcg-create-role.html
Eg2: Derived role
pfcg->role name->create->in describtion tab towards right enter the master role name->Auth tab->export mode->read old status and merge with new data->you will get a pop for org levels (here you can restrict on plant lvel,purchasing group,company code....)
->let say for plant : 1000 ->generated / user comparssion
Once the role is added to the user. User will be albe to see only those plant related details (1000) (i.e he will have access to only plant 1000)
suppose if the user enters 2000,he will get a error message saying no access to 2000
NOTE: Any changes to the role should be done in master role (like adding tcodes)
.http://www.rssfeeddirectory.org/directory/items/346239.aspx
https://cw.sdn.sap.com/cw/docs/DOC-12021
http://help.sap.com/saphelp_wp/helpdata/en/1c/c38028816c11d396bc0000e82de14a/content.htm
Re: Authorization error after transport
Thanks,
Sri

Mass role Import in ERM "unable to determine matching org. level" Error

I am trying to upload the Derived Roles into the ERM. I have already uploaded all the Parents Roles. The volumes of the Derived Roles is huge in my SAP Backend system.
I am not able to understand what should be the content of Org File which we upload. Please correct if I am wrong
1>Example a role Z_TEST_D is derived from Z_TEST on the org levels EKGRP,KOART,GSBER,WERKS.
2>I have run Org Synchronization Job in the ERM
3>Downloaded Z_TEST (Parent Role) and uploaded it into ERM(It was easy because there was no org file)
4> Downloaded Z_TEST_D(Derived Role) through /VIRSA/RE_DNLDROLES Tcode in backend.
5>Downloaded the AGR_1252 information for this role which contained the Org levels and values
6>I put all those information into the Org File and then tried to upload it throws me the error Role Z_TEST_D : not imported; unable to determine matching org. level for WERKSin the system
So I again tried with the another method by changing the input sheet for the Org File
Z_TEST_D BUKRS 0* 9*
Z_TEST_D EKGRP *
Z_TEST_D KOART *
Z_TEST_D GSBER *
Z_TEST_D WERKS *
and tried to upload it again gave me the same error. I have checked the ERM all these Org Levels are fetched into the ERM. I am not sure if I am missing any basic things.
Current Support pack: SP10 Hot Fix 2.
Please share your experience and best practice to upload the roles,

Hello Rahul,
I had that same problem with SP10 also. The way I resolved itand this sounds crazywas to move that WERKS line up one or two rows.
The problem I noticed was not with all derived roles, but when there was a problem, it was always the last line of the Org file for the role that was causing the problem. And the problem was not always WERKS either.
If the next time you run it, the error occurs on the "new" last line (e.g. GSBER), move that line up also. Eventually they all make it in. I have not seen this problem repeated in SP12. Don't delete the line, just shift the order within the number of rows the role has.
P.S. I have several hundred derived roles, about 10 - 15% had this import problem.
-Dylan

How to distribute new object from org level

Hi Expert,
I'm trying to create a new object: MATKL to org level through program: PFCG_ORGFIELD_CREATE. But I find there are only distribute to all roles. Could you advice if it can be distribute by selected role instead of all roles? Any advice on hierarchy problem?
Rdgs,
Emily

Hi Colleen,
Actually I want to grant authorization on MM section by separate material group. It's to fulfil some special users are able to access particular material group. So I'm thinking to create new material group org value and distribute from the top level (org level). Could you advice if there is any method can achieve my purpose more safety or easily?
If I want to control some users access some particular material number which limited by control different material group. Can I just assign object: M_MATE_WGR and control the value for access? If yes, where to assign?
Rdgs,
Emily

Impact of creating org level for PERSA

Hi,
I am currently on a HCM project, and have been requested to make personnel area an org level. The security currently is working by Personnel area, with their org structure using location on personnel area, and subarea for region. Because we are not finished with the blueprint stage, i'm hesitant to create this, as the security is working on the testing I have done on the sandbox. Their reasoning is for using derived roles. HCM is only phase 1. So, wouldn't this need to be considered for every new project they implement? If deriving is neccessary, has anyone ever derived on Plan Version? Has anyone ever had problems with creating org levels? Any information would be appreciated, I've looked all over, and just want to make the best recommendation. Thank you.

Hi
I often change PERSA to org level, unless the customer is using structural profiles, as Rainer described just use the report PFCG_ORGFIELD_CREATE, but remember,you need to run this report for all the HR systems in your landscape - the change isn't transported, and if you forget, your role transports will fail.
Regarding the Plan Version org level - I have never seen it used
Regards
Morten

Impact of Addition of New Value Fields in the existing Op. Concern-COPA

Hi All,
Want to know the steps of adding new value fields in the existing operating concern in COPA?
What is the overall impact of addition of New Value fields in the running Operating Concern?
How do we test the addition of new value fields?
Is the addition of New Value fields to the running Operating Concern advisable?
Your support and advice is highly anticipated and appreciated.
Thanks & Regards
9819528669
Ohter details are as follows...
VALUE FIELDS : Defines the Structure of your Costs & Revenues. (Op. Concern 120 Value Fields)
1)     The client requires three new value fields to be created. Value fields for :
-     Other Airport Charges - International
-     Cargo Commission Cost
-     Personal Cost (Direct)
2)     What are the Steps involved in creation of new value fields? The steps are :
1)     Before creating new value field we need to check whether we can use already existing UNUSED value fields (There are 62 value fields created for the op concern 1000, in production the value fields TBUL1-L7 i.e. to be used (I assume) screen shot1 provided. My predecessor has used value field VV291, VV292, VV380 original description being TBUL3, TBUL4, and TBUL1. I believe he has changed the description in development client and created a transport request ref screen shot 2)
2)     You can create new value field thru T-Code KEA6 (4-5 characters beginning with VV) u2013 My predecessor has reused the value fields originally created he has not created new one I believe. please provide give your comments)
3)     Specify whether this field is for Currency or Quantity (currency defined in attribute of op concern and quantity defined by its own field u2013 unit of measure) u2013 My predecessor has configured the three value fields as Currency.
4)     Describe how the values in this field are aggregated over characteristics. (SUM, LAS, AVG) u2013 My predecessor has aggregated all the three value fields as SUM and they are in Active status.
5)     After the value field is created you have to add the value field (active status only) to the operating concern by Editing the Data Structure. (I guess this is done in the next step)
6)     Assign newly created Value fields to the Operating Concern u2013 T-Code KEA0 (In development client the value fields are assigned to the op concern 1000 refer screen shot 3. In the production client also those three value fields exist (does it mean they are assigned? your comments please.) As they have the original description TBUL3, TBUL4, and TBUL1 refer screen shot 4.
7)     After the Data Structure is defined you need to activate them. (creates plan vs actual database) u2013 Go to the data structure tab and Choose Activate. The status in dev client is Active with correct description but in the production client it is Active with the OLD description. After addition of the value field you need to regenerate the operating concern. T-Code KEA0 u2013 right?
8)     Condition Types are assigned to Value Fields? Donu2019t know u2013 T-Code KE45 (I think this is NOT required in our case u2013 Please give your comments)
9)     Define and Assign Valuation Strategy u2013 Cost assigned to Value fields u2013 T-Code KE4U (I think this is also NOT required in our case)
10)     Define PA Transfer Structure for Settlement u2013 T-Code KEI1 (This step is crucial u2013 I think I have to to include newly created value fields, but am not aware how to do it and what is the connectivity or what happens after this is done)
Note: My predecessor has created a Transport Request No# KEDK902167 for the value fields created by him.
3)     Whether my predecessor has performed all the steps for value field creation? How to test it and check that?
4)     If yes then, Do I need to perform additional configuration or can I proceed to transport it to Production?
5)     What is COPA Allocation Structure & PA Transfer Structure? Where and Why It is used?
6)     What are the different methods of cost and revenue allocations in SAP?
7)     I have checked the status of the value fields across clients, It is as followsu2026
     Value Field     Value Field For     Description     Development      Quality     Production
1     VV291     Other Airport Charges International     TBUL3     Exists      DNE     DNE
2     VV292     Cargo Commission Cost     TBUL4     Exists      DNE     DNE
3     VV380     Personal Cost u2013 Direct     TBUL1     Exists      DNE     DNE
#DNE : Does Not Exist (assumed since the description given to value field is not the same as in development client.)

HI sree,
ofter creation value field and saving that time reqwest number appeare copy the reqwest number and go through the se01 select that reqwest number select and transport click the truck symbole, and draft a mail to basis guyw.
Thank You!
Best Regards,
pradheep.

Adding New Org Units to Existing Organization Structure

Hi,
There is a change in the Org Structure, i.e we are adding new Org Units(Personnel Sub areas) to the existing Structure and creating postions to the newly created Org Units using PP01. Now my question is what are all things need to be configured with respect to Payroll, for the newly created PSA.
Rgds
Ram

Hi Ramakrishna,
Please be more clearer. PSAs are not org units. PSA belong to enterprise structure, whereas Org Unit belong to Org Structure. When you create new positions under the Org Units tht have been assigned to a PSA, PA, Company Code, Cost Center and Controlling area combination, you would have to set the following.
Group your PSA for,
Primary Wage Types
Premium
Work Schedule
Time Recording
Absence Attendence Type.
Assign Tax Area to a PSA(If it is US Payroll).
Any more suggestions from experts?
K

Adding a new Big INT column to existing table in production, which holds 700 million records will impact anything in production?

Hi Guys,
I have to add a new Big INT column to existing table in production, which holds 700 million records and would like to know the impact?
I have been tolled by one of my colleagues that last time they tried adding a column to same table during working hour and it locked out the table and impacted the users.
Please suggest/share If any one had similar experience.
Thanks Shiven:) If Answer is Helpful, Please Vote

If you add a new column to a table using an ALTER TABLE ADD command and specify that the new column allows NULLs and you do not define a default value, then it will take a table lock. However, once it gets the table lock, it will essentially run instantly
and then free the table lock. That will add this new column as the last column in the table, for example
ALTER MyTable ADD MyNewColumn bigint NULL;
But if you your change adds a new column with a default value, or you do something like using table designer to add the new column in the middle of the current list of columns, then SQL will have to rewrite the table. So it will get a table lock, rewrite
the whole table and then free the table lock. That will take a considerable amount of time and the table lock will be held for that whole period of time.
But, no matter how you make the change, if at all possible, I would not alter a table schema on a production database during working hours. Do it when nothing else is going on.
Tom

New Org Level impact in existing roles

Similar Messages

Maybe you are looking for